commit bd24b3addd46ff660d8ad6cc32a58aecd4715374 · pyrox.dev/nixpkgs

nixos/modules/module-list.nix

···

       560
        
         ./services/networking/ssh/lshd.nix

     

       561
        
         ./services/networking/ssh/sshd.nix

     

       562
        
         ./services/networking/strongswan.nix

     

       0
        
       
     

       563
        
         ./services/networking/stunnel.nix

     

       564
        
         ./services/networking/supplicant.nix

     

       565
        
         ./services/networking/supybot.nix

···

       560
        
         ./services/networking/ssh/lshd.nix

     

       561
        
         ./services/networking/ssh/sshd.nix

     

       562
        
         ./services/networking/strongswan.nix

     

       563
       +
         ./services/networking/strongswan-swanctl/module.nix

     

       564
        
         ./services/networking/stunnel.nix

     

       565
        
         ./services/networking/supplicant.nix

     

       566
        
         ./services/networking/supybot.nix

+80

nixos/modules/services/networking/strongswan-swanctl/module.nix

···

       1
       +
       { config, lib, pkgs, ... }:

     

       2
       +
       

     

       3
       +
       with lib;

     

       4
       +
       with (import ./param-lib.nix lib);

     

       5
       +
       

     

       6
       +
       let

     

       7
       +
         cfg = config.services.strongswan-swanctl;

     

       8
       +
       

     

       9
       +
         # TODO: auto-generate these files using:

     

       10
       +
         # https://github.com/strongswan/strongswan/tree/master/conf

     

       11
       +
         # IDEA: extend the format-options.py script to output these Nix files.

     

       12
       +
         strongswanParams = import ./strongswan-params.nix lib;

     

       13
       +
         swanctlParams    = import ./swanctl-params.nix    lib;

     

       14
       +
       in  {

     

       15
       +
         options.services.strongswan-swanctl = {

     

       16
       +
           enable = mkEnableOption "strongswan-swanctl service";

     

       17
       +
       

     

       18
       +
           package = mkOption {

     

       19
       +
             type = types.package;

     

       20
       +
             default = pkgs.strongswan;

     

       21
       +
             defaultText = "pkgs.strongswan";

     

       22
       +
             description = ''

     

       23
       +
               The strongswan derivation to use.

     

       24
       +
             '';

     

       25
       +
           };

     

       26
       +
       

     

       27
       +
           strongswan = paramsToOptions strongswanParams;

     

       28
       +
           swanctl    = paramsToOptions swanctlParams;

     

       29
       +
         };

     

       30
       +
       

     

       31
       +
         config = mkIf cfg.enable {

     

       32
       +
       

     

       33
       +
           assertions = [

     

       34
       +
             { assertion = !config.services.strongswan.enable;

     

       35
       +
               message = "cannot enable both services.strongswan and services.strongswan-swanctl. Choose either one.";

     

       36
       +
             }

     

       37
       +
           ];

     

       38
       +
       

     

       39
       +
           environment.etc."swanctl/swanctl.conf".text =

     

       40
       +
             paramsToConf cfg.swanctl swanctlParams;

     

       41
       +
       

     

       42
       +
           # The swanctl command complains when the following directories don't exist:

     

       43
       +
           # See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctldirectory

     

       44
       +
           system.activationScripts.strongswan-swanctl-etc = stringAfter ["etc"] ''

     

       45
       +
             mkdir -p '/etc/swanctl/x509'     # Trusted X.509 end entity certificates

     

       46
       +
             mkdir -p '/etc/swanctl/x509ca'   # Trusted X.509 Certificate Authority certificates

     

       47
       +
             mkdir -p '/etc/swanctl/x509ocsp'

     

       48
       +
             mkdir -p '/etc/swanctl/x509aa'   # Trusted X.509 Attribute Authority certificates

     

       49
       +
             mkdir -p '/etc/swanctl/x509ac'   # Attribute Certificates

     

       50
       +
             mkdir -p '/etc/swanctl/x509crl'  # Certificate Revocation Lists

     

       51
       +
             mkdir -p '/etc/swanctl/pubkey'   # Raw public keys

     

       52
       +
             mkdir -p '/etc/swanctl/private'  # Private keys in any format

     

       53
       +
             mkdir -p '/etc/swanctl/rsa'      # PKCS#1 encoded RSA private keys

     

       54
       +
             mkdir -p '/etc/swanctl/ecdsa'    # Plain ECDSA private keys

     

       55
       +
             mkdir -p '/etc/swanctl/bliss'

     

       56
       +
             mkdir -p '/etc/swanctl/pkcs8'    # PKCS#8 encoded private keys of any type

     

       57
       +
             mkdir -p '/etc/swanctl/pkcs12'   # PKCS#12 containers

     

       58
       +
           '';

     

       59
       +
       

     

       60
       +
           systemd.services.strongswan-swanctl = {

     

       61
       +
             description = "strongSwan IPsec IKEv1/IKEv2 daemon using swanctl";

     

       62
       +
             wantedBy = [ "multi-user.target" ];

     

       63
       +
             after    = [ "network-online.target" "keys.target" ];

     

       64
       +
             wants    = [ "keys.target" ];

     

       65
       +
             path = with pkgs; [ kmod iproute iptables utillinux ];

     

       66
       +
             environment.STRONGSWAN_CONF = pkgs.writeTextFile {

     

       67
       +
               name = "strongswan.conf";

     

       68
       +
               text = paramsToConf cfg.strongswan strongswanParams;

     

       69
       +
             };

     

       70
       +
             restartTriggers = [ config.environment.etc."swanctl/swanctl.conf".source ];

     

       71
       +
             serviceConfig = {

     

       72
       +
               ExecStart     = "${cfg.package}/sbin/charon-systemd";

     

       73
       +
               Type          = "notify";

     

       74
       +
               ExecStartPost = "${cfg.package}/sbin/swanctl --load-all --noprompt";

     

       75
       +
               ExecReload    = "${cfg.package}/sbin/swanctl --reload";

     

       76
       +
               Restart       = "on-abnormal";

     

       77
       +
             };

     

       78
       +
           };

     

       79
       +
         };

     

       80
       +
       }

+162

nixos/modules/services/networking/strongswan-swanctl/param-constructors.nix

···

       1
       +
       # In the following context a parameter is an attribute set that

     

       2
       +
       # contains a NixOS option and a render function. It also contains the

     

       3
       +
       # attribute: '_type = "param"' so we can distinguish it from other

     

       4
       +
       # sets.

     

       5
       +
       #

     

       6
       +
       # The render function is used to convert the value of the option to a

     

       7
       +
       # snippet of strongswan.conf. Most parameters simply render their

     

       8
       +
       # value to a string. For example, take the following parameter:

     

       9
       +
       #

     

       10
       +
       #   threads = mkIntParam 10 "Threads to use for request handling.";

     

       11
       +
       #

     

       12
       +
       # When a users defines the corresponding option as for example:

     

       13
       +
       #

     

       14
       +
       #   services.strongswan-swanctl.strongswan.threads = 32;

     

       15
       +
       #

     

       16
       +
       # It will get rendered to the following snippet in strongswan.conf:

     

       17
       +
       #

     

       18
       +
       #   threads = 32

     

       19
       +
       #

     

       20
       +
       # Some parameters however need to be able to change the attribute

     

       21
       +
       # name. For example, take the following parameter:

     

       22
       +
       #

     

       23
       +
       #   id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") "...";

     

       24
       +
       #

     

       25
       +
       # A user can define the corresponding option as for example:

     

       26
       +
       #

     

       27
       +
       #   id = {

     

       28
       +
       #     "foo" = "bar";

     

       29
       +
       #     "baz" = "qux";

     

       30
       +
       #   };

     

       31
       +
       #

     

       32
       +
       # This will get rendered to the following snippet:

     

       33
       +
       #

     

       34
       +
       #   foo-id = bar

     

       35
       +
       #   baz-id = qux

     

       36
       +
       #

     

       37
       +
       # For this reason the render function is not simply a function from

     

       38
       +
       # value -> string but a function from a value to an attribute set:

     

       39
       +
       # { "${name}" = string }. This allows parameters to change the attribute

     

       40
       +
       # name like in the previous example.

     

       41
       +
       

     

       42
       +
       lib :

     

       43
       +
       

     

       44
       +
       with lib;

     

       45
       +
       with (import ./param-lib.nix lib);

     

       46
       +
       

     

       47
       +
       rec {

     

       48
       +
         mkParamOfType = type : strongswanDefault : description : {

     

       49
       +
           _type = "param";

     

       50
       +
           option = mkOption {

     

       51
       +
             type = types.nullOr type;

     

       52
       +
             default = null;

     

       53
       +
             description = documentDefault description strongswanDefault;

     

       54
       +
           };

     

       55
       +
           render = single toString;

     

       56
       +
         };

     

       57
       +
       

     

       58
       +
         documentDefault = description : strongswanDefault :

     

       59
       +
           if isNull strongswanDefault

     

       60
       +
           then description

     

       61
       +
           else description + ''

     

       62
       +
             </para><para>

     

       63
       +
             StrongSwan default: <literal><![CDATA[${builtins.toJSON strongswanDefault}]]></literal>

     

       64
       +
           '';

     

       65
       +
       

     

       66
       +
         single = f: name: value: { "${name}" = f value; };

     

       67
       +
       

     

       68
       +
         mkStrParam         = mkParamOfType types.str;

     

       69
       +
         mkOptionalStrParam = mkStrParam null;

     

       70
       +
       

     

       71
       +
         mkEnumParam = values : mkParamOfType (types.enum values);

     

       72
       +
       

     

       73
       +
         mkIntParam         = mkParamOfType types.int;

     

       74
       +
         mkOptionalIntParam = mkIntParam null;

     

       75
       +
       

     

       76
       +
         # We should have floats in Nix...

     

       77
       +
         mkFloatParam = mkStrParam;

     

       78
       +
       

     

       79
       +
         # TODO: Check for hex format:

     

       80
       +
         mkHexParam         = mkStrParam;

     

       81
       +
         mkOptionalHexParam = mkOptionalStrParam;

     

       82
       +
       

     

       83
       +
         # TODO: Check for duration format:

     

       84
       +
         mkDurationParam         = mkStrParam;

     

       85
       +
         mkOptionalDurationParam = mkOptionalStrParam;

     

       86
       +
       

     

       87
       +
         mkYesNoParam = strongswanDefault : description : {

     

       88
       +
           _type = "param";

     

       89
       +
           option = mkOption {

     

       90
       +
             type = types.nullOr types.bool;

     

       91
       +
             default = null;

     

       92
       +
             description = documentDefault description strongswanDefault;

     

       93
       +
           };

     

       94
       +
           render = single (b: if b then "yes" else "no");

     

       95
       +
         };

     

       96
       +
         yes = true;

     

       97
       +
         no  = false;

     

       98
       +
       

     

       99
       +
         mkSpaceSepListParam = mkSepListParam " ";

     

       100
       +
         mkCommaSepListParam = mkSepListParam ",";

     

       101
       +
       

     

       102
       +
         mkSepListParam = sep : strongswanDefault : description : {

     

       103
       +
           _type = "param";

     

       104
       +
           option = mkOption {

     

       105
       +
             type = types.nullOr (types.listOf types.str);

     

       106
       +
             default = null;

     

       107
       +
             description = documentDefault description strongswanDefault;

     

       108
       +
           };

     

       109
       +
           render = single (value: concatStringsSep sep value);

     

       110
       +
         };

     

       111
       +
       

     

       112
       +
         mkAttrsOfParams = params :

     

       113
       +
           mkAttrsOf params (types.submodule {options = paramsToOptions params;});

     

       114
       +
       

     

       115
       +
         mkAttrsOfParam = param :

     

       116
       +
           mkAttrsOf param param.option.type;

     

       117
       +
       

     

       118
       +
         mkAttrsOf = param : option : description : {

     

       119
       +
           _type = "param";

     

       120
       +
           option = mkOption {

     

       121
       +
             type = types.attrsOf option;

     

       122
       +
             default = {};

     

       123
       +
             inherit description;

     

       124
       +
           };

     

       125
       +
           render = single (attrs:

     

       126
       +
             (paramsToRenderedStrings attrs

     

       127
       +
               (mapAttrs (_n: _v: param) attrs)));

     

       128
       +
         };

     

       129
       +
       

     

       130
       +
         mkPrefixedAttrsOfParams = params :

     

       131
       +
           mkPrefixedAttrsOf params (types.submodule {options = paramsToOptions params;});

     

       132
       +
       

     

       133
       +
         mkPrefixedAttrsOfParam = param :

     

       134
       +
           mkPrefixedAttrsOf param param.option.type;

     

       135
       +
       

     

       136
       +
         mkPrefixedAttrsOf = p : option : description : {

     

       137
       +
           _type = "param";

     

       138
       +
           option = mkOption {

     

       139
       +
             type = types.attrsOf option;

     

       140
       +
             default = {};

     

       141
       +
             inherit description;

     

       142
       +
           };

     

       143
       +
           render = prefix: attrs:

     

       144
       +
             let prefixedAttrs = mapAttrs' (name: nameValuePair "${prefix}-${name}") attrs;

     

       145
       +
             in paramsToRenderedStrings prefixedAttrs

     

       146
       +
                  (mapAttrs (_n: _v: p) prefixedAttrs);

     

       147
       +
         };

     

       148
       +
       

     

       149
       +
         mkPostfixedAttrsOfParams = params : description : {

     

       150
       +
           _type = "param";

     

       151
       +
           option = mkOption {

     

       152
       +
             type = types.attrsOf (types.submodule {options = paramsToOptions params;});

     

       153
       +
             default = {};

     

       154
       +
             inherit description;

     

       155
       +
           };

     

       156
       +
           render = postfix: attrs:

     

       157
       +
             let postfixedAttrs = mapAttrs' (name: nameValuePair "${name}-${postfix}") attrs;

     

       158
       +
             in paramsToRenderedStrings postfixedAttrs

     

       159
       +
                  (mapAttrs (_n: _v: params) postfixedAttrs);

     

       160
       +
         };

     

       161
       +
       

     

       162
       +
       }

+82

nixos/modules/services/networking/strongswan-swanctl/param-lib.nix

···

       1
       +
       lib :

     

       2
       +
       

     

       3
       +
       with lib;

     

       4
       +
       

     

       5
       +
       rec {

     

       6
       +
         paramsToConf = cfg : ps : mkConf 0 (paramsToRenderedStrings cfg ps);

     

       7
       +
       

     

       8
       +
         # mkConf takes an indentation level (which usually starts at 0) and a nested

     

       9
       +
         # attribute set of strings and will render that set to a strongswan.conf style

     

       10
       +
         # configuration format. For example:

     

       11
       +
         #

     

       12
       +
         #   mkConf 0 {a = "1"; b = { c = { "foo" = "2"; "bar" = "3"; }; d = "4";};}   =>   ''

     

       13
       +
         #   a = 1

     

       14
       +
         #   b {

     

       15
       +
         #     c {

     

       16
       +
         #       foo = 2

     

       17
       +
         #       bar = 3

     

       18
       +
         #     }

     

       19
       +
         #     d = 4

     

       20
       +
         #   }''

     

       21
       +
         mkConf = indent : ps :

     

       22
       +
           concatMapStringsSep "\n"

     

       23
       +
             (name:

     

       24
       +
               let value = ps."${name}";

     

       25
       +
                   indentation = replicate indent " ";

     

       26
       +
               in

     

       27
       +
               indentation + (

     

       28
       +
                 if isAttrs value

     

       29
       +
                 then "${name} {\n" +

     

       30
       +
                        mkConf (indent + 2) value + "\n" +

     

       31
       +
                      indentation + "}"

     

       32
       +
                 else "${name} = ${value}"

     

       33
       +
               )

     

       34
       +
             )

     

       35
       +
             (attrNames ps);

     

       36
       +
       

     

       37
       +
         replicate = n : c : concatStrings (builtins.genList (_x : c) n);

     

       38
       +
       

     

       39
       +
         # `paramsToRenderedStrings cfg ps` converts the NixOS configuration `cfg`

     

       40
       +
         # (typically the "config" argument of a NixOS module) and the set of

     

       41
       +
         # parameters `ps` (an attribute set where the values are constructed using the

     

       42
       +
         # parameter constructors in ./param-constructors.nix) to a nested attribute

     

       43
       +
         # set of strings (rendered parameters).

     

       44
       +
         paramsToRenderedStrings = cfg : ps :

     

       45
       +
           filterEmptySets (

     

       46
       +
             (mapParamsRecursive (path: name: param:

     

       47
       +
               let value = attrByPath path null cfg;

     

       48
       +
               in optionalAttrs (!isNull value) (param.render name value)

     

       49
       +
             ) ps));

     

       50
       +
       

     

       51
       +
         filterEmptySets = set : filterAttrs (n: v: !(isNull v)) (mapAttrs (name: value:

     

       52
       +
           if isAttrs value

     

       53
       +
           then let value' = filterEmptySets value;

     

       54
       +
                in if value' == {}

     

       55
       +
                   then null

     

       56
       +
                   else value'

     

       57
       +
           else value

     

       58
       +
         ) set);

     

       59
       +
       

     

       60
       +
         # Recursively map over every parameter in the given attribute set.

     

       61
       +
         mapParamsRecursive = mapAttrsRecursiveCond' (as: (!(as ? "_type" && as._type == "param")));

     

       62
       +
       

     

       63
       +
         mapAttrsRecursiveCond' = cond: f: set:

     

       64
       +
           let

     

       65
       +
             recurse = path: set:

     

       66
       +
               let

     

       67
       +
                 g =

     

       68
       +
                   name: value:

     

       69
       +
                   if isAttrs value && cond value

     

       70
       +
                     then { "${name}" = recurse (path ++ [name]) value; }

     

       71
       +
                     else f (path ++ [name]) name value;

     

       72
       +
               in mapAttrs'' g set;

     

       73
       +
           in recurse [] set;

     

       74
       +
       

     

       75
       +
         mapAttrs'' = f: set:

     

       76
       +
           foldl' (a: b: a // b) {} (map (attr: f attr set.${attr}) (attrNames set));

     

       77
       +
       

     

       78
       +
         # Extract the options from the given set of parameters.

     

       79
       +
         paramsToOptions = ps :

     

       80
       +
           mapParamsRecursive (_path: name: param: { "${name}" = param.option; }) ps;

     

       81
       +
       

     

       82
       +
       }

+568

nixos/modules/services/networking/strongswan-swanctl/strongswan-charon-params.nix

···

       1
       +
       lib: with (import ./param-constructors.nix lib);

     

       2
       +
       

     

       3
       +
       let loglevelParams = import ./strongswan-loglevel-params.nix lib;

     

       4
       +
       in {

     

       5
       +
         accept_unencrypted_mainmode_messages = mkYesNoParam no ''

     

       6
       +
           Accept unencrypted ID and HASH payloads in IKEv1 Main Mode. Some

     

       7
       +
           implementations send the third Main Mode message unencrypted, probably

     

       8
       +
           to find the PSKs for the specified ID for authentication. This is very

     

       9
       +
           similar to Aggressive Mode, and has the same security implications: A

     

       10
       +
           passive attacker can sniff the negotiated Identity, and start brute

     

       11
       +
           forcing the PSK using the HASH payload. It is recommended to keep this

     

       12
       +
           option to no, unless you know exactly what the implications are and

     

       13
       +
           require compatibility to such devices (for example, some SonicWall

     

       14
       +
           boxes).

     

       15
       +
         '';

     

       16
       +
       

     

       17
       +
         block_threshold = mkIntParam 5 ''

     

       18
       +
           Maximum number of half-open IKE_SAs for a single peer IP.

     

       19
       +
         '';

     

       20
       +
       

     

       21
       +
         cache_crls = mkYesNoParam no ''

     

       22
       +
           Whether Certicate Revocation Lists (CRLs) fetched via HTTP or LDAP

     

       23
       +
           should be saved under a unique file name derived from the public

     

       24
       +
           key of the Certification Authority (CA) to

     

       25
       +
           <literal>/etc/ipsec.d/crls</literal> (stroke) or

     

       26
       +
           <literal>/etc/swanctl/x509crl</literal> (vici), respectively.

     

       27
       +
         '';

     

       28
       +
       

     

       29
       +
         cert_cache = mkYesNoParam yes ''

     

       30
       +
           Whether relations in validated certificate chains should be cached in memory.

     

       31
       +
         '';

     

       32
       +
       

     

       33
       +
         cisco_unity = mkYesNoParam no ''

     

       34
       +
           Send Cisco Unity vendor ID payload (IKEv1 only), see unity plugin.

     

       35
       +
         '';

     

       36
       +
       

     

       37
       +
         close_ike_on_child_failure = mkYesNoParam no ''

     

       38
       +
           Close the IKE_SA if setup of the CHILD_SA along with IKE_AUTH failed.

     

       39
       +
         '';

     

       40
       +
       

     

       41
       +
         cookie_threshold = mkIntParam 10 ''

     

       42
       +
           Number of half-open IKE_SAs that activate the cookie mechanism.

     

       43
       +
         '';

     

       44
       +
       

     

       45
       +
         crypto_test.bench = mkYesNoParam no ''

     

       46
       +
           Benchmark crypto algorithms and order them by efficiency.

     

       47
       +
         '';

     

       48
       +
       

     

       49
       +
         crypto_test.bench_size = mkIntParam 1024 ''

     

       50
       +
           Buffer size used for crypto benchmark.

     

       51
       +
         '';

     

       52
       +
       

     

       53
       +
         crypto_test.bench_time = mkIntParam 50 ''

     

       54
       +
           Number of iterations to test each algorithm.

     

       55
       +
         '';

     

       56
       +
       

     

       57
       +
         crypto_test.on_add = mkYesNoParam no ''

     

       58
       +
           Test crypto algorithms during registration

     

       59
       +
           (requires test vectors provided by the test-vectors plugin).

     

       60
       +
         '';

     

       61
       +
       

     

       62
       +
         crypto_test.on_create = mkYesNoParam no ''

     

       63
       +
           Test crypto algorithms on each crypto primitive instantiation.

     

       64
       +
         '';

     

       65
       +
       

     

       66
       +
         crypto_test.required = mkYesNoParam no ''

     

       67
       +
           Strictly require at least one test vector to enable an algorithm.

     

       68
       +
         '';

     

       69
       +
       

     

       70
       +
         crypto_test.rng_true = mkYesNoParam no ''

     

       71
       +
           Whether to test RNG with TRUE quality; requires a lot of entropy.

     

       72
       +
         '';

     

       73
       +
       

     

       74
       +
         delete_rekeyed = mkYesNoParam no ''

     

       75
       +
           Delete CHILD_SAs right after they got successfully rekeyed (IKEv1 only).

     

       76
       +
           Reduces the number of stale CHILD_SAs in scenarios with a lot of rekeyings.

     

       77
       +
           However, this might cause problems with implementations that continue

     

       78
       +
           to use rekeyed SAs until they expire.

     

       79
       +
         '';

     

       80
       +
       

     

       81
       +
         delete_rekeyed_delay = mkIntParam 5 ''

     

       82
       +
           Delay in seconds until inbound IPsec SAs are deleted after rekeyings

     

       83
       +
           (IKEv2 only).

     

       84
       +
           </para><para>

     

       85
       +
           To process delayed packets the inbound part of a CHILD_SA is kept

     

       86
       +
           installed up to the configured number of seconds after it got replaced

     

       87
       +
           during a rekeying. If set to 0 the CHILD_SA will be kept installed until

     

       88
       +
           it expires (if no lifetime is set it will be destroyed immediately).

     

       89
       +
         '';

     

       90
       +
       

     

       91
       +
         dh_exponent_ansi_x9_42 = mkYesNoParam yes ''

     

       92
       +
           Use ANSI X9.42 DH exponent size or optimum size matched to

     

       93
       +
           cryptographical strength.

     

       94
       +
         '';

     

       95
       +
       

     

       96
       +
         dlopen_use_rtld_now = mkYesNoParam no ''

     

       97
       +
           Use RTLD_NOW with dlopen() when loading plugins and IMV/IMCs to reveal

     

       98
       +
           missing symbols immediately. Useful during development of custom plugins.

     

       99
       +
         '';

     

       100
       +
       

     

       101
       +
         dns1 = mkOptionalStrParam ''

     

       102
       +
           DNS server assigned to peer via configuration payload (CP), see attr plugin.

     

       103
       +
         '';

     

       104
       +
       

     

       105
       +
         dns2 = mkOptionalStrParam ''

     

       106
       +
           DNS server assigned to peer via configuration payload (CP).

     

       107
       +
         '';

     

       108
       +
       

     

       109
       +
         dos_protection = mkYesNoParam yes ''

     

       110
       +
           Enable Denial of Service protection using cookies and aggressiveness checks.

     

       111
       +
         '';

     

       112
       +
       

     

       113
       +
         ecp_x_coordinate_only = mkYesNoParam yes ''

     

       114
       +
           Compliance with the errata for RFC 4753.

     

       115
       +
         '';

     

       116
       +
       

     

       117
       +
         filelog = mkAttrsOfParams ({

     

       118
       +
           append = mkYesNoParam yes ''

     

       119
       +
             If this option is enabled log entries are appended to the existing file.

     

       120
       +
           '';

     

       121
       +
       

     

       122
       +
           flush_line = mkYesNoParam no ''

     

       123
       +
             Enabling this option disables block buffering and enables line

     

       124
       +
             buffering. That is, a flush to disk is enforced for each logged line.

     

       125
       +
           '';

     

       126
       +
       

     

       127
       +
           ike_name = mkYesNoParam no ''

     

       128
       +
             Prefix each log entry with the connection name and a unique numerical

     

       129
       +
             identifier for each IKE_SA.

     

       130
       +
           '';

     

       131
       +
       

     

       132
       +
           time_format = mkOptionalStrParam ''

     

       133
       +
             Prefix each log entry with a timestamp. The option accepts a format string

     

       134
       +
             as passed to strftime(3).

     

       135
       +
           '';

     

       136
       +
       

     

       137
       +
           time_add_ms = mkYesNoParam no ''

     

       138
       +
             Adds the milliseconds within the current second after the timestamp

     

       139
       +
             (separated by a dot, so time_format should end with %S or %T)

     

       140
       +
           '';

     

       141
       +
         } // loglevelParams) ''Section to define file loggers, see LoggerConfiguration.'';

     

       142
       +
       

     

       143
       +
         flush_auth_cfg = mkYesNoParam no ''

     

       144
       +
           If enabled objects used during authentication (certificates, identities

     

       145
       +
           etc.) are released to free memory once an IKE_SA is

     

       146
       +
           established. Enabling this might conflict with plugins that later need

     

       147
       +
           access to e.g. the used certificates.

     

       148
       +
         '';

     

       149
       +
       

     

       150
       +
         follow_redirects = mkYesNoParam yes ''

     

       151
       +
           Whether to follow IKEv2 redirects (RFC 5685).

     

       152
       +
         '';

     

       153
       +
       

     

       154
       +
         fragment_size = mkIntParam 1280 ''

     

       155
       +
           Maximum size (complete IP datagram size in bytes) of a sent IKE fragment

     

       156
       +
           when using proprietary IKEv1 or standardized IKEv2 fragmentation,

     

       157
       +
           defaults to 1280 (use 0 for address family specific default values,

     

       158
       +
           which uses a lower value for IPv4). If specified this limit is used for

     

       159
       +
           both IPv4 and IPv6.

     

       160
       +
         '';

     

       161
       +
       

     

       162
       +
         group = mkOptionalStrParam ''

     

       163
       +
           Name of the group the daemon changes to after startup.

     

       164
       +
         '';

     

       165
       +
       

     

       166
       +
         half_open_timeout = mkIntParam 30 ''

     

       167
       +
           Timeout in seconds for connecting IKE_SAs, also see IKE_SA_INIT dropping.

     

       168
       +
         '';

     

       169
       +
       

     

       170
       +
         hash_and_url = mkYesNoParam no ''

     

       171
       +
           Enable hash and URL support.

     

       172
       +
         '';

     

       173
       +
       

     

       174
       +
         host_resolver.max_threads = mkIntParam 3 ''

     

       175
       +
           Maximum number of concurrent resolver threads (they are terminated if unused).

     

       176
       +
         '';

     

       177
       +
       

     

       178
       +
         host_resolver.min_threads = mkIntParam 0 ''

     

       179
       +
           Minimum number of resolver threads to keep around.

     

       180
       +
         '';

     

       181
       +
       

     

       182
       +
         i_dont_care_about_security_and_use_aggressive_mode_psk = mkYesNoParam no ''

     

       183
       +
           If enabled responders are allowed to use IKEv1 Aggressive Mode with

     

       184
       +
           pre-shared keys, which is discouraged due to security concerns (offline

     

       185
       +
           attacks on the openly transmitted hash of the PSK).

     

       186
       +
         '';

     

       187
       +
       

     

       188
       +
         ignore_acquire_ts = mkYesNoParam no ''

     

       189
       +
           If this is disabled the traffic selectors from the kernel's acquire

     

       190
       +
           events, which are derived from the triggering packet, are prepended to

     

       191
       +
           the traffic selectors from the configuration for IKEv2 connection. By

     

       192
       +
           enabling this, such specific traffic selectors will be ignored and only

     

       193
       +
           the ones in the config will be sent. This always happens for IKEv1

     

       194
       +
           connections as the protocol only supports one set of traffic selectors

     

       195
       +
           per CHILD_SA.

     

       196
       +
         '';

     

       197
       +
       

     

       198
       +
         ignore_routing_tables = mkSpaceSepListParam [] ''

     

       199
       +
           A space-separated list of routing tables to be excluded from route lookup.

     

       200
       +
         '';

     

       201
       +
       

     

       202
       +
         ikesa_limit = mkIntParam 0 ''

     

       203
       +
           Maximum number of IKE_SAs that can be established at the same time

     

       204
       +
           before new connection attempts are blocked.

     

       205
       +
         '';

     

       206
       +
       

     

       207
       +
         ikesa_table_segments = mkIntParam 1 ''

     

       208
       +
           Number of exclusively locked segments in the hash table, see IKE_SA

     

       209
       +
           lookup tuning.

     

       210
       +
         '';

     

       211
       +
       

     

       212
       +
         ikesa_table_size = mkIntParam 1 ''

     

       213
       +
           Size of the IKE_SA hash table, see IKE_SA lookup tuning.

     

       214
       +
         '';

     

       215
       +
       

     

       216
       +
         inactivity_close_ike = mkYesNoParam no ''

     

       217
       +
           Whether to close IKE_SA if the only CHILD_SA closed due to inactivity.

     

       218
       +
         '';

     

       219
       +
       

     

       220
       +
         init_limit_half_open = mkIntParam 0 ''

     

       221
       +
           Limit new connections based on the current number of half open IKE_SAs,

     

       222
       +
           see IKE_SA_INIT dropping.

     

       223
       +
         '';

     

       224
       +
       

     

       225
       +
         init_limit_job_load = mkIntParam 0 ''

     

       226
       +
           Limit new connections based on the number of jobs currently queued for

     

       227
       +
           processing, see IKE_SA_INIT dropping.

     

       228
       +
         '';

     

       229
       +
       

     

       230
       +
         initiator_only = mkYesNoParam no ''

     

       231
       +
           Causes charon daemon to ignore IKE initiation requests.

     

       232
       +
         '';

     

       233
       +
       

     

       234
       +
         install_routes = mkYesNoParam yes ''

     

       235
       +
           Install routes into a separate routing table for established IPsec

     

       236
       +
           tunnels. If disabled a more efficient lookup for source and next-hop

     

       237
       +
           addresses is used since 5.5.2.

     

       238
       +
         '';

     

       239
       +
       

     

       240
       +
         install_virtual_ip = mkYesNoParam yes ''

     

       241
       +
           Install virtual IP addresses.

     

       242
       +
         '';

     

       243
       +
       

     

       244
       +
         install_virtual_ip_on = mkOptionalStrParam ''

     

       245
       +
           The name of the interface on which virtual IP addresses should be

     

       246
       +
           installed. If not specified the addresses will be installed on the

     

       247
       +
           outbound interface.

     

       248
       +
         '';

     

       249
       +
       

     

       250
       +
         integrity_test = mkYesNoParam no ''

     

       251
       +
           Check daemon, libstrongswan and plugin integrity at startup.

     

       252
       +
         '';

     

       253
       +
       

     

       254
       +
         interfaces_ignore = mkCommaSepListParam [] ''

     

       255
       +
           List of network interfaces that should be ignored, if

     

       256
       +
           <option>interfaces_use</option> is specified this option has no effect.

     

       257
       +
         '';

     

       258
       +
       

     

       259
       +
         interfaces_use = mkCommaSepListParam [] ''

     

       260
       +
           List of network interfaces that should be used by

     

       261
       +
           charon. All other interfaces are ignored.

     

       262
       +
         '';

     

       263
       +
       

     

       264
       +
         keep_alive = mkIntParam 20 ''

     

       265
       +
           NAT keep alive interval in seconds.

     

       266
       +
         '';

     

       267
       +
       

     

       268
       +
         leak_detective.detailed = mkYesNoParam yes ''

     

       269
       +
           Includes source file names and line numbers in leak detective output.

     

       270
       +
         '';

     

       271
       +
       

     

       272
       +
         leak_detective.usage_threshold = mkIntParam 10240 ''

     

       273
       +
           Threshold in bytes for leaks to be reported (0 to report all).

     

       274
       +
         '';

     

       275
       +
       

     

       276
       +
         leak_detective.usage_threshold_count = mkIntParam 0 ''

     

       277
       +
           Threshold in number of allocations for leaks to be reported (0 to report

     

       278
       +
           all).

     

       279
       +
         '';

     

       280
       +
       

     

       281
       +
         load = mkSpaceSepListParam [] ''

     

       282
       +
           Plugins to load in IKEv2 charon daemon, see PluginLoad.

     

       283
       +
         '';

     

       284
       +
       

     

       285
       +
         load_modular = mkYesNoParam no ''

     

       286
       +
           If enabled the list of plugins to load is determined by individual load

     

       287
       +
           settings for each plugin, see PluginLoad.

     

       288
       +
         '';

     

       289
       +
       

     

       290
       +
         make_before_break = mkYesNoParam no ''

     

       291
       +
           Initiate IKEv2 reauthentication with a make-before-break instead of a

     

       292
       +
           break-before-make scheme. Make-before-break uses overlapping IKE and

     

       293
       +
           CHILD_SA during reauthentication by first recreating all new SAs before

     

       294
       +
           deleting the old ones. This behavior can be beneficial to avoid

     

       295
       +
           connectivity gaps during reauthentication, but requires support for

     

       296
       +
           overlapping SAs by the peer. strongSwan can handle such overlapping SAs

     

       297
       +
           since 5.3.0.

     

       298
       +
         '';

     

       299
       +
       

     

       300
       +
         max_ikev1_exchanges = mkIntParam 3 ''

     

       301
       +
           Maximum number of IKEv1 phase 2 exchanges per IKE_SA to keep state about

     

       302
       +
           and track concurrently.

     

       303
       +
         '';

     

       304
       +
       

     

       305
       +
         max_packet = mkIntParam 10000 ''

     

       306
       +
           Maximum packet size accepted by charon.

     

       307
       +
         '';

     

       308
       +
       

     

       309
       +
         multiple_authentication = mkYesNoParam yes ''

     

       310
       +
           Enable multiple authentication exchanges (RFC 4739).

     

       311
       +
         '';

     

       312
       +
       

     

       313
       +
         nbns1 = mkOptionalStrParam ''

     

       314
       +
           WINS server assigned to peer via configuration payload (CP), see attr

     

       315
       +
           plugin.

     

       316
       +
         '';

     

       317
       +
       

     

       318
       +
         nbns2 = mkOptionalStrParam ''

     

       319
       +
           WINS server assigned to peer via configuration payload (CP).

     

       320
       +
         '';

     

       321
       +
       

     

       322
       +
         port = mkIntParam 500 ''

     

       323
       +
           UDP port used locally. If set to 0 a random port will be allocated.

     

       324
       +
         '';

     

       325
       +
       

     

       326
       +
         port_nat_t = mkIntParam 4500 ''

     

       327
       +
           UDP port used locally in case of NAT-T. If set to 0 a random port will

     

       328
       +
           be allocated. Has to be different from charon.port, otherwise a random

     

       329
       +
           port will be allocated.

     

       330
       +
         '';

     

       331
       +
       

     

       332
       +
         prefer_best_path = mkYesNoParam no ''

     

       333
       +
           By default, charon keeps SAs on the routing path with addresses it

     

       334
       +
           previously used if that path is still usable. By enabling this option,

     

       335
       +
           it tries more aggressively to update SAs with MOBIKE on routing priority

     

       336
       +
           changes using the cheapest path. This adds more noise, but allows to

     

       337
       +
           dynamically adapt SAs to routing priority changes. This option has no

     

       338
       +
           effect if MOBIKE is not supported or disabled.

     

       339
       +
         '';

     

       340
       +
       

     

       341
       +
         prefer_configured_proposals = mkYesNoParam yes ''

     

       342
       +
           Prefer locally configured proposals for IKE/IPsec over supplied ones as

     

       343
       +
           responder (disabling this can avoid keying retries due to

     

       344
       +
           INVALID_KE_PAYLOAD notifies).

     

       345
       +
         '';

     

       346
       +
       

     

       347
       +
         prefer_temporary_addrs = mkYesNoParam no ''

     

       348
       +
           By default public IPv6 addresses are preferred over temporary ones

     

       349
       +
           (according to RFC 4941), to make connections more stable. Enable this

     

       350
       +
           option to reverse this.

     

       351
       +
         '';

     

       352
       +
       

     

       353
       +
         process_route = mkYesNoParam yes ''

     

       354
       +
           Process RTM_NEWROUTE and RTM_DELROUTE events.

     

       355
       +
         '';

     

       356
       +
       

     

       357
       +
         processor.priority_threads = {

     

       358
       +
           critical = mkIntParam 0 ''

     

       359
       +
             Threads reserved for CRITICAL priority class jobs.

     

       360
       +
           '';

     

       361
       +
       

     

       362
       +
           high = mkIntParam 0 ''

     

       363
       +
             Threads reserved for HIGH priority class jobs.

     

       364
       +
           '';

     

       365
       +
       

     

       366
       +
           medium = mkIntParam 0 ''

     

       367
       +
             Threads reserved for MEDIUM priority class jobs.

     

       368
       +
           '';

     

       369
       +
       

     

       370
       +
           low = mkIntParam 0 ''

     

       371
       +
             Threads reserved for LOW priority class jobs.

     

       372
       +
           '';

     

       373
       +
         };

     

       374
       +
       

     

       375
       +
         receive_delay = mkIntParam 0 ''

     

       376
       +
           Delay in ms for receiving packets, to simulate larger RTT.

     

       377
       +
         '';

     

       378
       +
       

     

       379
       +
         receive_delay_response = mkYesNoParam yes ''

     

       380
       +
           Delay response messages.

     

       381
       +
         '';

     

       382
       +
       

     

       383
       +
         receive_delay_request = mkYesNoParam yes ''

     

       384
       +
           Delay request messages.

     

       385
       +
         '';

     

       386
       +
       

     

       387
       +
         receive_delay_type = mkIntParam 0 ''

     

       388
       +
           Specific IKEv2 message type to delay, 0 for any.

     

       389
       +
         '';

     

       390
       +
       

     

       391
       +
         replay_window = mkIntParam 32 ''

     

       392
       +
           Size of the AH/ESP replay window, in packets.

     

       393
       +
         '';

     

       394
       +
       

     

       395
       +
         retransmit_base = mkFloatParam "1.8" ''

     

       396
       +
           Base to use for calculating exponential back off, see Retransmission.

     

       397
       +
         '';

     

       398
       +
       

     

       399
       +
         retransmit_jitter = mkIntParam 0 ''

     

       400
       +
           Maximum jitter in percent to apply randomly to calculated retransmission

     

       401
       +
           timeout (0 to disable).

     

       402
       +
         '';

     

       403
       +
       

     

       404
       +
         retransmit_limit = mkIntParam 0 ''

     

       405
       +
           Upper limit in seconds for calculated retransmission timeout (0 to

     

       406
       +
           disable).

     

       407
       +
         '';

     

       408
       +
       

     

       409
       +
         retransmit_timeout = mkFloatParam "4.0" ''

     

       410
       +
           Timeout in seconds before sending first retransmit.

     

       411
       +
         '';

     

       412
       +
       

     

       413
       +
         retransmit_tries = mkIntParam 5 ''

     

       414
       +
           Number of times to retransmit a packet before giving up.

     

       415
       +
         '';

     

       416
       +
       

     

       417
       +
         retry_initiate_interval = mkIntParam 0 ''

     

       418
       +
           Interval in seconds to use when retrying to initiate an IKE_SA (e.g. if

     

       419
       +
           DNS resolution failed), 0 to disable retries.

     

       420
       +
         '';

     

       421
       +
       

     

       422
       +
         reuse_ikesa = mkYesNoParam yes ''

     

       423
       +
           Initiate CHILD_SA within existing IKE_SAs (always enabled for IKEv1).

     

       424
       +
         '';

     

       425
       +
       

     

       426
       +
         routing_table = mkIntParam 220 ''

     

       427
       +
           Numerical routing table to install routes to.

     

       428
       +
         '';

     

       429
       +
       

     

       430
       +
         routing_table_prio = mkIntParam 220 ''

     

       431
       +
           Priority of the routing table.

     

       432
       +
         '';

     

       433
       +
       

     

       434
       +
         send_delay = mkIntParam 0 ''

     

       435
       +
           Delay in ms for sending packets, to simulate larger RTT.

     

       436
       +
         '';

     

       437
       +
       

     

       438
       +
         send_delay_request = mkYesNoParam yes ''

     

       439
       +
           Delay request messages.

     

       440
       +
         '';

     

       441
       +
       

     

       442
       +
         send_delay_response = mkYesNoParam yes ''

     

       443
       +
           Delay response messages.

     

       444
       +
         '';

     

       445
       +
       

     

       446
       +
         send_delay_type = mkIntParam 0 ''

     

       447
       +
           Specific IKEv2 message type to delay, 0 for any.

     

       448
       +
         '';

     

       449
       +
       

     

       450
       +
         send_vendor_id = mkYesNoParam no ''

     

       451
       +
           Send strongSwan vendor ID payload.

     

       452
       +
         '';

     

       453
       +
       

     

       454
       +
         signature_authentication = mkYesNoParam yes ''

     

       455
       +
           Whether to enable Signature Authentication as per RFC 7427.

     

       456
       +
         '';

     

       457
       +
       

     

       458
       +
         signature_authentication_constraints = mkYesNoParam yes ''

     

       459
       +
           If enabled, signature schemes configured in rightauth, in addition to

     

       460
       +
           getting used as constraints against signature schemes employed in the

     

       461
       +
           certificate chain, are also used as constraints against the signature

     

       462
       +
           scheme used by peers during IKEv2.

     

       463
       +
         '';

     

       464
       +
       

     

       465
       +
         spi_min = mkHexParam "0xc0000000" ''

     

       466
       +
           The lower limit for SPIs requested from the kernel for IPsec SAs. Should

     

       467
       +
           not be set lower than 0x00000100 (256), as SPIs between 1 and 255 are

     

       468
       +
           reserved by IANA.

     

       469
       +
         '';

     

       470
       +
       

     

       471
       +
         spi_max = mkHexParam "0xcfffffff" ''

     

       472
       +
           The upper limit for SPIs requested from the kernel for IPsec SAs.

     

       473
       +
         '';

     

       474
       +
       

     

       475
       +
         start-scripts = mkAttrsOfParam (mkStrParam "" "") ''

     

       476
       +
           Section containing a list of scripts (name = path) that are executed

     

       477
       +
           when the daemon is started.

     

       478
       +
         '';

     

       479
       +
       

     

       480
       +
         stop-scripts = mkAttrsOfParam (mkStrParam "" "") ''

     

       481
       +
           Section containing a list of scripts (name = path) that are executed

     

       482
       +
           when the daemon is terminated.

     

       483
       +
         '';

     

       484
       +
       

     

       485
       +
         syslog = loglevelParams // {

     

       486
       +
           identifier = mkOptionalStrParam ''

     

       487
       +
             Identifier for use with openlog(3).

     

       488
       +
             </para><para>

     

       489
       +
             Global identifier used for an openlog(3) call, prepended to each log

     

       490
       +
             message by syslog.  If not configured, openlog(3) is not called, so

     

       491
       +
             the value will depend on system defaults (often the program name).

     

       492
       +
           '';

     

       493
       +
       

     

       494
       +
           ike_name = mkYesNoParam no ''

     

       495
       +
             Prefix each log entry with the connection name and a unique numerical

     

       496
       +
             identifier for each IKE_SA.

     

       497
       +
           '';

     

       498
       +
         };

     

       499
       +
       

     

       500
       +
         threads = mkIntParam 16 ''

     

       501
       +
           Number of worker threads in charon. Several of these are reserved for

     

       502
       +
           long running tasks in internal modules and plugins. Therefore, make sure

     

       503
       +
           you don't set this value too low. The number of idle worker threads

     

       504
       +
           listed in ipsec statusall might be used as indicator on the number of

     

       505
       +
           reserved threads (JobPriority has more on this).

     

       506
       +
         '';

     

       507
       +
       

     

       508
       +
         user = mkOptionalStrParam ''

     

       509
       +
           Name of the user the daemon changes to after startup.

     

       510
       +
         '';

     

       511
       +
       

     

       512
       +
         x509.enforce_critical = mkYesNoParam yes ''

     

       513
       +
           Discard certificates with unsupported or unknown critical extensions.

     

       514
       +
         '';

     

       515
       +
       

     

       516
       +
         plugins = import ./strongswan-charon-plugins-params.nix lib;

     

       517
       +
       

     

       518
       +
         imcv = {

     

       519
       +
           assessment_result = mkYesNoParam yes ''

     

       520
       +
             Whether IMVs send a standard IETF Assessment Result attribute.

     

       521
       +
           '';

     

       522
       +
       

     

       523
       +
           database = mkOptionalStrParam ''

     

       524
       +
             Global IMV policy database URI. If it contains a password, make sure to

     

       525
       +
             adjust the permissions of the config file accordingly.

     

       526
       +
           '';

     

       527
       +
       

     

       528
       +
           os_info.default_password_enabled = mkYesNoParam no ''

     

       529
       +
             Manually set whether a default password is enabled.

     

       530
       +
           '';

     

       531
       +
       

     

       532
       +
           os_info.name = mkOptionalStrParam ''

     

       533
       +
             Manually set the name of the client OS (e.g. <literal>NixOS</literal>).

     

       534
       +
           '';

     

       535
       +
       

     

       536
       +
           os_info.version = mkOptionalStrParam ''

     

       537
       +
             Manually set the version of the client OS (e.g. <literal>17.09</literal>).

     

       538
       +
           '';

     

       539
       +
       

     

       540
       +
           policy_script = mkStrParam "ipsec _imv_policy" ''

     

       541
       +
             Script called for each TNC connection to generate IMV policies.

     

       542
       +
           '';

     

       543
       +
         };

     

       544
       +
       

     

       545
       +
         tls = {

     

       546
       +
           cipher = mkSpaceSepListParam [] ''

     

       547
       +
             List of TLS encryption ciphers.

     

       548
       +
           '';

     

       549
       +
       

     

       550
       +
           key_exchange = mkSpaceSepListParam [] ''

     

       551
       +
             List of TLS key exchange methods.

     

       552
       +
           '';

     

       553
       +
       

     

       554
       +
           mac = mkSpaceSepListParam [] ''

     

       555
       +
             List of TLS MAC algorithms.

     

       556
       +
           '';

     

       557
       +
       

     

       558
       +
           suites = mkSpaceSepListParam [] ''

     

       559
       +
             List of TLS cipher suites.

     

       560
       +
           '';

     

       561
       +
         };

     

       562
       +
       

     

       563
       +
         tnc = {

     

       564
       +
           libtnccs.tnc_config = mkStrParam "/etc/tnc_config" ''

     

       565
       +
             TNC IMC/IMV configuration file.

     

       566
       +
           '';

     

       567
       +
         };

     

       568
       +
       }

+1070

nixos/modules/services/networking/strongswan-swanctl/strongswan-charon-plugins-params.nix

···

       1
       +
       lib : with (import ./param-constructors.nix lib); {

     

       2
       +
         addrblock.strict = mkYesNoParam yes ''

     

       3
       +
           If enabled, a subject certificate without an RFC 3779 address block

     

       4
       +
           extension is rejected if the issuer certificate has such an addrblock

     

       5
       +
           extension. If disabled, subject certificates issued without addrblock

     

       6
       +
           extension are accepted without any traffic selector checks and no policy

     

       7
       +
           is enforced by the plugin.

     

       8
       +
         '';

     

       9
       +
       

     

       10
       +
         android_log.loglevel = mkIntParam 1 ''

     

       11
       +
           Loglevel for logging to Android specific logger.

     

       12
       +
         '';

     

       13
       +
       

     

       14
       +
         attr = mkAttrsOfParam (mkCommaSepListParam [] "") ''

     

       15
       +
           Section to specify arbitrary attributes that are assigned to a peer

     

       16
       +
           via configuration payload, see attr plugin.

     

       17
       +
           </para><para>

     

       18
       +
           The attribute can be either

     

       19
       +
           <literal>address</literal>,

     

       20
       +
           <literal>netmask</literal>,

     

       21
       +
           <literal>dns</literal>,

     

       22
       +
           <literal>nbns</literal>,

     

       23
       +
           <literal>dhcp</literal>,

     

       24
       +
           <literal>subnet</literal>,

     

       25
       +
           <literal>split-include</literal>,

     

       26
       +
           <literal>split-exclude</literal>

     

       27
       +
           or the numeric identifier of the attribute type. The assigned value can be

     

       28
       +
           an IPv4/IPv6 address, a subnet in CIDR notation or an arbitrary value

     

       29
       +
           depending on the attribute type. Since some attribute types accept multiple

     

       30
       +
           values all values must be specified as a list.

     

       31
       +
         '';

     

       32
       +
       

     

       33
       +
         attr-sql.crash_recovery = mkYesNoParam yes ''

     

       34
       +
           Release all online leases during startup. Disable this to share the DB

     

       35
       +
           between multiple VPN gateways.

     

       36
       +
         '';

     

       37
       +
       

     

       38
       +
         attr-sql.database  = mkOptionalStrParam ''

     

       39
       +
           Database URI for attr-sql plugin used by charon. If it contains a

     

       40
       +
           password, make sure to adjust the permissions of the config file

     

       41
       +
           accordingly.

     

       42
       +
         '';

     

       43
       +
       

     

       44
       +
         attr-sql.lease_history = mkYesNoParam yes ''

     

       45
       +
           Enable logging of SQL IP pool leases.

     

       46
       +
         '';

     

       47
       +
       

     

       48
       +
         bliss.use_bliss_b = mkYesNoParam yes ''

     

       49
       +
           Use the enhanced BLISS-B key generation and signature algorithm.

     

       50
       +
         '';

     

       51
       +
       

     

       52
       +
         bypass-lan.interfaces_ignore = mkCommaSepListParam [] ''

     

       53
       +
           List of network interfaces for which connected subnets

     

       54
       +
           should be ignored, if interfaces_use is specified this option has no

     

       55
       +
           effect.

     

       56
       +
         '';

     

       57
       +
       

     

       58
       +
         bypass-lan.interfaces_use = mkCommaSepListParam [] ''

     

       59
       +
           List of network interfaces for which connected subnets

     

       60
       +
           should be considered. All other interfaces are ignored.

     

       61
       +
         '';

     

       62
       +
       

     

       63
       +
         certexpire.csv.cron = mkOptionalStrParam ''

     

       64
       +
           Cron style string specifying CSV export times, see certexpire for

     

       65
       +
           details.

     

       66
       +
         '';

     

       67
       +
       

     

       68
       +
         certexpire.csv.empty_string = mkOptionalStrParam ''

     

       69
       +
           String to use in empty intermediate CA fields.

     

       70
       +
         '';

     

       71
       +
       

     

       72
       +
         certexpire.csv.fixed_fields = mkYesNoParam yes ''

     

       73
       +
           Use a fixed intermediate CA field count.

     

       74
       +
         '';

     

       75
       +
       

     

       76
       +
         certexpire.csv.force = mkYesNoParam yes ''

     

       77
       +
           Force export of all trustchains we have a private key for.

     

       78
       +
         '';

     

       79
       +
       

     

       80
       +
         certexpire.csv.format = mkStrParam "%d:%m:%Y" ''

     

       81
       +
           strftime(3) format string to export expiration dates as.

     

       82
       +
         '';

     

       83
       +
       

     

       84
       +
         certexpire.csv.local = mkOptionalStrParam ''

     

       85
       +
           strftime(3) format string for the CSV file name to export local

     

       86
       +
           certificates to.

     

       87
       +
         '';

     

       88
       +
       

     

       89
       +
         certexpire.csv.remote = mkOptionalStrParam ''

     

       90
       +
           strftime(3) format string for the CSV file name to export remote

     

       91
       +
           certificates to.

     

       92
       +
         '';

     

       93
       +
       

     

       94
       +
         certexpire.csv.separator = mkStrParam "," ''

     

       95
       +
           CSV field separator.

     

       96
       +
         '';

     

       97
       +
       

     

       98
       +
         coupling.file = mkOptionalStrParam ''

     

       99
       +
           File to store coupling list to, see certcoupling plugin for details.

     

       100
       +
         '';

     

       101
       +
       

     

       102
       +
         coupling.hash = mkStrParam "sha1" ''

     

       103
       +
           Hashing algorithm to fingerprint coupled certificates.

     

       104
       +
         '';

     

       105
       +
       

     

       106
       +
         coupling.max = mkIntParam 1 ''

     

       107
       +
           Maximum number of coupling entries to create.

     

       108
       +
         '';

     

       109
       +
       

     

       110
       +
         curl.redir = mkIntParam (-1) ''

     

       111
       +
           Maximum number of redirects followed by the plugin, set to 0 to disable

     

       112
       +
           following redirects, set to -1 for no limit.

     

       113
       +
         '';

     

       114
       +
       

     

       115
       +
         dhcp.force_server_address = mkYesNoParam no ''

     

       116
       +
           Always use the configured server address, see DHCP plugin for details.

     

       117
       +
         '';

     

       118
       +
       

     

       119
       +
         dhcp.identity_lease = mkYesNoParam no ''

     

       120
       +
           Derive user-defined MAC address from hash of IKEv2 identity.

     

       121
       +
         '';

     

       122
       +
       

     

       123
       +
         dhcp.interface = mkOptionalStrParam ''

     

       124
       +
           Interface name the plugin uses for address allocation. The default is to

     

       125
       +
           bind to any and let the system decide which way to route the packets to

     

       126
       +
           the DHCP server.

     

       127
       +
         '';

     

       128
       +
       

     

       129
       +
         dhcp.server = mkStrParam "255.255.255.255" ''

     

       130
       +
           DHCP server unicast or broadcast IP address.

     

       131
       +
         '';

     

       132
       +
       

     

       133
       +
         dnscert.enable = mkYesNoParam no ''

     

       134
       +
           Enable fetching of CERT RRs via DNS.

     

       135
       +
         '';

     

       136
       +
       

     

       137
       +
         duplicheck.enable = mkYesNoParam yes ''

     

       138
       +
           Enable duplicheck plugin (if loaded).

     

       139
       +
         '';

     

       140
       +
       

     

       141
       +
         duplicheck.socket = mkStrParam "unix://\${piddir}/charon.dck" ''

     

       142
       +
           Socket provided by the duplicheck plugin.

     

       143
       +
         '';

     

       144
       +
       

     

       145
       +
         eap-aka.request_identity = mkYesNoParam yes "";

     

       146
       +
       

     

       147
       +
         eap-aka-3ggp2.seq_check = mkOptionalStrParam ''

     

       148
       +
           Enable to activate sequence check of the AKA SQN values in order to trigger

     

       149
       +
           resync cycles.

     

       150
       +
         '';

     

       151
       +
       

     

       152
       +
         eap-dynamic.prefer_user = mkYesNoParam no ''

     

       153
       +
           If enabled, the eap-dynamic plugin will prefer the order of the EAP

     

       154
       +
           methods in an EAP-Nak message sent by a client over the one configured

     

       155
       +
           locally.

     

       156
       +
         '';

     

       157
       +
       

     

       158
       +
         eap-dynamic.preferred = mkCommaSepListParam [] ''

     

       159
       +
           The preferred EAP method(s) to be used by the eap-dynamic plugin. If it is

     

       160
       +
           not set, the first registered method will be used initially. The methods

     

       161
       +
           are tried in the given order before trying the rest of the registered

     

       162
       +
           methods.

     

       163
       +
         '';

     

       164
       +
       

     

       165
       +
         eap-gtc.backend = mkStrParam "pam" ''

     

       166
       +
           XAuth backend to be used for credential verification, see EAP-GTC.

     

       167
       +
         '';

     

       168
       +
       

     

       169
       +
         eap-peap.fragment_size = mkIntParam 1024 ''

     

       170
       +
           Maximum size of an EAP-PEAP packet.

     

       171
       +
         '';

     

       172
       +
       

     

       173
       +
         eap-peap.max_message_count = mkIntParam 32 ''

     

       174
       +
           Maximum number of processed EAP-PEAP packets.

     

       175
       +
         '';

     

       176
       +
       

     

       177
       +
         eap-peap.include_length = mkYesNoParam no ''

     

       178
       +
           Include length in non-fragmented EAP-PEAP packets.

     

       179
       +
         '';

     

       180
       +
       

     

       181
       +
         eap-peap.phase2_method = mkStrParam "mschapv2" ''

     

       182
       +
           Phase2 EAP client authentication method.

     

       183
       +
         '';

     

       184
       +
       

     

       185
       +
         eap-peap.phase2_piggyback = mkYesNoParam no ''

     

       186
       +
           Phase2 EAP Identity request piggybacked by server onto TLS Finished

     

       187
       +
           message.

     

       188
       +
         '';

     

       189
       +
       

     

       190
       +
         eap-peap.phase2_tnc = mkYesNoParam no ''

     

       191
       +
           Start phase2 EAP-TNC protocol after successful client authentication.

     

       192
       +
         '';

     

       193
       +
       

     

       194
       +
         eap-peap.request_peer_auth = mkYesNoParam no ''

     

       195
       +
           Request peer authentication based on a client certificate.

     

       196
       +
         '';

     

       197
       +
       

     

       198
       +
         eap-radius.accounting = mkYesNoParam no ''

     

       199
       +
           Enable EAP-RADIUS accounting.

     

       200
       +
         '';

     

       201
       +
       

     

       202
       +
         eap-radius.accounting_close_on_timeout = mkYesNoParam yes ''

     

       203
       +
           Close the IKE_SA if there is a timeout during interim RADIUS accounting

     

       204
       +
           updates.

     

       205
       +
         '';

     

       206
       +
       

     

       207
       +
         eap-radius.accounting_interval = mkIntParam 0 ''

     

       208
       +
           Interval in seconds for interim RADIUS accounting updates, if not

     

       209
       +
           specified by the RADIUS server in the Access-Accept message.

     

       210
       +
         '';

     

       211
       +
       

     

       212
       +
         eap-radius.accounting_requires_vip = mkYesNoParam no ''

     

       213
       +
           If enabled, accounting is disabled unless an IKE_SA has at least one

     

       214
       +
           virtual IP.

     

       215
       +
         '';

     

       216
       +
       

     

       217
       +
         eap-radius.class_group = mkYesNoParam no ''

     

       218
       +
           Use the class attribute sent in the Access-Accept message as group

     

       219
       +
           membership information, see EapRadius.

     

       220
       +
         '';

     

       221
       +
       

     

       222
       +
         eap-radius.close_all_on_timeout = mkYesNoParam no ''

     

       223
       +
           Closes all IKE_SAs if communication with the RADIUS server times out. If

     

       224
       +
           it is not set only the current IKE_SA is closed.

     

       225
       +
         '';

     

       226
       +
       

     

       227
       +
         eap-radius.dae.enable = mkYesNoParam no ''

     

       228
       +
           Enables support for the Dynamic Authorization Extension (RFC 5176).

     

       229
       +
         '';

     

       230
       +
       

     

       231
       +
         eap-radius.dae.listen = mkStrParam "0.0.0.0" ''

     

       232
       +
           Address to listen for DAE messages from the RADIUS server.

     

       233
       +
         '';

     

       234
       +
       

     

       235
       +
         eap-radius.dae.port = mkIntParam 3799 ''

     

       236
       +
           Port to listen for DAE requests.

     

       237
       +
         '';

     

       238
       +
       

     

       239
       +
         eap-radius.dae.secret = mkOptionalStrParam ''

     

       240
       +
           Shared secret used to verify/sign DAE messages.If set, make sure to

     

       241
       +
           adjust the permissions of the config file accordingly.

     

       242
       +
         '';

     

       243
       +
       

     

       244
       +
         eap-radius.eap_start = mkYesNoParam no ''

     

       245
       +
           Send EAP-Start instead of EAP-Identity to start RADIUS conversation.

     

       246
       +
         '';

     

       247
       +
       

     

       248
       +
         eap-radius.filter_id = mkYesNoParam no ''

     

       249
       +
           Use the filter_id attribute sent in the RADIUS-Accept message as group

     

       250
       +
           membership if the RADIUS tunnel_type attribute is set to ESP.

     

       251
       +
         '';

     

       252
       +
       

     

       253
       +
         eap-radius.forward.ike_to_radius = mkOptionalStrParam ''

     

       254
       +
           RADIUS attributes to be forwarded from IKEv2 to RADIUS (can be defined

     

       255
       +
           by name or attribute number, a colon can be used to specify

     

       256
       +
           vendor-specific attributes, e.g. Reply-Message, or 11, or 36906:12).

     

       257
       +
         '';

     

       258
       +
       

     

       259
       +
         eap-radius.forward.radius_to_ike = mkOptionalStrParam ''

     

       260
       +
           Same as above but from RADIUS to IKEv2, a strongSwan specific private

     

       261
       +
           notify (40969) is used to transmit the attributes.

     

       262
       +
         '';

     

       263
       +
       

     

       264
       +
         eap-radius.id_prefix = mkOptionalStrParam ''

     

       265
       +
           Prefix to EAP-Identity, some AAA servers use a IMSI prefix to select the

     

       266
       +
           EAP method.

     

       267
       +
         '';

     

       268
       +
       

     

       269
       +
         eap-radius.nas_identifier = mkStrParam "strongSwan" ''

     

       270
       +
           NAS-Identifier to include in RADIUS messages.

     

       271
       +
         '';

     

       272
       +
       

     

       273
       +
         eap-radius.port = mkIntParam 1812 ''

     

       274
       +
           Port of RADIUS server (authentication).

     

       275
       +
         '';

     

       276
       +
       

     

       277
       +
         eap-radius.retransmit_base = mkFloatParam "1.4" ''

     

       278
       +
           Base to use for calculating exponential back off.

     

       279
       +
         '';

     

       280
       +
       

     

       281
       +
         eap-radius.retransmit_timeout = mkFloatParam "2.0" ''

     

       282
       +
           Timeout in seconds before sending first retransmit.

     

       283
       +
         '';

     

       284
       +
       

     

       285
       +
         eap-radius.retransmit_tries = mkIntParam 4 ''

     

       286
       +
           Number of times to retransmit a packet before giving up.

     

       287
       +
         '';

     

       288
       +
       

     

       289
       +
         eap-radius.secret = mkOptionalStrParam ''

     

       290
       +
           Shared secret between RADIUS and NAS. If set, make sure to adjust the

     

       291
       +
           permissions of the config file accordingly.

     

       292
       +
         '';

     

       293
       +
       

     

       294
       +
         eap-radius.server = mkOptionalStrParam ''

     

       295
       +
           IP/Hostname of RADIUS server.

     

       296
       +
         '';

     

       297
       +
       

     

       298
       +
         eap-radius.servers = mkAttrsOfParams {

     

       299
       +
           nas_identifier = mkStrParam "strongSwan" ''

     

       300
       +
             The nas_identifer (default: strongSwan) identifies the gateway against the

     

       301
       +
             RADIUS server and allows it to enforce a policy, for example.

     

       302
       +
           '';

     

       303
       +
       

     

       304
       +
           secret = mkOptionalStrParam "";

     

       305
       +
       

     

       306
       +
           sockets = mkIntParam 1 ''

     

       307
       +
             The number of pre-allocated sockets to use. A value of 5 allows the

     

       308
       +
             gateway to authentication 5 clients simultaneously over RADIUS.

     

       309
       +
           '';

     

       310
       +
       

     

       311
       +
           auth_port = mkIntParam 1812 ''

     

       312
       +
             RADIUS UDP port

     

       313
       +
           '';

     

       314
       +
       

     

       315
       +
           address = mkOptionalStrParam ''

     

       316
       +
             The server's IP/Hostname.

     

       317
       +
           '';

     

       318
       +
       

     

       319
       +
           acct_port = mkIntParam 1813 ''

     

       320
       +
             Accounting port.

     

       321
       +
           '';

     

       322
       +
       

     

       323
       +
           preference = mkIntParam 0 ''

     

       324
       +
             With the preference paramter of a server, priorities for specific servers

     

       325
       +
             can be defined. This allows to use a secondary RADIUS server only if the

     

       326
       +
             first gets unresponsive, or if it is overloaded.

     

       327
       +
           '';

     

       328
       +
         } ''Section to specify multiple RADIUS servers, see EapRadius.'';

     

       329
       +
       

     

       330
       +
         eap-radius.sockets = mkIntParam 1 ''

     

       331
       +
           Number of sockets (ports) to use, increase for high load.

     

       332
       +
         '';

     

       333
       +
       

     

       334
       +
         eap-radius.xauth = mkAttrsOfParams {

     

       335
       +
           nextpin  = mkOptionalStrParam "";

     

       336
       +
           password = mkOptionalStrParam "";

     

       337
       +
           passcode = mkOptionalStrParam "";

     

       338
       +
           answer   = mkOptionalStrParam "";

     

       339
       +
         } ''

     

       340
       +
           Section to configure multiple XAuth authentication rounds via RADIUS.

     

       341
       +
         '';

     

       342
       +
       

     

       343
       +
         eap-sim.request_identity = mkYesNoParam yes "";

     

       344
       +
       

     

       345
       +
         eap-simaka-sql.database = mkOptionalStrParam "";

     

       346
       +
       

     

       347
       +
         eap-simaka-sql.remove_used = mkOptionalStrParam "";

     

       348
       +
       

     

       349
       +
         eap-tls.fragment_size = mkIntParam  1024 ''

     

       350
       +
           Maximum size of an EAP-TLS packet.

     

       351
       +
         '';

     

       352
       +
       

     

       353
       +
         eap-tls.include_length = mkYesNoParam yes ''

     

       354
       +
           Include length in non-fragmented EAP-TLS packets.

     

       355
       +
         '';

     

       356
       +
       

     

       357
       +
         eap-tls.max_message_count = mkIntParam 32 ''

     

       358
       +
           Maximum number of processed EAP-TLS packets (0 = no limit).

     

       359
       +
         '';

     

       360
       +
       

     

       361
       +
         eap-tnc.max_message_count = mkIntParam 10 ''

     

       362
       +
           Maximum number of processed EAP-TNC packets (0 = no limit).

     

       363
       +
         '';

     

       364
       +
       

     

       365
       +
         eap-tnc.protocol = mkStrParam "tnccs-2.0" ''

     

       366
       +
           IF-TNCCS protocol version to be used (tnccs-1.1, tnccs-2.0,

     

       367
       +
           tnccs-dynamic).

     

       368
       +
         '';

     

       369
       +
       

     

       370
       +
         eap-ttls.fragment_size = mkIntParam 1024 ''

     

       371
       +
           Maximum size of an EAP-TTLS packet.

     

       372
       +
         '';

     

       373
       +
       

     

       374
       +
         eap-ttls.include_length = mkYesNoParam yes ''

     

       375
       +
           Include length in non-fragmented EAP-TTLS packets.

     

       376
       +
         '';

     

       377
       +
       

     

       378
       +
         eap-ttls.max_message_count = mkIntParam 32 ''

     

       379
       +
           Maximum number of processed EAP-TTLS packets (0 = no limit).

     

       380
       +
         '';

     

       381
       +
       

     

       382
       +
         eap-ttls.phase2_method = mkStrParam "md5" ''

     

       383
       +
           Phase2 EAP client authentication method.

     

       384
       +
         '';

     

       385
       +
       

     

       386
       +
         eap-ttls.phase2_piggyback = mkYesNoParam no ''

     

       387
       +
           Phase2 EAP Identity request piggybacked by server onto TLS Finished

     

       388
       +
           message.

     

       389
       +
         '';

     

       390
       +
       

     

       391
       +
         eap-ttls.phase2_tnc = mkYesNoParam no ''

     

       392
       +
           Start phase2 EAP TNC protocol after successful client authentication.

     

       393
       +
         '';

     

       394
       +
       

     

       395
       +
         eap-ttls-phase2_tnc_method = mkEnumParam ["pt" "legacy"] "pt" ''

     

       396
       +
           Phase2 EAP TNC transport protocol (pt as IETF standard or legacy tnc)

     

       397
       +
         '';

     

       398
       +
       

     

       399
       +
         eap-ttls.request_peer_auth = mkYesNoParam no ''

     

       400
       +
           Request peer authentication based on a client certificate.

     

       401
       +
         '';

     

       402
       +
       

     

       403
       +
         error-notify.socket = mkStrParam "unix://\${piddir}/charon.enfy" ''

     

       404
       +
           Socket provided by the error-notify plugin.

     

       405
       +
         '';

     

       406
       +
       

     

       407
       +
         ext-auth.script = mkOptionalStrParam ''

     

       408
       +
           Shell script to invoke for peer authorization (see ext-auth).

     

       409
       +
         '';

     

       410
       +
       

     

       411
       +
         gcrypt.quick_random = mkYesNoParam no ''

     

       412
       +
           Use faster random numbers in gcrypt. For testing only, produces weak

     

       413
       +
           keys!

     

       414
       +
         '';

     

       415
       +
       

     

       416
       +
         ha.autobalance = mkIntParam 0 ''

     

       417
       +
           Interval in seconds to automatically balance handled segments between

     

       418
       +
           nodes. Set to 0 to disable.

     

       419
       +
         '';

     

       420
       +
       

     

       421
       +
         ha.fifo_interface = mkYesNoParam yes "";

     

       422
       +
       

     

       423
       +
         ha.heartbeat_delay = mkIntParam 1000 "";

     

       424
       +
       

     

       425
       +
         ha.heartbeat_timeout = mkIntParam 2100 "";

     

       426
       +
       

     

       427
       +
         ha.local = mkOptionalIntParam "";

     

       428
       +
       

     

       429
       +
         ha.monitor = mkYesNoParam yes "";

     

       430
       +
       

     

       431
       +
         ha.pools = mkOptionalStrParam "";

     

       432
       +
       

     

       433
       +
         ha.remote = mkOptionalStrParam "";

     

       434
       +
       

     

       435
       +
         ha.resync = mkYesNoParam yes "";

     

       436
       +
       

     

       437
       +
         ha.secret = mkOptionalStrParam "";

     

       438
       +
       

     

       439
       +
         ha.segment_count = mkIntParam 1 "";

     

       440
       +
       

     

       441
       +
         ipseckey.enable = mkYesNoParam no ''

     

       442
       +
           Enable fetching of IPSECKEY RRs via DNS.

     

       443
       +
         '';

     

       444
       +
       

     

       445
       +
         kernel-libipsec.allow_peer_ts = mkYesNoParam no ''

     

       446
       +
           Allow that the remote traffic selector equals the IKE peer (see

     

       447
       +
           kernel-libipsec for details).

     

       448
       +
         '';

     

       449
       +
       

     

       450
       +
         kernel-netlink.buflen = mkOptionalIntParam ''

     

       451
       +
           Buffer size for received Netlink messages. Defaults to

     

       452
       +
           <literal>min(PAGE_SIZE, 8192)</literal>.

     

       453
       +
         '';

     

       454
       +
       

     

       455
       +
         kernel-netlink.force_receive_buffer_size = mkYesNoParam no ''

     

       456
       +
           If the maximum Netlink socket receive buffer in bytes set by

     

       457
       +
           receive_buffer_size exceeds the system-wide maximum from

     

       458
       +
           <literal>/proc/sys/net/core/rmem_max</literal>, this option can be used to

     

       459
       +
           override the limit. Enabling this option requires special priviliges

     

       460
       +
           (CAP_NET_ADMIN).

     

       461
       +
         '';

     

       462
       +
       

     

       463
       +
         kernel-netlink.fwmark = mkOptionalStrParam ''

     

       464
       +
           Firewall mark to set on the routing rule that directs traffic to our own

     

       465
       +
           routing table. The format is <literal>[!]mark[/mask]</literal>, where the

     

       466
       +
           optional exclamation mark inverts the meaning (i.e. the rule only applies to

     

       467
       +
           packets that don't match the mark). A possible use case are host-to-host

     

       468
       +
           tunnels with kernel-libipsec. When set to !&#60;mark&#62; a more efficient

     

       469
       +
           lookup for source and next-hop addresses may also be used since 5.3.3.

     

       470
       +
         '';

     

       471
       +
       

     

       472
       +
         kernel-netlink.mss = mkIntParam 0 ''

     

       473
       +
           MSS to set on installed routes, 0 to disable.

     

       474
       +
         '';

     

       475
       +
       

     

       476
       +
         kernel-netlink.mtu = mkIntParam 0 ''

     

       477
       +
           MTU to set on installed routes, 0 to disable.

     

       478
       +
         '';

     

       479
       +
       

     

       480
       +
         kernel-netlink.receive_buffer_size = mkIntParam 0 ''

     

       481
       +
           Maximum Netlink socket receive buffer in bytes. This value controls how many

     

       482
       +
           bytes of Netlink messages can be received on a Netlink socket. The default

     

       483
       +
           value is set by <literal>/proc/sys/net/core/rmem_default</literal>. The

     

       484
       +
           specified value cannot exceed the system-wide maximum from

     

       485
       +
           <literal>/proc/sys/net/core/rmem_max</literal>, unless

     

       486
       +
           <option>force_receive_buffer_size</option> is enabled.

     

       487
       +
         '';

     

       488
       +
       

     

       489
       +
         kernel-netlink.roam_events = mkYesNoParam yes ''

     

       490
       +
           Whether to trigger roam events when interfaces, addresses or routes

     

       491
       +
           change.

     

       492
       +
         '';

     

       493
       +
       

     

       494
       +
         kernel-netlink.set_proto_port_transport_sa = mkYesNoParam no ''

     

       495
       +
           Whether to set protocol and ports in the selector installed on transport

     

       496
       +
           mode IPsec SAs in the kernel. While doing so enforces policies for

     

       497
       +
           inbound traffic, it also prevents the use of a single IPsec SA by more

     

       498
       +
           than one traffic selector.

     

       499
       +
         '';

     

       500
       +
       

     

       501
       +
         kernel-netlink.spdh_thresh.ipv4.lbits = mkIntParam 32 ''

     

       502
       +
           Local subnet XFRM policy hashing threshold for IPv4.

     

       503
       +
         '';

     

       504
       +
       

     

       505
       +
         kernel-netlink.spdh_thresh.ipv4.rbits = mkIntParam 32 ''

     

       506
       +
           Remote subnet XFRM policy hashing threshold for IPv4.

     

       507
       +
         '';

     

       508
       +
       

     

       509
       +
         kernel-netlink.spdh_thresh.ipv6.lbits = mkIntParam 128 ''

     

       510
       +
           Local subnet XFRM policy hashing threshold for IPv6.

     

       511
       +
         '';

     

       512
       +
       

     

       513
       +
         kernel-netlink.spdh_thresh.ipv6.rbits = mkIntParam 128 ''

     

       514
       +
           Remote subnet XFRM policy hashing threshold for IPv6.

     

       515
       +
         '';

     

       516
       +
       

     

       517
       +
         kernel-netlink.xfrm_acq_expires = mkIntParam 165 ''

     

       518
       +
           Lifetime of XFRM acquire state created by the kernel when traffic matches a

     

       519
       +
           trap policy. The value gets written to

     

       520
       +
           <literal>/proc/sys/net/core/xfrm_acq_expires</literal>. Indirectly controls

     

       521
       +
           the delay between XFRM acquire messages triggered by the kernel for a trap

     

       522
       +
           policy. The same value is used as timeout for SPIs allocated by the

     

       523
       +
           kernel. The default value equals the default total retransmission timeout

     

       524
       +
           for IKE messages (since 5.5.3 this value is determined dynamically based on

     

       525
       +
           the configuration).

     

       526
       +
         '';

     

       527
       +
       

     

       528
       +
         kernel-pfkey.events_buffer_size = mkIntParam 0 ''

     

       529
       +
           Size of the receive buffer for the event socket (0 for default

     

       530
       +
           size). Because events are received asynchronously installing e.g. lots

     

       531
       +
           of policies may require a larger buffer than the default on certain

     

       532
       +
           platforms in order to receive all messages.

     

       533
       +
         '';

     

       534
       +
       

     

       535
       +
         kernel-pfroute.vip_wait = mkIntParam 1000 ''

     

       536
       +
           Time in ms to wait until virtual IP addresses appear/disappear before

     

       537
       +
           failing.

     

       538
       +
         '';

     

       539
       +
       

     

       540
       +
         led.activity_led = mkOptionalStrParam "";

     

       541
       +
       

     

       542
       +
         led.blink_time = mkIntParam 50 "";

     

       543
       +
       

     

       544
       +
         load-tester = {

     

       545
       +
           addrs = mkAttrsOfParam (mkOptionalStrParam "") ''

     

       546
       +
             Section that contains key/value pairs with address pools (in CIDR

     

       547
       +
             notation) to use for a specific network interface e.g.

     

       548
       +
             <literal>eth0 = 10.10.0.0/16</literal>.

     

       549
       +
          '';

     

       550
       +
       

     

       551
       +
           addrs_keep = mkYesNoParam no ''

     

       552
       +
             Whether to keep dynamic addresses even after the associated SA got

     

       553
       +
             terminated.

     

       554
       +
           '';

     

       555
       +
       

     

       556
       +
           addrs_prefix = mkIntParam 16 ''

     

       557
       +
             Network prefix length to use when installing dynamic addresses.

     

       558
       +
             If set to -1 the full address is used (i.e. 32 or 128).

     

       559
       +
           '';

     

       560
       +
       

     

       561
       +
           ca_dir = mkOptionalStrParam ''

     

       562
       +
             Directory to load (intermediate) CA certificates from.

     

       563
       +
           '';

     

       564
       +
       

     

       565
       +
           child_rekey = mkIntParam 600 ''

     

       566
       +
             Seconds to start CHILD_SA rekeying after setup.

     

       567
       +
           '';

     

       568
       +
       

     

       569
       +
           crl = mkOptionalStrParam ''

     

       570
       +
             URI to a CRL to include as certificate distribution point in generated

     

       571
       +
             certificates.

     

       572
       +
           '';

     

       573
       +
       

     

       574
       +
           delay = mkIntParam 0 ''

     

       575
       +
             Delay between initiatons for each thread.

     

       576
       +
           '';

     

       577
       +
       

     

       578
       +
           delete_after_established = mkYesNoParam no ''

     

       579
       +
             Delete an IKE_SA as soon as it has been established.

     

       580
       +
           '';

     

       581
       +
       

     

       582
       +
           digest = mkStrParam "sha1" ''

     

       583
       +
             Digest algorithm used when issuing certificates.

     

       584
       +
           '';

     

       585
       +
       

     

       586
       +
           dpd_delay = mkIntParam 0 ''

     

       587
       +
             DPD delay to use in load test.

     

       588
       +
           '';

     

       589
       +
       

     

       590
       +
           dynamic_port = mkIntParam 0 ''

     

       591
       +
             Base port to be used for requests (each client uses a different port).

     

       592
       +
           '';

     

       593
       +
       

     

       594
       +
           eap_password = mkStrParam "default-pwd" ''

     

       595
       +
             EAP secret to use in load test.

     

       596
       +
           '';

     

       597
       +
       

     

       598
       +
           enable = mkYesNoParam no ''

     

       599
       +
             Enable the load testing plugin. **WARNING**: Never enable this plugin on

     

       600
       +
             productive systems. It provides preconfigured credentials and allows an

     

       601
       +
             attacker to authenticate as any user.

     

       602
       +
           '';

     

       603
       +
       

     

       604
       +
           esp = mkStrParam "aes128-sha1" ''

     

       605
       +
             CHILD_SA proposal to use for load tests.

     

       606
       +
           '';

     

       607
       +
       

     

       608
       +
           fake_kernel = mkYesNoParam no ''

     

       609
       +
             Fake the kernel interface to allow load-testing against self.

     

       610
       +
           '';

     

       611
       +
       

     

       612
       +
           ike_rekey = mkIntParam 0 ''

     

       613
       +
             Seconds to start IKE_SA rekeying after setup.

     

       614
       +
           '';

     

       615
       +
       

     

       616
       +
           init_limit = mkIntParam 0 ''

     

       617
       +
             Global limit of concurrently established SAs during load test.

     

       618
       +
           '';

     

       619
       +
       

     

       620
       +
           initiator = mkStrParam "0.0.0.0" ''

     

       621
       +
             Address to initiate from.

     

       622
       +
           '';

     

       623
       +
       

     

       624
       +
           initiators = mkIntParam 0 ''

     

       625
       +
             Number of concurrent initiator threads to use in load test.

     

       626
       +
           '';

     

       627
       +
       

     

       628
       +
           initiator_auth = mkStrParam "pubkey" ''

     

       629
       +
             Authentication method(s) the intiator uses.

     

       630
       +
           '';

     

       631
       +
       

     

       632
       +
           initiator_id = mkOptionalStrParam ''

     

       633
       +
             Initiator ID used in load test.

     

       634
       +
           '';

     

       635
       +
       

     

       636
       +
           initiator_match = mkOptionalStrParam ''

     

       637
       +
             Initiator ID to match against as responder.

     

       638
       +
           '';

     

       639
       +
       

     

       640
       +
           initiator_tsi = mkOptionalStrParam ''

     

       641
       +
             Traffic selector on initiator side, as proposed by initiator.

     

       642
       +
           '';

     

       643
       +
       

     

       644
       +
           initiator_tsr = mkOptionalStrParam ''

     

       645
       +
             Traffic selector on responder side, as proposed by initiator.

     

       646
       +
           '';

     

       647
       +
       

     

       648
       +
           iterations = mkIntParam 1 ''

     

       649
       +
             Number of IKE_SAs to initiate by each initiator in load test.

     

       650
       +
           '';

     

       651
       +
       

     

       652
       +
           issuer_cert = mkOptionalStrParam ''

     

       653
       +
             Path to the issuer certificate (if not configured a hard-coded default

     

       654
       +
             value is used).

     

       655
       +
           '';

     

       656
       +
       

     

       657
       +
           issuer_key = mkOptionalStrParam ''

     

       658
       +
             Path to private key that is used to issue certificates (if not configured

     

       659
       +
             a hard-coded default value is used).

     

       660
       +
           '';

     

       661
       +
       

     

       662
       +
           mode = mkEnumParam ["tunnel" "transport" "beet"] "tunnel" ''

     

       663
       +
             IPsec mode to use.

     

       664
       +
           '';

     

       665
       +
       

     

       666
       +
           pool = mkOptionalStrParam ''

     

       667
       +
             Provide INTERNAL_IPV4_ADDRs from a named pool.

     

       668
       +
           '';

     

       669
       +
       

     

       670
       +
           preshared_key = mkStrParam "<default-psk>" ''

     

       671
       +
             Preshared key to use in load test.

     

       672
       +
           '';

     

       673
       +
       

     

       674
       +
           proposal = mkStrParam "aes128-sha1-modp768" ''

     

       675
       +
             IKE proposal to use in load test.

     

       676
       +
           '';

     

       677
       +
       

     

       678
       +
           responder = mkStrParam "127.0.0.1" ''

     

       679
       +
             Address to initiation connections to.

     

       680
       +
           '';

     

       681
       +
       

     

       682
       +
           responder_auth = mkStrParam "pubkey" ''

     

       683
       +
             Authentication method(s) the responder uses.

     

       684
       +
           '';

     

       685
       +
       

     

       686
       +
           responder_id = mkOptionalStrParam ''

     

       687
       +
             Responder ID used in load test.

     

       688
       +
           '';

     

       689
       +
       

     

       690
       +
           responder_tsi = mkStrParam "initiator_tsi" ''

     

       691
       +
             Traffic selector on initiator side, as narrowed by responder.

     

       692
       +
           '';

     

       693
       +
       

     

       694
       +
           responder_tsr = mkStrParam "initiator_tsr" ''

     

       695
       +
             Traffic selector on responder side, as narrowed by responder.

     

       696
       +
           '';

     

       697
       +
       

     

       698
       +
           request_virtual_ip = mkYesNoParam no ''

     

       699
       +
             Request an INTERNAL_IPV4_ADDR from the server.

     

       700
       +
           '';

     

       701
       +
       

     

       702
       +
           shutdown_when_complete = mkYesNoParam no ''

     

       703
       +
             Shutdown the daemon after all IKE_SAs have been established.

     

       704
       +
           '';

     

       705
       +
       

     

       706
       +
           socket = mkStrParam "unix://\\\${piddir}/charon.ldt" ''

     

       707
       +
             Socket provided by the load-tester plugin.

     

       708
       +
           '';

     

       709
       +
       

     

       710
       +
           version = mkIntParam 0 ''

     

       711
       +
             IKE version to use (0 means use IKEv2 as initiator and accept any version

     

       712
       +
             as responder).

     

       713
       +
           '';

     

       714
       +
         };

     

       715
       +
       

     

       716
       +
         lookip.socket = mkStrParam "unix://\\\${piddir}/charon.lkp" ''

     

       717
       +
           Socket provided by the lookip plugin.

     

       718
       +
         '';

     

       719
       +
       

     

       720
       +
         ntru.max_drbg_requests = mkIntParam 4294967294 ''

     

       721
       +
           Number of pseudo-random bit requests from the DRBG before an automatic

     

       722
       +
           reseeding occurs.

     

       723
       +
         '';

     

       724
       +
       

     

       725
       +
         ntru.parameter_set =

     

       726
       +
           mkEnumParam ["x9_98_speed" "x9_98_bandwidth" "x9_98_balance" "optimum"] "optimum" ''

     

       727
       +
             The following parameter sets are available:

     

       728
       +
             <literal>x9_98_speed</literal>, <literal>x9_98_bandwidth</literal>,

     

       729
       +
             <literal>x9_98_balance</literal> and <literal>optimum</literal>, the last

     

       730
       +
             set not being part of the X9.98 standard but having the best performance.

     

       731
       +
           '';

     

       732
       +
       

     

       733
       +
         openssl.engine_id = mkStrParam "pkcs11" ''

     

       734
       +
           ENGINE ID to use in the OpenSSL plugin.

     

       735
       +
         '';

     

       736
       +
       

     

       737
       +
         openssl.fips_mode = mkIntParam 0 ''

     

       738
       +
           Set OpenSSL FIPS mode:

     

       739
       +
           <itemizedlist>

     

       740
       +
           <listitem><para>disabled (0),</para></listitem>

     

       741
       +
           <listitem><para>enabled (1),</para></listitem>

     

       742
       +
           <listitem><para>Suite B enabled (2).</para></listitem>

     

       743
       +
           </itemizedlist>

     

       744
       +
           Defaults to the value configured with the

     

       745
       +
           <literal>--with-fips-mode</literal> option.

     

       746
       +
       

     

       747
       +
         '';

     

       748
       +
       

     

       749
       +
         osx-attr.append = mkYesNoParam yes ''

     

       750
       +
           Whether DNS servers are appended to existing entries, instead of

     

       751
       +
           replacing them.

     

       752
       +
         '';

     

       753
       +
       

     

       754
       +
         pkcs11.load_certs = mkYesNoParam yes ''

     

       755
       +
           Whether to load certificates from tokens.

     

       756
       +
         '';

     

       757
       +
       

     

       758
       +
         pkcs11.modules = mkAttrsOfParams {

     

       759
       +
           path = mkOptionalStrParam ''

     

       760
       +
             Full path to the shared object file of this PKCS#11 module

     

       761
       +
           '';

     

       762
       +
       

     

       763
       +
           os_locking = mkYesNoParam no ''

     

       764
       +
             Whether OS locking should be enabled for this module

     

       765
       +
           '';

     

       766
       +
       

     

       767
       +
           load_certs = mkYesNoParam no ''

     

       768
       +
             Whether the PKCS#11 modules should load certificates from tokens (since 5.0.2)

     

       769
       +
           '';

     

       770
       +
         } ''

     

       771
       +
           List of available PKCS#11 modules, see SmartCardsIKEv2.

     

       772
       +
         '';

     

       773
       +
       

     

       774
       +
         pkcs11.reload_certs = mkYesNoParam no ''

     

       775
       +
           Reload certificates from all tokens if charon receives a SIGHUP.

     

       776
       +
         '';

     

       777
       +
       

     

       778
       +
         pkcs11.use_dh = mkYesNoParam no ''

     

       779
       +
           Whether the PKCS#11 modules should be used for DH and ECDH.

     

       780
       +
         '';

     

       781
       +
       

     

       782
       +
         pkcs11.use_ecc = mkYesNoParam no ''

     

       783
       +
           Whether the PKCS#11 modules should be used for ECDH and ECDSA public key

     

       784
       +
           operations. ECDSA private keys are used regardless of this option.

     

       785
       +
         '';

     

       786
       +
       

     

       787
       +
         pkcs11.use_hasher = mkYesNoParam no ''

     

       788
       +
           Whether the PKCS#11 modules should be used to hash data.

     

       789
       +
         '';

     

       790
       +
       

     

       791
       +
         pkcs11.use_pubkey = mkYesNoParam no ''

     

       792
       +
           Whether the PKCS#11 modules should be used for public key operations,

     

       793
       +
           even for keys not stored on tokens.

     

       794
       +
         '';

     

       795
       +
       

     

       796
       +
         pkcs11.use_rng = mkYesNoParam no ''

     

       797
       +
           Whether the PKCS#11 modules should be used as RNG.

     

       798
       +
         '';

     

       799
       +
       

     

       800
       +
         radattr.dir = mkOptionalStrParam ''

     

       801
       +
           Directory where RADIUS attributes are stored in client-ID specific

     

       802
       +
           files, see radattr.

     

       803
       +
         '';

     

       804
       +
       

     

       805
       +
         radattr.message_id = mkIntParam (-1) ''

     

       806
       +
           RADIUS attributes are added to all IKE_AUTH messages by default (-1), or

     

       807
       +
           only to the IKE_AUTH message with the given IKEv2 message ID.

     

       808
       +
         '';

     

       809
       +
       

     

       810
       +
         random.random = mkStrParam "/dev/random" ''

     

       811
       +
           File to read random bytes from.

     

       812
       +
         '';

     

       813
       +
       

     

       814
       +
         random.urandom = mkStrParam "/dev/urandom" ''

     

       815
       +
           File to read pseudo random bytes from.

     

       816
       +
         '';

     

       817
       +
       

     

       818
       +
         random.strong_equals_true = mkYesNoParam no ''

     

       819
       +
           If enabled the RNG_STRONG class reads random bytes from the same source

     

       820
       +
           as the RNG_TRUE class.

     

       821
       +
         '';

     

       822
       +
       

     

       823
       +
         resolve.file = mkStrParam "/etc/resolv.conf" ''

     

       824
       +
           File used by the resolve plugin to write DNS server entries to.

     

       825
       +
         '';

     

       826
       +
       

     

       827
       +
         resolve.resolvconf.iface_prefix = mkStrParam "lo.inet.ipsec." ''

     

       828
       +
           Prefix used by the resolve plugin for interface names sent to

     

       829
       +
           resolvconf(8). The name server address is appended to this prefix to

     

       830
       +
           make it unique. The result has to be a valid interface name according to

     

       831
       +
           the rules defined by resolvconf. Also, it should have a high priority

     

       832
       +
           according to the order defined in interface-order(5).

     

       833
       +
         '';

     

       834
       +
       

     

       835
       +
         revocation.enable_crl = mkYesNoParam yes ''

     

       836
       +
           Whether CRL validation should be enabled.

     

       837
       +
         '';

     

       838
       +
       

     

       839
       +
         revocation.enable_ocsp = mkYesNoParam yes ''

     

       840
       +
           Whether OCSP validation should be enabled.

     

       841
       +
         '';

     

       842
       +
       

     

       843
       +
         socket-default.fwmark = mkOptionalStrParam ''

     

       844
       +
           Firewall mark to set on outbound packets (a possible use case are

     

       845
       +
           host-to-host tunnels with kernel-libipsec).

     

       846
       +
         '';

     

       847
       +
       

     

       848
       +
         socket-default.set_source = mkYesNoParam yes ''

     

       849
       +
           Set source address on outbound packets, if possible.

     

       850
       +
         '';

     

       851
       +
       

     

       852
       +
         socket-default.set_sourceif = mkYesNoParam no ''

     

       853
       +
           Force sending interface on outbound packets, if possible. This allows

     

       854
       +
           using IPv6 link-local addresses as tunnel endpoints.

     

       855
       +
         '';

     

       856
       +
       

     

       857
       +
         socket-default.use_ipv4 = mkYesNoParam yes ''

     

       858
       +
           Listen on IPv4, if possible.

     

       859
       +
         '';

     

       860
       +
       

     

       861
       +
         socket-default.use_ipv6 = mkYesNoParam yes ''

     

       862
       +
           Listen on IPv6, if possible.

     

       863
       +
         '';

     

       864
       +
       

     

       865
       +
         sql.database = mkOptionalStrParam ''

     

       866
       +
           Database URI for charon's SQL plugin. If it contains a password, make

     

       867
       +
           sure to adjust the permissions of the config file accordingly.

     

       868
       +
         '';

     

       869
       +
       

     

       870
       +
         sql.loglevel = mkIntParam (-1) ''

     

       871
       +
           Loglevel for logging to SQL database.

     

       872
       +
         '';

     

       873
       +
       

     

       874
       +
         stroke.allow_swap = mkYesNoParam yes ''

     

       875
       +
           Analyze addresses/hostnames in left/right to detect which side is local

     

       876
       +
           and swap configuration options if necessary. If disabled left is always

     

       877
       +
           local.

     

       878
       +
         '';

     

       879
       +
       

     

       880
       +
         stroke.ignore_missing_ca_basic_constraint = mkYesNoParam no ''

     

       881
       +
           Treat certificates in ipsec.d/cacerts and ipsec.conf ca sections as CA

     

       882
       +
           certificates even if they don't contain a CA basic constraint.

     

       883
       +
         '';

     

       884
       +
       

     

       885
       +
         stroke.max_concurrent = mkIntParam 4 ''

     

       886
       +
           Maximum number of stroke messages handled concurrently.

     

       887
       +
         '';

     

       888
       +
       

     

       889
       +
         stroke.secrets_file = mkStrParam "\${sysconfdir}/ipsec.secrets" ''

     

       890
       +
           Location of the ipsec.secrets file.

     

       891
       +
         '';

     

       892
       +
       

     

       893
       +
         stroke.socket = mkStrParam "unix://\${piddir}/charon.ctl" ''

     

       894
       +
           Socket provided by the stroke plugin.

     

       895
       +
         '';

     

       896
       +
       

     

       897
       +
         stroke.timeout = mkIntParam 0 ''

     

       898
       +
           Timeout in ms for any stroke command. Use 0 to disable the timeout.

     

       899
       +
         '';

     

       900
       +
       

     

       901
       +
         systime-fix.interval = mkIntParam 0 ''

     

       902
       +
           Interval in seconds to check system time for validity. 0 disables the

     

       903
       +
           check. See systime-fix plugin.

     

       904
       +
         '';

     

       905
       +
       

     

       906
       +
         systime-fix.reauth = mkYesNoParam no ''

     

       907
       +
           Whether to use reauth or delete if an invalid cert lifetime is detected.

     

       908
       +
         '';

     

       909
       +
       

     

       910
       +
         systime-fix.threshold = mkOptionalStrParam ''

     

       911
       +
           Threshold date where system time is considered valid. Disabled if not

     

       912
       +
           specified.

     

       913
       +
         '';

     

       914
       +
       

     

       915
       +
         systime-fix.threshold_format = mkStrParam "%Y" ''

     

       916
       +
           strptime(3) format used to parse threshold option.

     

       917
       +
         '';

     

       918
       +
       

     

       919
       +
         tnc-ifmap.client_cert = mkOptionalStrParam ''

     

       920
       +
           Path to X.509 certificate file of IF-MAP client.

     

       921
       +
         '';

     

       922
       +
       

     

       923
       +
         tnc-ifmap.client_key = mkOptionalStrParam ''

     

       924
       +
           Path to private key file of IF-MAP client.

     

       925
       +
         '';

     

       926
       +
       

     

       927
       +
         tnc-ifmap.device_name = mkOptionalStrParam ''

     

       928
       +
           Unique name of strongSwan server as a PEP and/or PDP device.

     

       929
       +
         '';

     

       930
       +
       

     

       931
       +
         tnc-ifmap.renew_session_interval = mkIntParam 150 ''

     

       932
       +
           Interval in seconds between periodic IF-MAP RenewSession requests.

     

       933
       +
         '';

     

       934
       +
       

     

       935
       +
         tnc-ifmap.server_cert = mkOptionalStrParam ''

     

       936
       +
           Path to X.509 certificate file of IF-MAP server.

     

       937
       +
         '';

     

       938
       +
       

     

       939
       +
         tnc-ifmap.server_uri = mkStrParam "https://localhost:8444/imap" ''

     

       940
       +
           URI of the form <literal>[https://]servername[:port][/path]</literal>.

     

       941
       +
         '';

     

       942
       +
       

     

       943
       +
         tnc-ifmap.username_password = mkOptionalStrParam ''

     

       944
       +
           Credentials of IF-MAP client of the form

     

       945
       +
           <literal>username:password</literal>. If set, make sure to adjust the

     

       946
       +
           permissions of the config file accordingly.

     

       947
       +
         '';

     

       948
       +
       

     

       949
       +
         tnc-imc.dlcose = mkYesNoParam yes ''

     

       950
       +
           Unload IMC after use.

     

       951
       +
         '';

     

       952
       +
       

     

       953
       +
         tnc-imc.preferred_language = mkStrParam "en" ''

     

       954
       +
           Preferred language for TNC recommendations.

     

       955
       +
         '';

     

       956
       +
       

     

       957
       +
         tnc-imv.dlcose = mkYesNoParam yes ''

     

       958
       +
           Unload IMV after use.

     

       959
       +
         '';

     

       960
       +
       

     

       961
       +
         tnc-imv.recommendation_policy = mkEnumParam ["default" "any" "all"] "default" ''

     

       962
       +
           default TNC recommendation policy.

     

       963
       +
         '';

     

       964
       +
       

     

       965
       +
         tnc-pdp.pt_tls.enable = mkYesNoParam yes ''

     

       966
       +
           Enable PT-TLS protocol on the strongSwan PDP.

     

       967
       +
         '';

     

       968
       +
       

     

       969
       +
         tnc-pdp.pt_tls.port = mkIntParam 271 ''

     

       970
       +
           PT-TLS server port the strongSwan PDP is listening on.

     

       971
       +
         '';

     

       972
       +
       

     

       973
       +
         tnc-pdp.radius.enable = mkYesNoParam yes ''

     

       974
       +
           Enable RADIUS protocol on the strongSwan PDP.

     

       975
       +
         '';

     

       976
       +
       

     

       977
       +
         tnc-pdp.radius.method = mkStrParam "ttls" ''

     

       978
       +
           EAP tunnel method to be used.

     

       979
       +
         '';

     

       980
       +
       

     

       981
       +
         tnc-pdp.radius.port = mkIntParam 1812 ''

     

       982
       +
           RADIUS server port the strongSwan PDP is listening on.

     

       983
       +
         '';

     

       984
       +
       

     

       985
       +
         tnc-pdp.radius.secret = mkOptionalStrParam ''

     

       986
       +
           Shared RADIUS secret between strongSwan PDP and NAS. If set, make sure

     

       987
       +
           to adjust the permissions of the config file accordingly.

     

       988
       +
         '';

     

       989
       +
       

     

       990
       +
         tnc-pdp.server = mkOptionalStrParam ''

     

       991
       +
           Name of the strongSwan PDP as contained in the AAA certificate.

     

       992
       +
         '';

     

       993
       +
       

     

       994
       +
         tnc-pdp.timeout = mkOptionalIntParam ''

     

       995
       +
           Timeout in seconds before closing incomplete connections.

     

       996
       +
         '';

     

       997
       +
       

     

       998
       +
         tnccs-11.max_message_size = mkIntParam 45000 ''

     

       999
       +
           Maximum size of a PA-TNC message (XML &#38; Base64 encoding).

     

       1000
       +
         '';

     

       1001
       +
       

     

       1002
       +
         tnccs-20.max_batch_size = mkIntParam 65522 ''

     

       1003
       +
           Maximum size of a PB-TNC batch (upper limit via PT-EAP = 65529).

     

       1004
       +
         '';

     

       1005
       +
       

     

       1006
       +
         tnccs-20.max_message_size = mkIntParam 65490 ''

     

       1007
       +
           Maximum size of a PA-TNC message (upper limit via PT-EAP = 65497).

     

       1008
       +
         '';

     

       1009
       +
       

     

       1010
       +
         tnccs-20.mutual = mkYesNoParam no ''

     

       1011
       +
           Enable PB-TNC mutual protocol.

     

       1012
       +
         '';

     

       1013
       +
       

     

       1014
       +
         tpm.use_rng = mkYesNoParam no ''

     

       1015
       +
           Whether the TPM should be used as RNG.

     

       1016
       +
         '';

     

       1017
       +
       

     

       1018
       +
         unbound.dlv_anchors = mkOptionalStrParam ''

     

       1019
       +
           File to read trusted keys for DLV from. It uses the same format as

     

       1020
       +
           <option>trust_anchors</option>. Only one DLV can be configured, which is

     

       1021
       +
           then used as a root trusted DLV, this means that it is a lookaside for the

     

       1022
       +
           root.

     

       1023
       +
         '';

     

       1024
       +
       

     

       1025
       +
         unbound.resolv_conf = mkStrParam "/etc/resolv.conf" ''

     

       1026
       +
           File to read DNS resolver configuration from.

     

       1027
       +
         '';

     

       1028
       +
       

     

       1029
       +
         unbound.trust_anchors = mkStrParam "/etc/ipsec.d/dnssec.keys" ''

     

       1030
       +
           File to read DNSSEC trust anchors from (usually root zone KSK). The

     

       1031
       +
           format of the file is the standard DNS Zone file format, anchors can be

     

       1032
       +
           stored as DS or DNSKEY entries in the file.

     

       1033
       +
         '';

     

       1034
       +
       

     

       1035
       +
         updown.dns_handler = mkYesNoParam no ''

     

       1036
       +
           Whether the updown script should handle DNS servers assigned via IKEv1

     

       1037
       +
           Mode Config or IKEv2 Config Payloads (if enabled they can't be handled

     

       1038
       +
           by other plugins, like resolve).

     

       1039
       +
         '';

     

       1040
       +
       

     

       1041
       +
         vici.socket = mkStrParam "unix://\${piddir}/charon.vici" ''

     

       1042
       +
           Socket the vici plugin serves clients.

     

       1043
       +
         '';

     

       1044
       +
       

     

       1045
       +
         whitelist.enable = mkYesNoParam yes ''

     

       1046
       +
           Enable loaded whitelist plugin.

     

       1047
       +
         '';

     

       1048
       +
       

     

       1049
       +
         whitelist.socket = mkStrParam "unix://\${piddir}/charon.wlst" ''

     

       1050
       +
           Socket provided by the whitelist plugin.

     

       1051
       +
         '';

     

       1052
       +
       

     

       1053
       +
         xauth-eap.backend = mkStrParam "radius" ''

     

       1054
       +
           EAP plugin to be used as backend for XAuth credential verification, see

     

       1055
       +
           XAuthEAP.

     

       1056
       +
         '';

     

       1057
       +
       

     

       1058
       +
         xauth-pam.pam_service = mkStrParam "login" ''

     

       1059
       +
           PAM service to be used for authentication, see XAuthPAM.

     

       1060
       +
         '';

     

       1061
       +
       

     

       1062
       +
         xauth-pam.session = mkYesNoParam no ''

     

       1063
       +
           Open/close a PAM session for each active IKE_SA.

     

       1064
       +
         '';

     

       1065
       +
       

     

       1066
       +
         xauth-pam.trim_email = mkYesNoParam yes ''

     

       1067
       +
           If an email address is given as an XAuth username, trim it to just the

     

       1068
       +
           username part.

     

       1069
       +
         '';

     

       1070
       +
       }

+291

nixos/modules/services/networking/strongswan-swanctl/strongswan-libimcv-params.nix

···

       1
       +
       lib : with (import ./param-constructors.nix lib); {

     

       2
       +
         debug_level = mkIntParam 1 ''

     

       3
       +
           Debug level for a stand-alone libimcv library.

     

       4
       +
         '';

     

       5
       +
       

     

       6
       +
         load = mkSpaceSepListParam ["random" "nonce" "gmp" "pubkey" "x509"] ''

     

       7
       +
           Plugins to load in IMC/IMVs with stand-alone libimcv library.

     

       8
       +
         '';

     

       9
       +
       

     

       10
       +
         stderr_quiet = mkYesNoParam no ''

     

       11
       +
           Disable the output to stderr with a stand-alone libimcv library.

     

       12
       +
         '';

     

       13
       +
       

     

       14
       +
         swid_gen = {

     

       15
       +
           command = mkStrParam "/usr/local/bin/swid_generator" ''

     

       16
       +
             SWID generator command to be executed.

     

       17
       +
           '';

     

       18
       +
       

     

       19
       +
           tag_creator = {

     

       20
       +
             name = mkStrParam "strongSwan Project" ''

     

       21
       +
               Name of the tagCreator entity.

     

       22
       +
             '';

     

       23
       +
       

     

       24
       +
             regid = mkStrParam "strongswan.org" ''

     

       25
       +
               regid of the tagCreator entity.

     

       26
       +
             '';

     

       27
       +
           };

     

       28
       +
         };

     

       29
       +
       

     

       30
       +
         plugins = {

     

       31
       +
       

     

       32
       +
           imc-attestation = {

     

       33
       +
             aik_blob = mkOptionalStrParam ''

     

       34
       +
               AIK encrypted private key blob file.

     

       35
       +
             '';

     

       36
       +
       

     

       37
       +
             aik_cert = mkOptionalStrParam ''

     

       38
       +
               AIK certificate file.

     

       39
       +
             '';

     

       40
       +
       

     

       41
       +
             aik_handle = mkOptionalStrParam ''

     

       42
       +
               AIK object handle, e.g. 0x81010003.

     

       43
       +
             '';

     

       44
       +
       

     

       45
       +
             aik_pubkey = mkOptionalStrParam ''

     

       46
       +
               AIK public key file.

     

       47
       +
             '';

     

       48
       +
       

     

       49
       +
             mandatory_dh_groups = mkYesNoParam yes ''

     

       50
       +
               Enforce mandatory Diffie-Hellman groups

     

       51
       +
             '';

     

       52
       +
       

     

       53
       +
             nonce_len = mkIntParam 20 ''

     

       54
       +
               DH nonce length.

     

       55
       +
             '';

     

       56
       +
       

     

       57
       +
             pcr_info = mkYesNoParam no ''

     

       58
       +
               Whether to send pcr_before and pcr_after info.

     

       59
       +
             '';

     

       60
       +
       

     

       61
       +
             use_quote2 = mkYesNoParam yes ''

     

       62
       +
               Use Quote2 AIK signature instead of Quote signature.

     

       63
       +
             '';

     

       64
       +
       

     

       65
       +
             use_version_info = mkYesNoParam no ''

     

       66
       +
               Version Info is included in Quote2 signature.

     

       67
       +
             '';

     

       68
       +
           };

     

       69
       +
       

     

       70
       +
           imc-hcd.push_info = mkYesNoParam yes ''

     

       71
       +
             Send quadruple info without being prompted.

     

       72
       +
           '';

     

       73
       +
       

     

       74
       +
           imc-hcd.subtypes = let

     

       75
       +
             imcHcdSubtypeParams = let

     

       76
       +
               softwareParams = mkAttrsOfParams {

     

       77
       +
                 name = mkOptionalStrParam ''

     

       78
       +
                   Name of the software installed on the hardcopy device.

     

       79
       +
                 '';

     

       80
       +
       

     

       81
       +
                 patches = mkOptionalStrParam ''

     

       82
       +
                   String describing all patches applied to the given software on this

     

       83
       +
                   hardcopy device. The individual patches are separated by a newline

     

       84
       +
                   character '\\n'.

     

       85
       +
                 '';

     

       86
       +
       

     

       87
       +
                 string_version = mkOptionalStrParam ''

     

       88
       +
                   String describing the version of the given software on this hardcopy device.

     

       89
       +
                 '';

     

       90
       +
       

     

       91
       +
                 version = mkOptionalStrParam ''

     

       92
       +
                   Hex-encoded version string with a length of 16 octets consisting of

     

       93
       +
                   the fields major version number (4 octets), minor version number (4

     

       94
       +
                   octets), build number (4 octets), service pack major number (2

     

       95
       +
                   octets) and service pack minor number (2 octets).

     

       96
       +
                 '';

     

       97
       +
               } ''

     

       98
       +
                 Defines a software section having an arbitrary name.

     

       99
       +
               '';

     

       100
       +
             in {

     

       101
       +
               firmware             = softwareParams;

     

       102
       +
               resident_application = softwareParams;

     

       103
       +
               user_application     = softwareParams;

     

       104
       +
               attributes_natural_language = mkStrParam "en" ''

     

       105
       +
                 Variable length natural language tag conforming to RFC 5646 specifies

     

       106
       +
                 the language to be used in the health assessment message of a given

     

       107
       +
                 subtype.

     

       108
       +
               '';

     

       109
       +
             };

     

       110
       +
           in {

     

       111
       +
             system = imcHcdSubtypeParams // {

     

       112
       +
               certification_state = mkOptionalStrParam ''

     

       113
       +
                 Hex-encoded certification state.

     

       114
       +
               '';

     

       115
       +
       

     

       116
       +
               configuration_state = mkOptionalStrParam ''

     

       117
       +
                 Hex-encoded configuration state.

     

       118
       +
               '';

     

       119
       +
       

     

       120
       +
               machine_type_model = mkOptionalStrParam ''

     

       121
       +
                 String specifying the machine type and model of the hardcopy device.

     

       122
       +
               '';

     

       123
       +
       

     

       124
       +
               pstn_fax_enabled = mkYesNoParam no ''

     

       125
       +
                 Specifies if a PSTN facsimile interface is installed and enabled on the

     

       126
       +
                 hardcopy device.

     

       127
       +
               '';

     

       128
       +
       

     

       129
       +
               time_source = mkOptionalStrParam ''

     

       130
       +
                 String specifying the hostname of the network time server used by the

     

       131
       +
                 hardcopy device.

     

       132
       +
               '';

     

       133
       +
       

     

       134
       +
               user_application_enabled = mkYesNoParam no ''

     

       135
       +
                 Specifies if users can dynamically download and execute applications on

     

       136
       +
                 the hardcopy device.

     

       137
       +
               '';

     

       138
       +
       

     

       139
       +
               user_application_persistence_enabled = mkYesNoParam no ''

     

       140
       +
                 Specifies if user dynamically downloaded applications can persist outside

     

       141
       +
                 the boundaries of a single job on the hardcopy device.

     

       142
       +
               '';

     

       143
       +
       

     

       144
       +
               vendor_name = mkOptionalStrParam ''

     

       145
       +
                 String specifying the manufacturer of the hardcopy device.

     

       146
       +
               '';

     

       147
       +
       

     

       148
       +
               vendor_smi_code = mkOptionalIntParam ''

     

       149
       +
                 Integer specifying the globally unique 24-bit SMI code assigned to the

     

       150
       +
                 manufacturer of the hardcopy device.

     

       151
       +
               '';

     

       152
       +
             };

     

       153
       +
             control   = imcHcdSubtypeParams;

     

       154
       +
             marker    = imcHcdSubtypeParams;

     

       155
       +
             finisher  = imcHcdSubtypeParams;

     

       156
       +
             interface = imcHcdSubtypeParams;

     

       157
       +
             scanner   = imcHcdSubtypeParams;

     

       158
       +
           };

     

       159
       +
       

     

       160
       +
           imc-os = {

     

       161
       +
             device_cert = mkOptionalStrParam ''

     

       162
       +
               Manually set the path to the client device certificate

     

       163
       +
               (e.g. /etc/pts/aikCert.der)

     

       164
       +
             '';

     

       165
       +
       

     

       166
       +
             device_id = mkOptionalStrParam ''

     

       167
       +
               Manually set the client device ID in hexadecimal format

     

       168
       +
               (e.g. 1083f03988c9762703b1c1080c2e46f72b99cc31)

     

       169
       +
             '';

     

       170
       +
       

     

       171
       +
             device_pubkey = mkOptionalStrParam ''

     

       172
       +
               Manually set the path to the client device public key

     

       173
       +
               (e.g. /etc/pts/aikPub.der)

     

       174
       +
             '';

     

       175
       +
       

     

       176
       +
             push_info = mkYesNoParam yes ''

     

       177
       +
               Send operating system info without being prompted.

     

       178
       +
             '';

     

       179
       +
           };

     

       180
       +
       

     

       181
       +
           imc-scanner.push_info = mkYesNoParam yes ''

     

       182
       +
             Send open listening ports without being prompted.

     

       183
       +
           '';

     

       184
       +
       

     

       185
       +
           imc-swid = {

     

       186
       +
             swid_full = mkYesNoParam no ''

     

       187
       +
               Include file information in the XML-encoded SWID tags.

     

       188
       +
             '';

     

       189
       +
       

     

       190
       +
             swid_pretty = mkYesNoParam no ''

     

       191
       +
               Generate XML-encoded SWID tags with pretty indentation.

     

       192
       +
             '';

     

       193
       +
       

     

       194
       +
             swid_directory = mkStrParam "\${prefix}/share" ''

     

       195
       +
               Directory where SWID tags are located.

     

       196
       +
             '';

     

       197
       +
           };

     

       198
       +
       

     

       199
       +
           imc-swima = {

     

       200
       +
             eid_epoch = mkHexParam "0x11223344" ''

     

       201
       +
               Set 32 bit epoch value for event IDs manually if software collector

     

       202
       +
               database is not available.

     

       203
       +
             '';

     

       204
       +
       

     

       205
       +
             swid_database = mkOptionalStrParam ''

     

       206
       +
               URI to software collector database containing event timestamps, software

     

       207
       +
               creation and deletion events and collected software identifiers.  If it

     

       208
       +
               contains a password, make sure to adjust the permissions of the config

     

       209
       +
               file accordingly.

     

       210
       +
             '';

     

       211
       +
       

     

       212
       +
             swid_directory = mkStrParam "\${prefix}/share" ''

     

       213
       +
               Directory where SWID tags are located.

     

       214
       +
             '';

     

       215
       +
       

     

       216
       +
             swid_pretty = mkYesNoParam no ''

     

       217
       +
               Generate XML-encoded SWID tags with pretty indentation.

     

       218
       +
             '';

     

       219
       +
       

     

       220
       +
             swid_full = mkYesNoParam no ''

     

       221
       +
               Include file information in the XML-encoded SWID tags.

     

       222
       +
             '';

     

       223
       +
           };

     

       224
       +
       

     

       225
       +
           imc-test = {

     

       226
       +
             additional_ids = mkIntParam 0 ''

     

       227
       +
               Number of additional IMC IDs.

     

       228
       +
             '';

     

       229
       +
       

     

       230
       +
             command = mkStrParam "none" ''

     

       231
       +
               Command to be sent to the Test IMV.

     

       232
       +
             '';

     

       233
       +
       

     

       234
       +
             dummy_size = mkIntParam 0 ''

     

       235
       +
               Size of dummy attribute to be sent to the Test IMV (0 = disabled).

     

       236
       +
             '';

     

       237
       +
       

     

       238
       +
             retry = mkYesNoParam no ''

     

       239
       +
               Do a handshake retry.

     

       240
       +
             '';

     

       241
       +
       

     

       242
       +
             retry_command = mkOptionalStrParam ''

     

       243
       +
               Command to be sent to the IMV Test in the handshake retry.

     

       244
       +
             '';

     

       245
       +
           };

     

       246
       +
       

     

       247
       +
           imv-attestation = {

     

       248
       +
             cadir = mkOptionalStrParam ''

     

       249
       +
               Path to directory with AIK cacerts.

     

       250
       +
             '';

     

       251
       +
       

     

       252
       +
             dh_group = mkStrParam "ecp256" ''

     

       253
       +
               Preferred Diffie-Hellman group.

     

       254
       +
             '';

     

       255
       +
       

     

       256
       +
             hash_algorithm = mkStrParam "sha256" ''

     

       257
       +
               Preferred measurement hash algorithm.

     

       258
       +
             '';

     

       259
       +
       

     

       260
       +
             min_nonce_len = mkIntParam 0 ''

     

       261
       +
               DH minimum nonce length.

     

       262
       +
             '';

     

       263
       +
       

     

       264
       +
             remediation_uri = mkOptionalStrParam ''

     

       265
       +
               URI pointing to attestation remediation instructions.

     

       266
       +
             '';

     

       267
       +
           };

     

       268
       +
       

     

       269
       +
           imv-os.remediation_uri = mkOptionalStrParam ''

     

       270
       +
             URI pointing to operating system remediation instructions.

     

       271
       +
           '';

     

       272
       +
       

     

       273
       +
           imv-scanner.remediation_uri = mkOptionalStrParam ''

     

       274
       +
             URI pointing to scanner remediation instructions.

     

       275
       +
           '';

     

       276
       +
       

     

       277
       +
           imv-swima.rest_api = {

     

       278
       +
             uri = mkOptionalStrParam ''

     

       279
       +
               HTTP URI of the SWID REST API.

     

       280
       +
             '';

     

       281
       +
       

     

       282
       +
             timeout = mkIntParam 120 ''

     

       283
       +
               Timeout of SWID REST API HTTP POST transaction.

     

       284
       +
             '';

     

       285
       +
           };

     

       286
       +
       

     

       287
       +
           imv-test.rounds = mkIntParam 0 ''

     

       288
       +
             Number of IMC-IMV retry rounds.

     

       289
       +
           '';

     

       290
       +
         };

     

       291
       +
       }

+29

nixos/modules/services/networking/strongswan-swanctl/strongswan-loglevel-params.nix

···

       1
       +
       lib : with (import ./param-constructors.nix lib);

     

       2
       +
       

     

       3
       +
       let mkJournalParam = description :

     

       4
       +
             mkEnumParam [(-1) 0 1 2 3 4] 0 "Logging level for ${description}";

     

       5
       +
       in {

     

       6
       +
         default = mkIntParam 1 ''

     

       7
       +
           Specifies the default loglevel to be used for subsystems for which no

     

       8
       +
           specific loglevel is defined.

     

       9
       +
         '';

     

       10
       +
       

     

       11
       +
         app = mkJournalParam "applications other than daemons.";

     

       12
       +
         asn = mkJournalParam "low-level encoding/decoding (ASN.1, X.509 etc.)";

     

       13
       +
         cfg = mkJournalParam "configuration management and plugins.";

     

       14
       +
         chd = mkJournalParam "CHILD_SA/IPsec SA.";

     

       15
       +
         dmn = mkJournalParam "main daemon setup/cleanup/signal handling.";

     

       16
       +
         enc = mkJournalParam "packet encoding/decoding encryption/decryption operations.";

     

       17
       +
         esp = mkJournalParam "libipsec library messages.";

     

       18
       +
         ike = mkJournalParam "IKE_SA/ISAKMP SA.";

     

       19
       +
         imc = mkJournalParam "integrity Measurement Collector.";

     

       20
       +
         imv = mkJournalParam "integrity Measurement Verifier.";

     

       21
       +
         job = mkJournalParam "jobs queuing/processing and thread pool management.";

     

       22
       +
         knl = mkJournalParam "IPsec/Networking kernel interface.";

     

       23
       +
         lib = mkJournalParam "libstrongwan library messages.";

     

       24
       +
         mgr = mkJournalParam "IKE_SA manager, handling synchronization for IKE_SA access.";

     

       25
       +
         net = mkJournalParam "IKE network communication.";

     

       26
       +
         pts = mkJournalParam "platform Trust Service.";

     

       27
       +
         tls = mkJournalParam "libtls library messages.";

     

       28
       +
         tnc = mkJournalParam "trusted Network Connect.";

     

       29
       +
       }

+228

nixos/modules/services/networking/strongswan-swanctl/strongswan-params.nix

···

       1
       +
       # See: https://wiki.strongswan.org/projects/strongswan/wiki/StrongswanConf

     

       2
       +
       #

     

       3
       +
       # When strongSwan is upgraded please update the parameters in this file. You can

     

       4
       +
       # see which parameters should be deleted, changed or added by diffing

     

       5
       +
       # the strongswan conf directory:

     

       6
       +
       #

     

       7
       +
       #   git clone https://github.com/strongswan/strongswan.git

     

       8
       +
       #   cd strongswan

     

       9
       +
       #   git diff 5.5.3..5.6.0 conf/

     

       10
       +
       

     

       11
       +
       lib: with (import ./param-constructors.nix lib);

     

       12
       +
       

     

       13
       +
       let charonParams = import ./strongswan-charon-params.nix lib;

     

       14
       +
       in {

     

       15
       +
         aikgen = {

     

       16
       +
           load = mkSpaceSepListParam [] ''

     

       17
       +
             Plugins to load in ipsec aikgen tool.

     

       18
       +
           '';

     

       19
       +
         };

     

       20
       +
         attest = {

     

       21
       +
           database = mkOptionalStrParam ''

     

       22
       +
             File measurement information database URI. If it contains a password,

     

       23
       +
             make sure to adjust the permissions of the config file accordingly.

     

       24
       +
           '';

     

       25
       +
       

     

       26
       +
           load = mkSpaceSepListParam [] ''

     

       27
       +
             Plugins to load in ipsec attest tool.

     

       28
       +
           '';

     

       29
       +
         };

     

       30
       +
       

     

       31
       +
         charon = charonParams;

     

       32
       +
       

     

       33
       +
         charon-nm = {

     

       34
       +
           ca_dir = mkStrParam "<default>" ''

     

       35
       +
             Directory from which to load CA certificates if no certificate is

     

       36
       +
             configured.

     

       37
       +
           '';

     

       38
       +
         };

     

       39
       +
       

     

       40
       +
         charon-systemd = charonParams // {

     

       41
       +
           journal = import ./strongswan-loglevel-params.nix lib;

     

       42
       +
         };

     

       43
       +
       

     

       44
       +
         imv_policy_manager = {

     

       45
       +
           command_allow = mkOptionalStrParam ''

     

       46
       +
             Shell command to be executed with recommendation allow.

     

       47
       +
           '';

     

       48
       +
       

     

       49
       +
           command_block = mkOptionalStrParam ''

     

       50
       +
             Shell command to be executed with all other recommendations.

     

       51
       +
           '';

     

       52
       +
       

     

       53
       +
           database = mkOptionalStrParam ''

     

       54
       +
             Database URI for the database that stores the package information. If it

     

       55
       +
             contains a password, make sure to adjust permissions of the config file

     

       56
       +
             accordingly.

     

       57
       +
           '';

     

       58
       +
       

     

       59
       +
           load = mkSpaceSepListParam ["sqlite"] ''

     

       60
       +
             Plugins to load in IMV policy manager.

     

       61
       +
           '';

     

       62
       +
         };

     

       63
       +
       

     

       64
       +
         libimcv = import ./strongswan-libimcv-params.nix lib;

     

       65
       +
       

     

       66
       +
         manager = {

     

       67
       +
           database = mkOptionalStrParam ''

     

       68
       +
             Credential database URI for manager. If it contains a password, make

     

       69
       +
             sure to adjust the permissions of the config file accordingly.

     

       70
       +
           '';

     

       71
       +
       

     

       72
       +
           debug = mkYesNoParam no ''

     

       73
       +
             Enable debugging in manager.

     

       74
       +
           '';

     

       75
       +
       

     

       76
       +
           load = mkSpaceSepListParam [] ''

     

       77
       +
             Plugins to load in manager.

     

       78
       +
           '';

     

       79
       +
       

     

       80
       +
           socket = mkOptionalStrParam ''

     

       81
       +
             FastCGI socket of manager, to run it statically.

     

       82
       +
           '';

     

       83
       +
       

     

       84
       +
           threads = mkIntParam 10 ''

     

       85
       +
             Threads to use for request handling.

     

       86
       +
           '';

     

       87
       +
       

     

       88
       +
           timeout = mkDurationParam "15m" ''

     

       89
       +
             Session timeout for manager.

     

       90
       +
           '';

     

       91
       +
         };

     

       92
       +
       

     

       93
       +
         medcli = {

     

       94
       +
           database = mkOptionalStrParam ''

     

       95
       +
             Mediation client database URI. If it contains a password, make sure to

     

       96
       +
             adjust the permissions of the config file accordingly.

     

       97
       +
           '';

     

       98
       +
       

     

       99
       +
           dpd = mkDurationParam "5m" ''

     

       100
       +
             DPD timeout to use in mediation client plugin.

     

       101
       +
           '';

     

       102
       +
       

     

       103
       +
           rekey = mkDurationParam "20m" ''

     

       104
       +
             Rekeying time on mediation connections in mediation client plugin.

     

       105
       +
           '';

     

       106
       +
         };

     

       107
       +
       

     

       108
       +
         medsrv = {

     

       109
       +
           database = mkOptionalStrParam ''

     

       110
       +
             Mediation server database URI. If it contains a password, make sure to

     

       111
       +
             adjust the permissions of the config file accordingly.

     

       112
       +
           '';

     

       113
       +
       

     

       114
       +
           debug = mkYesNoParam no ''

     

       115
       +
             Debugging in mediation server web application.

     

       116
       +
           '';

     

       117
       +
       

     

       118
       +
           dpd = mkDurationParam "5m" ''

     

       119
       +
             DPD timeout to use in mediation server plugin.

     

       120
       +
           '';

     

       121
       +
       

     

       122
       +
           load = mkSpaceSepListParam [] ''

     

       123
       +
             Plugins to load in mediation server plugin.

     

       124
       +
           '';

     

       125
       +
       

     

       126
       +
           password_length = mkIntParam 6 ''

     

       127
       +
             Minimum password length required for mediation server user accounts.

     

       128
       +
           '';

     

       129
       +
       

     

       130
       +
           rekey = mkDurationParam "20m" ''

     

       131
       +
             Rekeying time on mediation connections in mediation server plugin.

     

       132
       +
           '';

     

       133
       +
       

     

       134
       +
           socket = mkOptionalStrParam ''

     

       135
       +
             Run Mediation server web application statically on socket.

     

       136
       +
           '';

     

       137
       +
       

     

       138
       +
           threads = mkIntParam 5 ''

     

       139
       +
             Number of thread for mediation service web application.

     

       140
       +
           '';

     

       141
       +
       

     

       142
       +
           timeout = mkDurationParam "15m" ''

     

       143
       +
             Session timeout for mediation service.

     

       144
       +
           '';

     

       145
       +
         };

     

       146
       +
       

     

       147
       +
         pacman.database = mkOptionalStrParam ''

     

       148
       +
           Database URI for the database that stores the package information. If it

     

       149
       +
           contains a password, make sure to adjust the permissions of the config

     

       150
       +
           file accordingly.

     

       151
       +
         '';

     

       152
       +
       

     

       153
       +
         pki.load = mkSpaceSepListParam [] ''

     

       154
       +
           Plugins to load in ipsec pki tool.

     

       155
       +
         '';

     

       156
       +
       

     

       157
       +
         pool = {

     

       158
       +
           database = mkOptionalStrParam ''

     

       159
       +
             Database URI for the database that stores IP pools and configuration

     

       160
       +
             attributes. If it contains a password, make sure to adjust the

     

       161
       +
             permissions of the config file accordingly.

     

       162
       +
           '';

     

       163
       +
       

     

       164
       +
           load = mkSpaceSepListParam [] ''

     

       165
       +
             Plugins to load in ipsec pool tool.

     

       166
       +
           '';

     

       167
       +
         };

     

       168
       +
       

     

       169
       +
         pt-tls-client.load = mkSpaceSepListParam [] ''

     

       170
       +
           Plugins to load in ipsec pt-tls-client tool.

     

       171
       +
         '';

     

       172
       +
       

     

       173
       +
         scepclient.load = mkSpaceSepListParam [] ''

     

       174
       +
           Plugins to load in ipsec scepclient tool.

     

       175
       +
         '';

     

       176
       +
       

     

       177
       +
         starter = {

     

       178
       +
           config_file = mkStrParam "\${sysconfdir}/ipsec.conf" ''

     

       179
       +
             Location of the ipsec.conf file.

     

       180
       +
           '';

     

       181
       +
       

     

       182
       +
           load_warning = mkYesNoParam yes ''

     

       183
       +
             Show charon.load setting warning, see

     

       184
       +
             https://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad

     

       185
       +
           '';

     

       186
       +
         };

     

       187
       +
       

     

       188
       +
         sw-collector = {

     

       189
       +
           database = mkOptionalStrParam ''

     

       190
       +
             URI to software collector database containing event timestamps,

     

       191
       +
             software creation and deletion events and collected software

     

       192
       +
             identifiers. If it contains a password, make sure to adjust the

     

       193
       +
             permissions of the config file accordingly.

     

       194
       +
           '';

     

       195
       +
       

     

       196
       +
           first_file = mkStrParam "/var/log/bootstrap.log" ''

     

       197
       +
             Path pointing to file created when the Linux OS was installed.

     

       198
       +
           '';

     

       199
       +
       

     

       200
       +
           first_time = mkStrParam "0000-00-00T00:00:00Z" ''

     

       201
       +
             Time in UTC when the Linux OS was installed.

     

       202
       +
           '';

     

       203
       +
       

     

       204
       +
           history = mkOptionalStrParam ''

     

       205
       +
             Path pointing to apt history.log file.

     

       206
       +
           '';

     

       207
       +
       

     

       208
       +
           rest_api = {

     

       209
       +
             uri = mkOptionalStrParam ''

     

       210
       +
               HTTP URI of the central collector's REST API.

     

       211
       +
             '';

     

       212
       +
       

     

       213
       +
             timeout = mkIntParam 120 ''

     

       214
       +
               Timeout of REST API HTTP POST transaction.

     

       215
       +
             '';

     

       216
       +
           };

     

       217
       +
       

     

       218
       +
           load = mkSpaceSepListParam [] "Plugins to load in sw-collector tool.";

     

       219
       +
         };

     

       220
       +
       

     

       221
       +
         swanctl = {

     

       222
       +
           load = mkSpaceSepListParam [] "Plugins to load in swanctl.";

     

       223
       +
       

     

       224
       +
           socket = mkStrParam "unix://\${piddir}/charon.vici" ''

     

       225
       +
             VICI socket to connect to by default.

     

       226
       +
           '';

     

       227
       +
         };

     

       228
       +
       }

+1145

nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix

···

       1
       +
       # See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctlconf

     

       2
       +
       #

     

       3
       +
       # When strongSwan is upgraded please update the parameters in this file. You can

     

       4
       +
       # see which parameters should be deleted, changed or added by diffing

     

       5
       +
       # swanctl.opt:

     

       6
       +
       #

     

       7
       +
       #   git clone https://github.com/strongswan/strongswan.git

     

       8
       +
       #   cd strongswan

     

       9
       +
       #   git diff 5.5.3..5.6.0 src/swanctl/swanctl.opt

     

       10
       +
       

     

       11
       +
       lib: with (import ./param-constructors.nix lib);

     

       12
       +
       

     

       13
       +
       let

     

       14
       +
         certParams = {

     

       15
       +
           file = mkOptionalStrParam ''

     

       16
       +
             Absolute path to the certificate to load. Passed as-is to the daemon, so

     

       17
       +
             it must be readable by it.

     

       18
       +
             </para><para>

     

       19
       +
             Configure either this or <option>handle</option>, but not both, in one section.

     

       20
       +
           '';

     

       21
       +
       

     

       22
       +
           handle = mkOptionalHexParam ''

     

       23
       +
             Hex-encoded CKA_ID or handle of the certificate on a token or TPM,

     

       24
       +
             respectively.

     

       25
       +
             </para><para>

     

       26
       +
             Configure either this or <option>file</option>, but not both, in one section.

     

       27
       +
           '';

     

       28
       +
       

     

       29
       +
           slot = mkOptionalIntParam ''

     

       30
       +
             Optional slot number of the token that stores the certificate.

     

       31
       +
           '';

     

       32
       +
       

     

       33
       +
           module = mkOptionalStrParam ''

     

       34
       +
             Optional PKCS#11 module name.

     

       35
       +
           '';

     

       36
       +
         };

     

       37
       +
       in {

     

       38
       +
         authorities = mkAttrsOfParams ({

     

       39
       +
       

     

       40
       +
           cacert = mkOptionalStrParam ''

     

       41
       +
             The certificates may use a relative path from the swanctl

     

       42
       +
             <literal>x509ca</literal> directory or an absolute path.

     

       43
       +
             </para><para>

     

       44
       +
             Configure one of <option>cacert</option>,

     

       45
       +
             <option>file</option>, or

     

       46
       +
             <option>handle</option> per section.

     

       47
       +
           '';

     

       48
       +
       

     

       49
       +
           cert_uri_base = mkOptionalStrParam ''

     

       50
       +
             Defines the base URI for the Hash and URL feature supported by

     

       51
       +
             IKEv2. Instead of exchanging complete certificates, IKEv2 allows one to

     

       52
       +
             send an URI that resolves to the DER encoded certificate. The certificate

     

       53
       +
             URIs are built by appending the SHA1 hash of the DER encoded certificates

     

       54
       +
             to this base URI.

     

       55
       +
           '';

     

       56
       +
       

     

       57
       +
           crl_uris = mkCommaSepListParam [] ''

     

       58
       +
             List of CRL distribution points (ldap, http, or file URI).

     

       59
       +
           '';

     

       60
       +
       

     

       61
       +
           ocsp_uris = mkCommaSepListParam [] ''

     

       62
       +
             List of OCSP URIs.

     

       63
       +
           '';

     

       64
       +
       

     

       65
       +
         } // certParams) ''

     

       66
       +
           Section defining complementary attributes of certification authorities, each

     

       67
       +
           in its own subsection with an arbitrary yet unique name

     

       68
       +
         '';

     

       69
       +
       

     

       70
       +
         connections = mkAttrsOfParams {

     

       71
       +
       

     

       72
       +
           version = mkIntParam 0 ''

     

       73
       +
             IKE major version to use for connection.

     

       74
       +
             <itemizedlist>

     

       75
       +
             <listitem><para>1 uses IKEv1 aka ISAKMP,</para></listitem>

     

       76
       +
             <listitem><para>2 uses IKEv2.</para></listitem>

     

       77
       +
             <listitem><para>A connection using the default of 0 accepts both IKEv1 and IKEv2 as

     

       78
       +
             responder, and initiates the connection actively with IKEv2.</para></listitem>

     

       79
       +
             </itemizedlist>

     

       80
       +
           '';

     

       81
       +
       

     

       82
       +
           local_addrs	= mkCommaSepListParam [] ''

     

       83
       +
             Local address(es) to use for IKE communication. Takes

     

       84
       +
             single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.

     

       85
       +
             </para><para>

     

       86
       +
             As initiator, the first non-range/non-subnet is used to initiate the

     

       87
       +
             connection from. As responder, the local destination address must match at

     

       88
       +
             least to one of the specified addresses, subnets or ranges.

     

       89
       +
             </para><para>

     

       90
       +
             If FQDNs are assigned they are resolved every time a configuration lookup

     

       91
       +
             is done. If DNS resolution times out, the lookup is delayed for that time.

     

       92
       +
           '';

     

       93
       +
       

     

       94
       +
           remote_addrs = mkCommaSepListParam [] ''

     

       95
       +
             Remote address(es) to use for IKE communication. Takes

     

       96
       +
             single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.

     

       97
       +
             </para><para>

     

       98
       +
             As initiator, the first non-range/non-subnet is used to initiate the

     

       99
       +
             connection to. As responder, the initiator source address must match at

     

       100
       +
             least to one of the specified addresses, subnets or ranges.

     

       101
       +
             </para><para>

     

       102
       +
             If FQDNs are assigned they are resolved every time a configuration lookup

     

       103
       +
             is done. If DNS resolution times out, the lookup is delayed for that time.

     

       104
       +
             To initiate a connection, at least one specific address or DNS name must

     

       105
       +
             be specified.

     

       106
       +
           '';

     

       107
       +
       

     

       108
       +
           local_port = mkIntParam 500 ''

     

       109
       +
             Local UDP port for IKE communication. By default the port of the socket

     

       110
       +
             backend is used, which is usually <literal>500</literal>. If port

     

       111
       +
             <literal>500</literal> is used, automatic IKE port floating to port

     

       112
       +
             <literal>4500</literal> is used to work around NAT issues.

     

       113
       +
             </para><para>

     

       114
       +
             Using a non-default local IKE port requires support from the socket

     

       115
       +
             backend in use (socket-dynamic).

     

       116
       +
           '';

     

       117
       +
       

     

       118
       +
           remote_port = mkIntParam 500 ''

     

       119
       +
             Remote UDP port for IKE communication. If the default of port

     

       120
       +
             <literal>500</literal> is used, automatic IKE port floating to port

     

       121
       +
             <literal>4500</literal> is used to work around NAT issues.

     

       122
       +
           '';

     

       123
       +
       

     

       124
       +
           proposals = mkCommaSepListParam ["default"] ''

     

       125
       +
             A proposal is a set of algorithms. For non-AEAD algorithms, this includes

     

       126
       +
             for IKE an encryption algorithm, an integrity algorithm, a pseudo random

     

       127
       +
             function and a Diffie-Hellman group. For AEAD algorithms, instead of

     

       128
       +
             encryption and integrity algorithms, a combined algorithm is used.

     

       129
       +
             </para><para>

     

       130
       +
             In IKEv2, multiple algorithms of the same kind can be specified in a

     

       131
       +
             single proposal, from which one gets selected. In IKEv1, only one

     

       132
       +
             algorithm per kind is allowed per proposal, more algorithms get implicitly

     

       133
       +
             stripped. Use multiple proposals to offer different algorithms

     

       134
       +
             combinations in IKEv1.

     

       135
       +
             </para><para>

     

       136
       +
             Algorithm keywords get separated using dashes. Multiple proposals may be

     

       137
       +
             specified in a list. The special value <literal>default</literal> forms a

     

       138
       +
             default proposal of supported algorithms considered safe, and is usually a

     

       139
       +
             good choice for interoperability.

     

       140
       +
           '';

     

       141
       +
       

     

       142
       +
           vips = mkCommaSepListParam [] ''

     

       143
       +
             List of virtual IPs to request in IKEv2 configuration payloads or IKEv1

     

       144
       +
             Mode Config. The wildcard addresses <literal>0.0.0.0</literal> and

     

       145
       +
             <literal>::</literal> request an arbitrary address, specific addresses may

     

       146
       +
             be defined. The responder may return a different address, though, or none

     

       147
       +
             at all.

     

       148
       +
           '';

     

       149
       +
       

     

       150
       +
           aggressive = mkYesNoParam no ''

     

       151
       +
             Enables Aggressive Mode instead of Main Mode with Identity

     

       152
       +
             Protection. Aggressive Mode is considered less secure, because the ID and

     

       153
       +
             HASH payloads are exchanged unprotected. This allows a passive attacker to

     

       154
       +
             snoop peer identities, and even worse, start dictionary attacks on the

     

       155
       +
             Preshared Key.

     

       156
       +
           '';

     

       157
       +
       

     

       158
       +
           pull = mkYesNoParam yes ''

     

       159
       +
             If the default of yes is used, Mode Config works in pull mode, where the

     

       160
       +
             initiator actively requests a virtual IP. With no, push mode is used,

     

       161
       +
             where the responder pushes down a virtual IP to the initiating peer.

     

       162
       +
             </para><para>

     

       163
       +
             Push mode is currently supported for IKEv1, but not in IKEv2. It is used

     

       164
       +
             by a few implementations only, pull mode is recommended.

     

       165
       +
           '';

     

       166
       +
       

     

       167
       +
           dscp = mkStrParam "000000" ''

     

       168
       +
             Differentiated Services Field Codepoint to set on outgoing IKE packets for

     

       169
       +
             this connection. The value is a six digit binary encoded string specifying

     

       170
       +
             the Codepoint to set, as defined in RFC 2474.

     

       171
       +
           '';

     

       172
       +
       

     

       173
       +
           encap = mkYesNoParam no ''

     

       174
       +
             To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the

     

       175
       +
             NAT detection payloads. This makes the peer believe that NAT takes place

     

       176
       +
             on the path, forcing it to encapsulate ESP packets in UDP.

     

       177
       +
             </para><para>

     

       178
       +
             Usually this is not required, but it can help to work around connectivity

     

       179
       +
             issues with too restrictive intermediary firewalls.

     

       180
       +
           '';

     

       181
       +
       

     

       182
       +
           mobike = mkYesNoParam yes ''

     

       183
       +
             Enables MOBIKE on IKEv2 connections. MOBIKE is enabled by default on IKEv2

     

       184
       +
             connections, and allows mobility of clients and multi-homing on servers by

     

       185
       +
             migrating active IPsec tunnels.

     

       186
       +
             </para><para>

     

       187
       +
             Usually keeping MOBIKE enabled is unproblematic, as it is not used if the

     

       188
       +
             peer does not indicate support for it. However, due to the design of

     

       189
       +
             MOBIKE, IKEv2 always floats to port 4500 starting from the second

     

       190
       +
             exchange. Some implementations don't like this behavior, hence it can be

     

       191
       +
             disabled.

     

       192
       +
           '';

     

       193
       +
       

     

       194
       +
           dpd_delay = mkDurationParam "0s" ''

     

       195
       +
             Interval to check the liveness of a peer actively using IKEv2

     

       196
       +
             INFORMATIONAL exchanges or IKEv1 R_U_THERE messages. Active DPD checking

     

       197
       +
             is only enforced if no IKE or ESP/AH packet has been received for the

     

       198
       +
             configured DPD delay.

     

       199
       +
           '';

     

       200
       +
       

     

       201
       +
           dpd_timeout = mkDurationParam "0s" ''

     

       202
       +
             Charon by default uses the normal retransmission mechanism and timeouts to

     

       203
       +
             check the liveness of a peer, as all messages are used for liveness

     

       204
       +
             checking. For compatibility reasons, with IKEv1 a custom interval may be

     

       205
       +
             specified; this option has no effect on connections using IKEv2.

     

       206
       +
           '';

     

       207
       +
       

     

       208
       +
           fragmentation = mkEnumParam ["yes" "accept" "force" "no"] "yes" ''

     

       209
       +
             Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2

     

       210
       +
             fragmentation). Acceptable values are <literal>yes</literal> (the default

     

       211
       +
             since 5.5.1), <literal>accept</literal> (since versions:5.5.3),

     

       212
       +
             <literal>force</literal> and <literal>no</literal>.

     

       213
       +
             <itemizedlist>

     

       214
       +
             <listitem><para>If set to <literal>yes</literal>, and the peer

     

       215
       +
             supports it, oversized IKE messages will be sent in fragments.</para></listitem>

     

       216
       +
             <listitem><para>If set to

     

       217
       +
             <literal>accept</literal>, support for fragmentation is announced to the peer but the daemon

     

       218
       +
             does not send its own messages in fragments.</para></listitem>

     

       219
       +
             <listitem><para>If set to <literal>force</literal> (only

     

       220
       +
             supported for IKEv1) the initial IKE message will already be fragmented if

     

       221
       +
             required.</para></listitem>

     

       222
       +
             <listitem><para>Finally, setting the option to <literal>no</literal> will disable announcing

     

       223
       +
             support for this feature.</para></listitem>

     

       224
       +
             </itemizedlist>

     

       225
       +
             </para><para>

     

       226
       +
             Note that fragmented IKE messages sent by a peer are always processed

     

       227
       +
             irrespective of the value of this option (even when set to no).

     

       228
       +
           '';

     

       229
       +
       

     

       230
       +
           send_certreq = mkYesNoParam yes ''

     

       231
       +
             Send certificate request payloads to offer trusted root CA certificates to

     

       232
       +
             the peer. Certificate requests help the peer to choose an appropriate

     

       233
       +
             certificate/private key for authentication and are enabled by default.

     

       234
       +
             Disabling certificate requests can be useful if too many trusted root CA

     

       235
       +
             certificates are installed, as each certificate request increases the size

     

       236
       +
             of the initial IKE packets.

     

       237
       +
          '';

     

       238
       +
       

     

       239
       +
           send_cert = mkEnumParam ["always" "never" "ifasked" ] "ifasked" ''

     

       240
       +
             Send certificate payloads when using certificate authentication.

     

       241
       +
             <itemizedlist>

     

       242
       +
             <listitem><para>With the default of <literal>ifasked</literal> the daemon sends

     

       243
       +
             certificate payloads only if certificate requests have been received.</para></listitem>

     

       244
       +
             <listitem><para><literal>never</literal> disables sending of certificate payloads

     

       245
       +
             altogether,</para></listitem>

     

       246
       +
             <listitem><para><literal>always</literal> causes certificate payloads to be sent

     

       247
       +
             unconditionally whenever certificate authentication is used.</para></listitem>

     

       248
       +
             </itemizedlist>

     

       249
       +
           '';

     

       250
       +
       

     

       251
       +
           keyingtries = mkIntParam 1 ''

     

       252
       +
             Number of retransmission sequences to perform during initial

     

       253
       +
             connect. Instead of giving up initiation after the first retransmission

     

       254
       +
             sequence with the default value of <literal>1</literal>, additional

     

       255
       +
             sequences may be started according to the configured value. A value of

     

       256
       +
             <literal>0</literal> initiates a new sequence until the connection

     

       257
       +
             establishes or fails with a permanent error.

     

       258
       +
           '';

     

       259
       +
       

     

       260
       +
           unique = mkEnumParam ["no" "never" "keep" "replace"] "no" ''

     

       261
       +
             Connection uniqueness policy to enforce. To avoid multiple connections

     

       262
       +
             from the same user, a uniqueness policy can be enforced.

     

       263
       +
             </para><para>

     

       264
       +
             <itemizedlist>

     

       265
       +
             <listitem><para>

     

       266
       +
             The value <literal>never</literal> does never enforce such a policy, even

     

       267
       +
             if a peer included INITIAL_CONTACT notification messages,

     

       268
       +
             </para></listitem>

     

       269
       +
             <listitem><para>

     

       270
       +
             whereas <literal>no</literal> replaces existing connections for the same

     

       271
       +
             identity if a new one has the INITIAL_CONTACT notify.

     

       272
       +
             </para></listitem>

     

       273
       +
             <listitem><para>

     

       274
       +
             <literal>keep</literal> rejects new connection attempts if the same user

     

       275
       +
             already has an active connection,

     

       276
       +
             </para></listitem>

     

       277
       +
             <listitem><para>

     

       278
       +
             <literal>replace</literal> deletes any existing connection if a new one

     

       279
       +
             for the same user gets established.

     

       280
       +
             </para></listitem>

     

       281
       +
             </itemizedlist>

     

       282
       +
             To compare connections for uniqueness, the remote IKE identity is used. If

     

       283
       +
             EAP or XAuth authentication is involved, the EAP-Identity or XAuth

     

       284
       +
             username is used to enforce the uniqueness policy instead.

     

       285
       +
             </para><para>

     

       286
       +
             On initiators this setting specifies whether an INITIAL_CONTACT notify is

     

       287
       +
             sent during IKE_AUTH if no existing connection is found with the remote

     

       288
       +
             peer (determined by the identities of the first authentication

     

       289
       +
             round). Only if set to keep or replace will the client send a notify.

     

       290
       +
           '';

     

       291
       +
       

     

       292
       +
           reauth_time	= mkDurationParam "0s" ''

     

       293
       +
             Time to schedule IKE reauthentication. IKE reauthentication recreates the

     

       294
       +
             IKE/ISAKMP SA from scratch and re-evaluates the credentials. In asymmetric

     

       295
       +
             configurations (with EAP or configuration payloads) it might not be

     

       296
       +
             possible to actively reauthenticate as responder. The IKEv2

     

       297
       +
             reauthentication lifetime negotiation can instruct the client to perform

     

       298
       +
             reauthentication.

     

       299
       +
             </para><para>

     

       300
       +
             Reauthentication is disabled by default. Enabling it usually may lead to

     

       301
       +
             small connection interruptions, as strongSwan uses a break-before-make

     

       302
       +
             policy with IKEv2 to avoid any conflicts with associated tunnel resources.

     

       303
       +
           '';

     

       304
       +
       

     

       305
       +
           rekey_time = mkDurationParam "4h" ''

     

       306
       +
             IKE rekeying refreshes key material using a Diffie-Hellman exchange, but

     

       307
       +
             does not re-check associated credentials. It is supported in IKEv2 only,

     

       308
       +
             IKEv1 performs a reauthentication procedure instead.

     

       309
       +
             </para><para>

     

       310
       +
             With the default value IKE rekeying is scheduled every 4 hours, minus the

     

       311
       +
             configured rand_time. If a reauth_time is configured, rekey_time defaults

     

       312
       +
             to zero, disabling rekeying; explicitly set both to enforce rekeying and

     

       313
       +
             reauthentication.

     

       314
       +
           '';

     

       315
       +
       

     

       316
       +
           over_time = mkOptionalDurationParam ''

     

       317
       +
             Hard IKE_SA lifetime if rekey/reauth does not complete, as time. To avoid

     

       318
       +
             having an IKE/ISAKMP kept alive if IKE reauthentication or rekeying fails

     

       319
       +
             perpetually, a maximum hard lifetime may be specified. If the IKE_SA fails

     

       320
       +
             to rekey or reauthenticate within the specified time, the IKE_SA gets

     

       321
       +
             closed.

     

       322
       +
             </para><para>

     

       323
       +
             In contrast to CHILD_SA rekeying, over_time is relative in time to the

     

       324
       +
             rekey_time and reauth_time values, as it applies to both.

     

       325
       +
             </para><para>

     

       326
       +
             The default is 10% of the longer of <option>rekey_time</option> and

     

       327
       +
             <option>reauth_time</option>.

     

       328
       +
           '';

     

       329
       +
       

     

       330
       +
           rand_time = mkOptionalDurationParam ''

     

       331
       +
             Time range from which to choose a random value to subtract from

     

       332
       +
             rekey/reauth times. To avoid having both peers initiating the rekey/reauth

     

       333
       +
             procedure simultaneously, a random time gets subtracted from the

     

       334
       +
             rekey/reauth times.

     

       335
       +
             </para><para>

     

       336
       +
             The default is equal to the configured <option>over_time</option>.

     

       337
       +
           '';

     

       338
       +
       

     

       339
       +
           pools = mkCommaSepListParam [] ''

     

       340
       +
             List of named IP pools to allocate virtual IP addresses

     

       341
       +
             and other configuration attributes from. Each name references a pool by

     

       342
       +
             name from either the pools section or an external pool.

     

       343
       +
           '';

     

       344
       +
       

     

       345
       +
           mediation = mkYesNoParam no ''

     

       346
       +
             Whether this connection is a mediation connection, that is, whether this

     

       347
       +
             connection is used to mediate other connections using the IKEv2 Mediation

     

       348
       +
             Extension. Mediation connections create no CHILD_SA.

     

       349
       +
           '';

     

       350
       +
       

     

       351
       +
           mediated_by = mkOptionalStrParam ''

     

       352
       +
             The name of the connection to mediate this connection through. If given,

     

       353
       +
             the connection will be mediated through the named mediation

     

       354
       +
             connection. The mediation connection must have mediation enabled.

     

       355
       +
           '';

     

       356
       +
       

     

       357
       +
           mediation_peer = mkOptionalStrParam ''

     

       358
       +
             Identity under which the peer is registered at the mediation server, that

     

       359
       +
             is, the IKE identity the other end of this connection uses as its local

     

       360
       +
             identity on its connection to the mediation server. This is the identity

     

       361
       +
             we request the mediation server to mediate us with. Only relevant on

     

       362
       +
             connections that set mediated_by. If it is not given, the remote IKE

     

       363
       +
             identity of the first authentication round of this connection will be

     

       364
       +
             used.

     

       365
       +
           '';

     

       366
       +
       

     

       367
       +
           local = mkPrefixedAttrsOfParams {

     

       368
       +
       

     

       369
       +
             round = mkIntParam 0 ''

     

       370
       +
               Optional numeric identifier by which authentication rounds are

     

       371
       +
               sorted. If not specified rounds are ordered by their position in the

     

       372
       +
               config file/vici message.

     

       373
       +
             '';

     

       374
       +
       

     

       375
       +
             certs = mkCommaSepListParam [] ''

     

       376
       +
               List of certificate candidates to use for

     

       377
       +
               authentication. The certificates may use a relative path from the

     

       378
       +
               swanctl <literal>x509</literal> directory or an absolute path.

     

       379
       +
               </para><para>

     

       380
       +
               The certificate used for authentication is selected based on the

     

       381
       +
               received certificate request payloads. If no appropriate CA can be

     

       382
       +
               located, the first certificate is used.

     

       383
       +
             '';

     

       384
       +
       

     

       385
       +
             cert = mkPostfixedAttrsOfParams certParams ''

     

       386
       +
               Section for a certificate candidate to use for

     

       387
       +
               authentication. Certificates in certs are transmitted as binary blobs,

     

       388
       +
               these sections offer more flexibility.

     

       389
       +
             '';

     

       390
       +
       

     

       391
       +
             pubkeys = mkCommaSepListParam [] ''

     

       392
       +
               List of raw public key candidates to use for

     

       393
       +
               authentication. The public keys may use a relative path from the swanctl

     

       394
       +
               <literal>pubkey</literal> directory or an absolute path.

     

       395
       +
               </para><para>

     

       396
       +
               Even though multiple local public keys could be defined in principle,

     

       397
       +
               only the first public key in the list is used for authentication.

     

       398
       +
             '';

     

       399
       +
       

     

       400
       +
             auth = mkStrParam "pubkey" ''

     

       401
       +
               Authentication to perform locally.

     

       402
       +
               <itemizedlist>

     

       403
       +
               <listitem><para>

     

       404
       +
               The default <literal>pubkey</literal> uses public key authentication

     

       405
       +
               using a private key associated to a usable certificate.

     

       406
       +
               </para></listitem>

     

       407
       +
               <listitem><para>

     

       408
       +
               <literal>psk</literal> uses pre-shared key authentication.

     

       409
       +
               </para></listitem>

     

       410
       +
               <listitem><para>

     

       411
       +
               The IKEv1 specific <literal>xauth</literal> is used for XAuth or Hybrid

     

       412
       +
               authentication,

     

       413
       +
               </para></listitem>

     

       414
       +
               <listitem><para>

     

       415
       +
               while the IKEv2 specific <literal>eap</literal> keyword defines EAP

     

       416
       +
               authentication.

     

       417
       +
               </para></listitem>

     

       418
       +
               <listitem><para>

     

       419
       +
               For <literal>xauth</literal>, a specific backend name may be appended,

     

       420
       +
               separated by a dash. The appropriate <literal>xauth</literal> backend is

     

       421
       +
               selected to perform the XAuth exchange. For traditional XAuth, the

     

       422
       +
               <literal>xauth</literal> method is usually defined in the second

     

       423
       +
               authentication round following an initial <literal>pubkey</literal> (or

     

       424
       +
               <literal>psk</literal>) round. Using <literal>xauth</literal> in the

     

       425
       +
               first round performs Hybrid Mode client authentication.

     

       426
       +
               </para></listitem>

     

       427
       +
               <listitem><para>

     

       428
       +
               For <literal>eap</literal>, a specific EAP method name may be appended, separated by a

     

       429
       +
               dash. An EAP module implementing the appropriate method is selected to

     

       430
       +
               perform the EAP conversation.

     

       431
       +
               </para></listitem>

     

       432
       +
               <listitem><para>

     

       433
       +
               Since 5.4.0, if both peers support RFC 7427 ("Signature Authentication

     

       434
       +
               in IKEv2") specific hash algorithms to be used during IKEv2

     

       435
       +
               authentication may be configured. To do so use <literal>ike:</literal>

     

       436
       +
               followed by a trust chain signature scheme constraint (see description

     

       437
       +
               of the <option>remote</option> section's <option>auth</option>

     

       438
       +
               keyword). For example, with <literal>ike:pubkey-sha384-sha256</literal>

     

       439
       +
               a public key signature scheme with either SHA-384 or SHA-256 would get

     

       440
       +
               used for authentication, in that order and depending on the hash

     

       441
       +
               algorithms supported by the peer. If no specific hash algorithms are

     

       442
       +
               configured, the default is to prefer an algorithm that matches or

     

       443
       +
               exceeds the strength of the signature key. If no constraints with

     

       444
       +
               <literal>ike:</literal> prefix are configured any signature scheme

     

       445
       +
               constraint (without <literal>ike:</literal> prefix) will also apply to

     

       446
       +
               IKEv2 authentication, unless this is disabled in

     

       447
       +
               <literal>strongswan.conf</literal>.

     

       448
       +
               </para></listitem>

     

       449
       +
               </itemizedlist>

     

       450
       +
             '';

     

       451
       +
       

     

       452
       +
             id = mkOptionalStrParam ''

     

       453
       +
               IKE identity to use for authentication round. When using certificate

     

       454
       +
               authentication, the IKE identity must be contained in the certificate,

     

       455
       +
               either as subject or as subjectAltName.

     

       456
       +
             '';

     

       457
       +
       

     

       458
       +
             eap_id = mkOptionalStrParam ''

     

       459
       +
               Client EAP-Identity to use in EAP-Identity exchange and the EAP method.

     

       460
       +
             '';

     

       461
       +
       

     

       462
       +
             aaa_id = mkOptionalStrParam ''

     

       463
       +
               Server side EAP-Identity to expect in the EAP method. Some EAP methods,

     

       464
       +
               such as EAP-TLS, use an identity for the server to perform mutual

     

       465
       +
               authentication. This identity may differ from the IKE identity,

     

       466
       +
               especially when EAP authentication is delegated from the IKE responder

     

       467
       +
               to an AAA backend.

     

       468
       +
               </para><para>

     

       469
       +
               For EAP-(T)TLS, this defines the identity for which the server must

     

       470
       +
               provide a certificate in the TLS exchange.

     

       471
       +
             '';

     

       472
       +
       

     

       473
       +
             xauth_id = mkOptionalStrParam ''

     

       474
       +
               Client XAuth username used in the XAuth exchange.

     

       475
       +
             '';

     

       476
       +
       

     

       477
       +
           } ''

     

       478
       +
             Section for a local authentication round. A local authentication round

     

       479
       +
             defines the rules how authentication is performed for the local

     

       480
       +
             peer. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple

     

       481
       +
             Authentication or IKEv1 XAuth.

     

       482
       +
             </para><para>

     

       483
       +
             Each round is defined in a section having <literal>local</literal> as

     

       484
       +
             prefix, and an optional unique suffix. To define a single authentication

     

       485
       +
             round, the suffix may be omitted.

     

       486
       +
           '';

     

       487
       +
       

     

       488
       +
           remote = mkPrefixedAttrsOfParams {

     

       489
       +
       

     

       490
       +
             round = mkIntParam 0 ''

     

       491
       +
               Optional numeric identifier by which authentication rounds are

     

       492
       +
               sorted. If not specified rounds are ordered by their position in the

     

       493
       +
               config file/vici message.

     

       494
       +
             '';

     

       495
       +
       

     

       496
       +
             id = mkStrParam "%any" ''

     

       497
       +
               IKE identity to expect for authentication round. When using certificate

     

       498
       +
               authentication, the IKE identity must be contained in the certificate,

     

       499
       +
               either as subject or as subjectAltName.

     

       500
       +
             '';

     

       501
       +
       

     

       502
       +
             eap_id = mkOptionalStrParam ''

     

       503
       +
               Identity to use as peer identity during EAP authentication. If set to

     

       504
       +
               <literal>%any</literal> the EAP-Identity method will be used to ask the

     

       505
       +
               client for an EAP identity.

     

       506
       +
             '';

     

       507
       +
       

     

       508
       +
             groups = mkCommaSepListParam [] ''

     

       509
       +
               Authorization group memberships to require. The peer

     

       510
       +
               must prove membership to at least one of the specified groups. Group

     

       511
       +
               membership can be certified by different means, for example by

     

       512
       +
               appropriate Attribute Certificates or by an AAA backend involved in the

     

       513
       +
               authentication.

     

       514
       +
             '';

     

       515
       +
       

     

       516
       +
             cert_policy = mkCommaSepListParam [] ''

     

       517
       +
               List of certificate policy OIDs the peer's certificate

     

       518
       +
               must have. OIDs are specified using the numerical dotted representation.

     

       519
       +
             '';

     

       520
       +
       

     

       521
       +
             certs = mkCommaSepListParam [] ''

     

       522
       +
               List of certificates to accept for authentication. The certificates may

     

       523
       +
               use a relative path from the swanctl <literal>x509</literal> directory

     

       524
       +
               or an absolute path.

     

       525
       +
             '';

     

       526
       +
       

     

       527
       +
             cert = mkPostfixedAttrsOfParams certParams ''

     

       528
       +
               Section for a certificate candidate to use for

     

       529
       +
               authentication. Certificates in certs are transmitted as binary blobs,

     

       530
       +
               these sections offer more flexibility.

     

       531
       +
             '';

     

       532
       +
       

     

       533
       +
             cacerts = mkCommaSepListParam [] ''

     

       534
       +
               List of CA certificates to accept for

     

       535
       +
               authentication. The certificates may use a relative path from the

     

       536
       +
               swanctl <literal>x509ca</literal> directory or an absolute path.

     

       537
       +
             '';

     

       538
       +
       

     

       539
       +
             cacert = mkPostfixedAttrsOfParams certParams ''

     

       540
       +
               Section for a CA certificate to accept for authentication. Certificates

     

       541
       +
               in cacerts are transmitted as binary blobs, these sections offer more

     

       542
       +
               flexibility.

     

       543
       +
             '';

     

       544
       +
       

     

       545
       +
             pubkeys = mkCommaSepListParam [] ''

     

       546
       +
               List of raw public keys to accept for

     

       547
       +
               authentication. The public keys may use a relative path from the swanctl

     

       548
       +
               <literal>pubkey</literal> directory or an absolute path.

     

       549
       +
             '';

     

       550
       +
       

     

       551
       +
             revocation = mkEnumParam ["strict" "ifuri" "relaxed"] "relaxed" ''

     

       552
       +
               Certificate revocation policy for CRL or OCSP revocation.

     

       553
       +
               <itemizedlist>

     

       554
       +
               <listitem><para>

     

       555
       +
               A <literal>strict</literal> revocation policy fails if no revocation information is

     

       556
       +
               available, i.e. the certificate is not known to be unrevoked.

     

       557
       +
               </para></listitem>

     

       558
       +
               <listitem><para>

     

       559
       +
               <literal>ifuri</literal> fails only if a CRL/OCSP URI is available, but certificate

     

       560
       +
               revocation checking fails, i.e. there should be revocation information

     

       561
       +
               available, but it could not be obtained.

     

       562
       +
               </para></listitem>

     

       563
       +
               <listitem><para>

     

       564
       +
               The default revocation policy <literal>relaxed</literal> fails only if a certificate is

     

       565
       +
               revoked, i.e. it is explicitly known that it is bad.

     

       566
       +
               </para></listitem>

     

       567
       +
               </itemizedlist>

     

       568
       +
             '';

     

       569
       +
       

     

       570
       +
             auth = mkStrParam "pubkey" ''

     

       571
       +
               Authentication to expect from remote. See the <option>local</option>

     

       572
       +
               section's <option>auth</option> keyword description about the details of

     

       573
       +
               supported mechanisms.

     

       574
       +
               </para><para>

     

       575
       +
               Since 5.4.0, to require a trustchain public key strength for the remote

     

       576
       +
               side, specify the key type followed by the minimum strength in bits (for

     

       577
       +
               example <literal>ecdsa-384</literal> or

     

       578
       +
               <literal>rsa-2048-ecdsa-256</literal>). To limit the acceptable set of

     

       579
       +
               hashing algorithms for trustchain validation, append hash algorithms to

     

       580
       +
               pubkey or a key strength definition (for example

     

       581
       +
               <literal>pubkey-sha1-sha256</literal> or

     

       582
       +
               <literal>rsa-2048-ecdsa-256-sha256-sha384-sha512</literal>). Unless

     

       583
       +
               disabled in <literal>strongswan.conf</literal>, or explicit IKEv2

     

       584
       +
               signature constraints are configured (refer to the description of the

     

       585
       +
               <option>local</option> section's <option>auth</option> keyword for

     

       586
       +
               details), such key types and hash algorithms are also applied as

     

       587
       +
               constraints against IKEv2 signature authentication schemes used by the

     

       588
       +
               remote side.

     

       589
       +
               </para><para>

     

       590
       +
               To specify trust chain constraints for EAP-(T)TLS, append a colon to the

     

       591
       +
               EAP method, followed by the key type/size and hash algorithm as

     

       592
       +
               discussed above (e.g. <literal>eap-tls:ecdsa-384-sha384</literal>).

     

       593
       +
             '';

     

       594
       +
       

     

       595
       +
           } ''

     

       596
       +
             Section for a remote authentication round. A remote authentication round

     

       597
       +
             defines the constraints how the peers must authenticate to use this

     

       598
       +
             connection. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple

     

       599
       +
             Authentication or IKEv1 XAuth.

     

       600
       +
             </para><para>

     

       601
       +
             Each round is defined in a section having <literal>remote</literal> as

     

       602
       +
             prefix, and an optional unique suffix. To define a single authentication

     

       603
       +
             round, the suffix may be omitted.

     

       604
       +
           '';

     

       605
       +
       

     

       606
       +
           children = mkAttrsOfParams {

     

       607
       +
             ah_proposals = mkCommaSepListParam [] ''

     

       608
       +
               AH proposals to offer for the CHILD_SA. A proposal is a set of

     

       609
       +
               algorithms. For AH, this includes an integrity algorithm and an optional

     

       610
       +
               Diffie-Hellman group. If a DH group is specified, CHILD_SA/Quick Mode

     

       611
       +
               rekeying and initial negotiation uses a separate Diffie-Hellman exchange

     

       612
       +
               using the specified group (refer to esp_proposals for details).

     

       613
       +
               </para><para>

     

       614
       +
               In IKEv2, multiple algorithms of the same kind can be specified in a

     

       615
       +
               single proposal, from which one gets selected. In IKEv1, only one

     

       616
       +
               algorithm per kind is allowed per proposal, more algorithms get

     

       617
       +
               implicitly stripped. Use multiple proposals to offer different algorithms

     

       618
       +
               combinations in IKEv1.

     

       619
       +
               </para><para>

     

       620
       +
               Algorithm keywords get separated using dashes. Multiple proposals may be

     

       621
       +
               specified in a list. The special value <literal>default</literal> forms

     

       622
       +
               a default proposal of supported algorithms considered safe, and is

     

       623
       +
               usually a good choice for interoperability. By default no AH proposals

     

       624
       +
               are included, instead ESP is proposed.

     

       625
       +
            '';

     

       626
       +
       

     

       627
       +
             esp_proposals = mkCommaSepListParam ["default"] ''

     

       628
       +
               ESP proposals to offer for the CHILD_SA. A proposal is a set of

     

       629
       +
               algorithms. For ESP non-AEAD proposals, this includes an integrity

     

       630
       +
               algorithm, an encryption algorithm, an optional Diffie-Hellman group and

     

       631
       +
               an optional Extended Sequence Number Mode indicator. For AEAD proposals,

     

       632
       +
               a combined mode algorithm is used instead of the separate

     

       633
       +
               encryption/integrity algorithms.

     

       634
       +
               </para><para>

     

       635
       +
               If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial

     

       636
       +
               negotiation use a separate Diffie-Hellman exchange using the specified

     

       637
       +
               group. However, for IKEv2, the keys of the CHILD_SA created implicitly

     

       638
       +
               with the IKE_SA will always be derived from the IKE_SA's key material. So

     

       639
       +
               any DH group specified here will only apply when the CHILD_SA is later

     

       640
       +
               rekeyed or is created with a separate CREATE_CHILD_SA exchange. A

     

       641
       +
               proposal mismatch might, therefore, not immediately be noticed when the

     

       642
       +
               SA is established, but may later cause rekeying to fail.

     

       643
       +
               </para><para>

     

       644
       +
               Extended Sequence Number support may be indicated with the

     

       645
       +
               <literal>esn</literal> and <literal>noesn</literal> values, both may be

     

       646
       +
               included to indicate support for both modes. If omitted,

     

       647
       +
               <literal>noesn</literal> is assumed.

     

       648
       +
               </para><para>

     

       649
       +
               In IKEv2, multiple algorithms of the same kind can be specified in a

     

       650
       +
               single proposal, from which one gets selected. In IKEv1, only one

     

       651
       +
               algorithm per kind is allowed per proposal, more algorithms get

     

       652
       +
               implicitly stripped. Use multiple proposals to offer different algorithms

     

       653
       +
               combinations in IKEv1.

     

       654
       +
               </para><para>

     

       655
       +
               Algorithm keywords get separated using dashes. Multiple proposals may be

     

       656
       +
               specified as a list. The special value <literal>default</literal> forms

     

       657
       +
               a default proposal of supported algorithms considered safe, and is

     

       658
       +
               usually a good choice for interoperability. If no algorithms are

     

       659
       +
               specified for AH nor ESP, the default set of algorithms for ESP is

     

       660
       +
               included.

     

       661
       +
             '';

     

       662
       +
       

     

       663
       +
             sha256_96 = mkYesNoParam no ''

     

       664
       +
               HMAC-SHA-256 is used with 128-bit truncation with IPsec. For

     

       665
       +
               compatibility with implementations that incorrectly use 96-bit truncation

     

       666
       +
               this option may be enabled to configure the shorter truncation length in

     

       667
       +
               the kernel. This is not negotiated, so this only works with peers that

     

       668
       +
               use the incorrect truncation length (or have this option enabled).

     

       669
       +
             '';

     

       670
       +
       

     

       671
       +
             local_ts = mkCommaSepListParam ["dynamic"] ''

     

       672
       +
               List of local traffic selectors to include in CHILD_SA. Each selector is

     

       673
       +
               a CIDR subnet definition, followed by an optional proto/port

     

       674
       +
               selector. The special value <literal>dynamic</literal> may be used

     

       675
       +
               instead of a subnet definition, which gets replaced by the tunnel outer

     

       676
       +
               address or the virtual IP, if negotiated. This is the default.

     

       677
       +
               </para><para>

     

       678
       +
               A protocol/port selector is surrounded by opening and closing square

     

       679
       +
               brackets. Between these brackets, a numeric or getservent(3) protocol

     

       680
       +
               name may be specified. After the optional protocol restriction, an

     

       681
       +
               optional port restriction may be specified, separated by a slash. The

     

       682
       +
               port restriction may be numeric, a getservent(3) service name, or the

     

       683
       +
               special value <literal>opaque</literal> for RFC 4301 OPAQUE

     

       684
       +
               selectors. Port ranges may be specified as well, none of the kernel

     

       685
       +
               backends currently support port ranges, though.

     

       686
       +
               </para><para>

     

       687
       +
               When IKEv1 is used only the first selector is interpreted, except if the

     

       688
       +
               Cisco Unity extension plugin is used. This is due to a limitation of the

     

       689
       +
               IKEv1 protocol, which only allows a single pair of selectors per

     

       690
       +
               CHILD_SA. So to tunnel traffic matched by several pairs of selectors when

     

       691
       +
               using IKEv1 several children (CHILD_SAs) have to be defined that cover

     

       692
       +
               the selectors.  The IKE daemon uses traffic selector narrowing for IKEv1,

     

       693
       +
               the same way it is standardized and implemented for IKEv2. However, this

     

       694
       +
               may lead to problems with other implementations. To avoid that, configure

     

       695
       +
               identical selectors in such scenarios.

     

       696
       +
             '';

     

       697
       +
       

     

       698
       +
             remote_ts = mkCommaSepListParam ["dynamic"] ''

     

       699
       +
               List of remote selectors to include in CHILD_SA. See

     

       700
       +
               <option>local_ts</option> for a description of the selector syntax.

     

       701
       +
             '';

     

       702
       +
       

     

       703
       +
             rekey_time = mkDurationParam "1h" ''

     

       704
       +
               Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key

     

       705
       +
               material, optionally using a Diffie-Hellman exchange if a group is

     

       706
       +
               specified in the proposal.  To avoid rekey collisions initiated by both

     

       707
       +
               ends simultaneously, a value in the range of <option>rand_time</option>

     

       708
       +
               gets subtracted to form the effective soft lifetime.

     

       709
       +
               </para><para>

     

       710
       +
               By default CHILD_SA rekeying is scheduled every hour, minus

     

       711
       +
               <option>rand_time</option>.

     

       712
       +
             '';

     

       713
       +
       

     

       714
       +
             life_time = mkOptionalDurationParam ''

     

       715
       +
               Maximum lifetime before CHILD_SA gets closed. Usually this hard lifetime

     

       716
       +
               is never reached, because the CHILD_SA gets rekeyed before. If that fails

     

       717
       +
               for whatever reason, this limit closes the CHILD_SA.  The default is 10%

     

       718
       +
               more than the <option>rekey_time</option>.

     

       719
       +
             '';

     

       720
       +
       

     

       721
       +
             rand_time = mkOptionalDurationParam ''

     

       722
       +
               Time range from which to choose a random value to subtract from

     

       723
       +
               <option>rekey_time</option>. The default is the difference between

     

       724
       +
               <option>life_time</option> and <option>rekey_time</option>.

     

       725
       +
             '';

     

       726
       +
       

     

       727
       +
             rekey_bytes = mkIntParam 0 ''

     

       728
       +
               Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA

     

       729
       +
               rekeying refreshes key material, optionally using a Diffie-Hellman

     

       730
       +
               exchange if a group is specified in the proposal.

     

       731
       +
               </para><para>

     

       732
       +
               To avoid rekey collisions initiated by both ends simultaneously, a value

     

       733
       +
               in the range of <option>rand_bytes</option> gets subtracted to form the

     

       734
       +
               effective soft volume limit.

     

       735
       +
               </para><para>

     

       736
       +
               Volume based CHILD_SA rekeying is disabled by default.

     

       737
       +
             '';

     

       738
       +
       

     

       739
       +
             life_bytes = mkOptionalIntParam ''

     

       740
       +
               Maximum bytes processed before CHILD_SA gets closed. Usually this hard

     

       741
       +
               volume limit is never reached, because the CHILD_SA gets rekeyed

     

       742
       +
               before. If that fails for whatever reason, this limit closes the

     

       743
       +
               CHILD_SA.  The default is 10% more than <option>rekey_bytes</option>.

     

       744
       +
             '';

     

       745
       +
       

     

       746
       +
             rand_bytes = mkOptionalIntParam ''

     

       747
       +
               Byte range from which to choose a random value to subtract from

     

       748
       +
               <option>rekey_bytes</option>. The default is the difference between

     

       749
       +
               <option>life_bytes</option> and <option>rekey_bytes</option>.

     

       750
       +
             '';

     

       751
       +
       

     

       752
       +
             rekey_packets = mkIntParam 0 ''

     

       753
       +
               Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA

     

       754
       +
               rekeying refreshes key material, optionally using a Diffie-Hellman

     

       755
       +
               exchange if a group is specified in the proposal.

     

       756
       +
               </para><para>

     

       757
       +
               To avoid rekey collisions initiated by both ends simultaneously, a value

     

       758
       +
               in the range of <option>rand_packets</option> gets subtracted to form

     

       759
       +
               the effective soft packet count limit.

     

       760
       +
               </para><para>

     

       761
       +
               Packet count based CHILD_SA rekeying is disabled by default.

     

       762
       +
             '';

     

       763
       +
       

     

       764
       +
             life_packets = mkOptionalIntParam ''

     

       765
       +
               Maximum number of packets processed before CHILD_SA gets closed. Usually

     

       766
       +
               this hard packets limit is never reached, because the CHILD_SA gets

     

       767
       +
               rekeyed before. If that fails for whatever reason, this limit closes the

     

       768
       +
               CHILD_SA.

     

       769
       +
               </para><para>

     

       770
       +
               The default is 10% more than <option>rekey_bytes</option>.

     

       771
       +
             '';

     

       772
       +
       

     

       773
       +
             rand_packets = mkOptionalIntParam ''

     

       774
       +
               Packet range from which to choose a random value to subtract from

     

       775
       +
               <option>rekey_packets</option>. The default is the difference between

     

       776
       +
               <option>life_packets</option> and <option>rekey_packets</option>.

     

       777
       +
             '';

     

       778
       +
       

     

       779
       +
             updown = mkOptionalStrParam ''

     

       780
       +
               Updown script to invoke on CHILD_SA up and down events.

     

       781
       +
             '';

     

       782
       +
       

     

       783
       +
             hostaccess = mkYesNoParam yes ''

     

       784
       +
               Hostaccess variable to pass to <literal>updown</literal> script.

     

       785
       +
             '';

     

       786
       +
       

     

       787
       +
             mode = mkEnumParam [ "tunnel"

     

       788
       +
                                  "transport"

     

       789
       +
                                  "transport_proxy"

     

       790
       +
                                  "beet"

     

       791
       +
                                  "pass"

     

       792
       +
                                  "drop"

     

       793
       +
                                ] "tunnel" ''

     

       794
       +
               IPsec Mode to establish CHILD_SA with.

     

       795
       +
               <itemizedlist>

     

       796
       +
               <listitem><para>

     

       797
       +
               <literal>tunnel</literal> negotiates the CHILD_SA in IPsec Tunnel Mode,

     

       798
       +
               </para></listitem>

     

       799
       +
               <listitem><para>

     

       800
       +
               whereas <literal>transport</literal> uses IPsec Transport Mode.

     

       801
       +
               </para></listitem>

     

       802
       +
               <listitem><para>

     

       803
       +
               <literal>transport_proxy</literal> signifying the special Mobile IPv6

     

       804
       +
               Transport Proxy Mode.

     

       805
       +
               </para></listitem>

     

       806
       +
               <listitem><para>

     

       807
       +
               <literal>beet</literal> is the Bound End to End Tunnel mixture mode,

     

       808
       +
               working with fixed inner addresses without the need to include them in

     

       809
       +
               each packet.

     

       810
       +
               </para></listitem>

     

       811
       +
               <listitem><para>

     

       812
       +
               Both <literal>transport</literal> and <literal>beet</literal> modes are

     

       813
       +
               subject to mode negotiation; <literal>tunnel</literal> mode is

     

       814
       +
               negotiated if the preferred mode is not available.

     

       815
       +
               </para></listitem>

     

       816
       +
               <listitem><para>

     

       817
       +
               <literal>pass</literal> and <literal>drop</literal> are used to install

     

       818
       +
               shunt policies which explicitly bypass the defined traffic from IPsec

     

       819
       +
               processing or drop it, respectively.

     

       820
       +
               </para></listitem>

     

       821
       +
               </itemizedlist>

     

       822
       +
             '';

     

       823
       +
       

     

       824
       +
             policies = mkYesNoParam yes ''

     

       825
       +
               Whether to install IPsec policies or not. Disabling this can be useful in

     

       826
       +
               some scenarios e.g. MIPv6, where policies are not managed by the IKE

     

       827
       +
               daemon. Since 5.3.3.

     

       828
       +
             '';

     

       829
       +
       

     

       830
       +
             policies_fwd_out = mkYesNoParam no ''

     

       831
       +
               Whether to install outbound FWD IPsec policies or not. Enabling this is

     

       832
       +
               required in case there is a drop policy that would match and block

     

       833
       +
               forwarded traffic for this CHILD_SA. Since 5.5.1.

     

       834
       +
             '';

     

       835
       +
       

     

       836
       +
             dpd_action = mkEnumParam ["clear" "trap" "restart"] "clear" ''

     

       837
       +
               Action to perform for this CHILD_SA on DPD timeout. The default clear

     

       838
       +
               closes the CHILD_SA and does not take further action. trap installs a

     

       839
       +
               trap policy, which will catch matching traffic and tries to re-negotiate

     

       840
       +
               the tunnel on-demand. restart immediately tries to re-negotiate the

     

       841
       +
               CHILD_SA under a fresh IKE_SA.

     

       842
       +
             '';

     

       843
       +
       

     

       844
       +
             ipcomp = mkYesNoParam no ''

     

       845
       +
               Enable IPComp compression before encryption. If enabled, IKE tries to

     

       846
       +
               negotiate IPComp compression to compress ESP payload data prior to

     

       847
       +
               encryption.

     

       848
       +
             '';

     

       849
       +
       

     

       850
       +
             inactivity = mkDurationParam "0s" ''

     

       851
       +
               Timeout before closing CHILD_SA after inactivity. If no traffic has been

     

       852
       +
               processed in either direction for the configured timeout, the CHILD_SA

     

       853
       +
               gets closed due to inactivity. The default value of 0 disables inactivity

     

       854
       +
               checks.

     

       855
       +
             '';

     

       856
       +
       

     

       857
       +
             reqid = mkIntParam 0 ''

     

       858
       +
               Fixed reqid to use for this CHILD_SA. This might be helpful in some

     

       859
       +
               scenarios, but works only if each CHILD_SA configuration is instantiated

     

       860
       +
               not more than once. The default of 0 uses dynamic reqids, allocated

     

       861
       +
               incrementally.

     

       862
       +
             '';

     

       863
       +
       

     

       864
       +
             priority = mkIntParam 0 ''

     

       865
       +
               Optional fixed priority for IPsec policies. This could be useful to

     

       866
       +
               install high-priority drop policies. The default of 0 uses dynamically

     

       867
       +
               calculated priorities based on the size of the traffic selectors.

     

       868
       +
             '';

     

       869
       +
       

     

       870
       +
             interface = mkOptionalStrParam ''

     

       871
       +
               Optional interface name to restrict outbound IPsec policies.

     

       872
       +
             '';

     

       873
       +
       

     

       874
       +
             mark_in = mkStrParam "0/0x00000000" ''

     

       875
       +
               Netfilter mark and mask for input traffic. On Linux Netfilter may

     

       876
       +
               require marks on each packet to match an SA having that option set. This

     

       877
       +
               allows Netfilter rules to select specific tunnels for incoming

     

       878
       +
               traffic. The special value <literal>%unique</literal> sets a unique mark

     

       879
       +
               on each CHILD_SA instance, beyond that the value

     

       880
       +
               <literal>%unique-dir</literal> assigns a different unique mark for each

     

       881
       +
               CHILD_SA direction (in/out).

     

       882
       +
               </para><para>

     

       883
       +
               An additional mask may be appended to the mark, separated by

     

       884
       +
               <literal>/</literal>. The default mask if omitted is

     

       885
       +
               <literal>0xffffffff</literal>.

     

       886
       +
             '';

     

       887
       +
       

     

       888
       +
             mark_out = mkStrParam "0/0x00000000" ''

     

       889
       +
               Netfilter mark and mask for output traffic. On Linux Netfilter may

     

       890
       +
               require marks on each packet to match a policy having that option

     

       891
       +
               set. This allows Netfilter rules to select specific tunnels for outgoing

     

       892
       +
               traffic. The special value <literal>%unique</literal> sets a unique mark

     

       893
       +
               on each CHILD_SA instance, beyond that the value

     

       894
       +
               <literal>%unique-dir</literal> assigns a different unique mark for each

     

       895
       +
               CHILD_SA direction (in/out).

     

       896
       +
               </para><para>

     

       897
       +
               An additional mask may be appended to the mark, separated by

     

       898
       +
               <literal>/</literal>. The default mask if omitted is

     

       899
       +
               <literal>0xffffffff</literal>.

     

       900
       +
             '';

     

       901
       +
       

     

       902
       +
             tfc_padding = mkParamOfType (with lib.types; either int (enum ["mtu"])) 0 ''

     

       903
       +
               Pads ESP packets with additional data to have a consistent ESP packet

     

       904
       +
               size for improved Traffic Flow Confidentiality. The padding defines the

     

       905
       +
               minimum size of all ESP packets sent.  The default value of

     

       906
       +
               <literal>0</literal> disables TFC padding, the special value

     

       907
       +
               <literal>mtu</literal> adds TFC padding to create a packet size equal to

     

       908
       +
               the Path Maximum Transfer Unit.

     

       909
       +
             '';

     

       910
       +
       

     

       911
       +
             replay_window = mkIntParam 32 ''

     

       912
       +
               IPsec replay window to configure for this CHILD_SA. Larger values than

     

       913
       +
               the default of <literal>32</literal> are supported using the Netlink

     

       914
       +
               backend only, a value of <literal>0</literal> disables IPsec replay

     

       915
       +
               protection.

     

       916
       +
             '';

     

       917
       +
       

     

       918
       +
             hw_offload = mkYesNoParam no ''

     

       919
       +
               Enable hardware offload for this CHILD_SA, if supported by the IPsec

     

       920
       +
               implementation.

     

       921
       +
             '';

     

       922
       +
       

     

       923
       +
             start_action = mkEnumParam ["none" "trap" "start"] "none" ''

     

       924
       +
               Action to perform after loading the configuration.

     

       925
       +
               <itemizedlist>

     

       926
       +
               <listitem><para>

     

       927
       +
               The default of <literal>none</literal> loads the connection only, which

     

       928
       +
               then can be manually initiated or used as a responder configuration.

     

       929
       +
               </para></listitem>

     

       930
       +
               <listitem><para>

     

       931
       +
               The value <literal>trap</literal> installs a trap policy, which triggers

     

       932
       +
               the tunnel as soon as matching traffic has been detected.

     

       933
       +
               </para></listitem>

     

       934
       +
               <listitem><para>

     

       935
       +
               The value <literal>start</literal> initiates the connection actively.

     

       936
       +
               </para></listitem>

     

       937
       +
               </itemizedlist>

     

       938
       +
               When unloading or replacing a CHILD_SA configuration having a

     

       939
       +
               <option>start_action</option> different from <literal>none</literal>,

     

       940
       +
               the inverse action is performed. Configurations with

     

       941
       +
               <literal>start</literal> get closed, while such with

     

       942
       +
               <literal>trap</literal> get uninstalled.

     

       943
       +
             '';

     

       944
       +
       

     

       945
       +
             close_action = mkEnumParam ["none" "trap" "start"] "none" ''

     

       946
       +
               Action to perform after a CHILD_SA gets closed by the peer.

     

       947
       +
               <itemizedlist>

     

       948
       +
               <listitem><para>

     

       949
       +
               The default of <literal>none</literal> does not take any action,

     

       950
       +
               </para></listitem>

     

       951
       +
               <listitem><para>

     

       952
       +
               <literal>trap</literal> installs a trap policy for the CHILD_SA.

     

       953
       +
               </para></listitem>

     

       954
       +
               <listitem><para>

     

       955
       +
               <literal>start</literal> tries to re-create the CHILD_SA.

     

       956
       +
               </para></listitem>

     

       957
       +
               </itemizedlist>

     

       958
       +
               </para><para>

     

       959
       +
               <option>close_action</option> does not provide any guarantee that the

     

       960
       +
               CHILD_SA is kept alive. It acts on explicit close messages only, but not

     

       961
       +
               on negotiation failures. Use trap policies to reliably re-create failed

     

       962
       +
               CHILD_SAs.

     

       963
       +
             '';

     

       964
       +
       

     

       965
       +
           } ''

     

       966
       +
             CHILD_SA configuration sub-section. Each connection definition may have

     

       967
       +
             one or more sections in its <option>children</option> subsection. The

     

       968
       +
             section name defines the name of the CHILD_SA configuration, which must be

     

       969
       +
             unique within the connection (denoted &#60;child&#62; below).

     

       970
       +
           '';

     

       971
       +
         } ''

     

       972
       +
           Section defining IKE connection configurations, each in its own subsection

     

       973
       +
           with an arbitrary yet unique name

     

       974
       +
         '';

     

       975
       +
       

     

       976
       +
         secrets = let

     

       977
       +
           mkEapXauthParams = mkPrefixedAttrsOfParams {

     

       978
       +
             secret = mkOptionalStrParam ''

     

       979
       +
               Value of the EAP/XAuth secret. It may either be an ASCII string, a hex

     

       980
       +
               encoded string if it has a 0x prefix or a Base64 encoded string if it

     

       981
       +
               has a 0s prefix in its value.

     

       982
       +
             '';

     

       983
       +
       

     

       984
       +
             id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''

     

       985
       +
               Identity the EAP/XAuth secret belongs to. Multiple unique identities may

     

       986
       +
               be specified, each having an <literal>id</literal> prefix, if a secret

     

       987
       +
               is shared between multiple users.

     

       988
       +
             '';

     

       989
       +
       

     

       990
       +
           } ''

     

       991
       +
             EAP secret section for a specific secret. Each EAP secret is defined in a

     

       992
       +
             unique section having the <literal>eap</literal> prefix. EAP secrets are

     

       993
       +
             used for XAuth authentication as well.

     

       994
       +
           '';

     

       995
       +
       

     

       996
       +
         in {

     

       997
       +
       

     

       998
       +
           eap   = mkEapXauthParams;

     

       999
       +
           xauth = mkEapXauthParams;

     

       1000
       +
       

     

       1001
       +
           ntlm = mkPrefixedAttrsOfParams {

     

       1002
       +
             secret = mkOptionalStrParam ''

     

       1003
       +
               Value of the NTLM secret, which is the NT Hash of the actual secret,

     

       1004
       +
               that is, MD4(UTF-16LE(secret)). The resulting 16-byte value may either

     

       1005
       +
               be given as a hex encoded string with a 0x prefix or as a Base64 encoded

     

       1006
       +
               string with a 0s prefix.

     

       1007
       +
             '';

     

       1008
       +
       

     

       1009
       +
             id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''

     

       1010
       +
               Identity the NTLM secret belongs to. Multiple unique identities may be

     

       1011
       +
               specified, each having an id prefix, if a secret is shared between

     

       1012
       +
               multiple users.

     

       1013
       +
             '';

     

       1014
       +
           } ''

     

       1015
       +
             NTLM secret section for a specific secret. Each NTLM secret is defined in

     

       1016
       +
             a unique section having the <literal>ntlm</literal> prefix. NTLM secrets

     

       1017
       +
             may only be used for EAP-MSCHAPv2 authentication.

     

       1018
       +
           '';

     

       1019
       +
       

     

       1020
       +
           ike = mkPrefixedAttrsOfParams {

     

       1021
       +
             secret = mkOptionalStrParam ''

     

       1022
       +
               Value of the IKE preshared secret. It may either be an ASCII string, a

     

       1023
       +
               hex encoded string if it has a 0x prefix or a Base64 encoded string if

     

       1024
       +
               it has a 0s prefix in its value.

     

       1025
       +
             '';

     

       1026
       +
       

     

       1027
       +
             id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''

     

       1028
       +
               IKE identity the IKE preshared secret belongs to. Multiple unique

     

       1029
       +
               identities may be specified, each having an <literal>id</literal>

     

       1030
       +
               prefix, if a secret is shared between multiple peers.

     

       1031
       +
             '';

     

       1032
       +
           } ''

     

       1033
       +
             IKE preshared secret section for a specific secret. Each IKE PSK is

     

       1034
       +
             defined in a unique section having the <literal>ike</literal> prefix.

     

       1035
       +
           '';

     

       1036
       +
       

     

       1037
       +
           private = mkPrefixedAttrsOfParams {

     

       1038
       +
             file = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''

     

       1039
       +
               File name in the private folder for which this passphrase should be used.

     

       1040
       +
             '';

     

       1041
       +
       

     

       1042
       +
             secret = mkOptionalStrParam ''

     

       1043
       +
               Value of decryption passphrase for private key.

     

       1044
       +
             '';

     

       1045
       +
           } ''

     

       1046
       +
             Private key decryption passphrase for a key in the

     

       1047
       +
             <literal>private</literal> folder.

     

       1048
       +
           '';

     

       1049
       +
       

     

       1050
       +
           rsa = mkPrefixedAttrsOfParams {

     

       1051
       +
             file = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''

     

       1052
       +
               File name in the <literal>rsa</literal> folder for which this passphrase

     

       1053
       +
               should be used.

     

       1054
       +
             '';

     

       1055
       +
             secret = mkOptionalStrParam ''

     

       1056
       +
               Value of decryption passphrase for RSA key.

     

       1057
       +
             '';

     

       1058
       +
           } ''

     

       1059
       +
             Private key decryption passphrase for a key in the <literal>rsa</literal>

     

       1060
       +
             folder.

     

       1061
       +
           '';

     

       1062
       +
       

     

       1063
       +
           ecdsa = mkPrefixedAttrsOfParams {

     

       1064
       +
             file = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''

     

       1065
       +
               File name in the <literal>ecdsa</literal> folder for which this

     

       1066
       +
               passphrase should be used.

     

       1067
       +
             '';

     

       1068
       +
             secret = mkOptionalStrParam ''

     

       1069
       +
               Value of decryption passphrase for ECDSA key.

     

       1070
       +
             '';

     

       1071
       +
           } ''

     

       1072
       +
             Private key decryption passphrase for a key in the

     

       1073
       +
             <literal>ecdsa</literal> folder.

     

       1074
       +
           '';

     

       1075
       +
       

     

       1076
       +
           pkcs8 = mkPrefixedAttrsOfParams {

     

       1077
       +
             file = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''

     

       1078
       +
               File name in the <literal>pkcs8</literal> folder for which this

     

       1079
       +
               passphrase should be used.

     

       1080
       +
             '';

     

       1081
       +
             secret = mkOptionalStrParam ''

     

       1082
       +
               Value of decryption passphrase for PKCS#8 key.

     

       1083
       +
             '';

     

       1084
       +
           } ''

     

       1085
       +
             Private key decryption passphrase for a key in the

     

       1086
       +
             <literal>pkcs8</literal> folder.

     

       1087
       +
           '';

     

       1088
       +
       

     

       1089
       +
           pkcs12 = mkPrefixedAttrsOfParams {

     

       1090
       +
             file = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''

     

       1091
       +
               File name in the <literal>pkcs12</literal> folder for which this

     

       1092
       +
               passphrase should be used.

     

       1093
       +
             '';

     

       1094
       +
             secret = mkOptionalStrParam ''

     

       1095
       +
               Value of decryption passphrase for PKCS#12 container.

     

       1096
       +
             '';

     

       1097
       +
           } ''

     

       1098
       +
             PKCS#12 decryption passphrase for a container in the

     

       1099
       +
             <literal>pkcs12</literal> folder.

     

       1100
       +
           '';

     

       1101
       +
       

     

       1102
       +
           token = mkPrefixedAttrsOfParams {

     

       1103
       +
             handle = mkOptionalHexParam ''

     

       1104
       +
               Hex-encoded CKA_ID or handle of the private key on the token or TPM,

     

       1105
       +
               respectively.

     

       1106
       +
             '';

     

       1107
       +
       

     

       1108
       +
             slot = mkOptionalIntParam ''

     

       1109
       +
               Optional slot number to access the token.

     

       1110
       +
             '';

     

       1111
       +
       

     

       1112
       +
             module = mkOptionalStrParam ''

     

       1113
       +
               Optional PKCS#11 module name to access the token.

     

       1114
       +
             '';

     

       1115
       +
       

     

       1116
       +
             pin = mkOptionalStrParam ''

     

       1117
       +
               Optional PIN required to access the key on the token. If none is

     

       1118
       +
               provided the user is prompted during an interactive

     

       1119
       +
               <literal>--load-creds</literal> call.

     

       1120
       +
             '';

     

       1121
       +
           } ''Definition for a private key that's stored on a token/smartcard/TPM.'';

     

       1122
       +
       

     

       1123
       +
         };

     

       1124
       +
       

     

       1125
       +
         pools = mkAttrsOfParams {

     

       1126
       +
           addrs = mkOptionalStrParam ''

     

       1127
       +
             Subnet or range defining addresses allocated in pool. Accepts a single

     

       1128
       +
             CIDR subnet defining the pool to allocate addresses from or an address

     

       1129
       +
             range (&#60;from&#62;-&#60;to&#62;). Pools must be unique and non-overlapping.

     

       1130
       +
           '';

     

       1131
       +
       

     

       1132
       +
           dns           = mkCommaSepListParam [] "Address or CIDR subnets";

     

       1133
       +
           nbns          = mkCommaSepListParam [] "Address or CIDR subnets";

     

       1134
       +
           dhcp          = mkCommaSepListParam [] "Address or CIDR subnets";

     

       1135
       +
           netmask       = mkCommaSepListParam [] "Address or CIDR subnets";

     

       1136
       +
           server        = mkCommaSepListParam [] "Address or CIDR subnets";

     

       1137
       +
           subnet        = mkCommaSepListParam [] "Address or CIDR subnets";

     

       1138
       +
           split_include = mkCommaSepListParam [] "Address or CIDR subnets";

     

       1139
       +
           split_exclude = mkCommaSepListParam [] "Address or CIDR subnets";

     

       1140
       +
         } ''

     

       1141
       +
           Section defining named pools. Named pools may be referenced by connections

     

       1142
       +
           with the pools option to assign virtual IPs and other configuration

     

       1143
       +
           attributes. Each pool must have a unique name (denoted &#60;name&#62; below).

     

       1144
       +
         '';

     

       1145
       +
       }

nixos/release.nix

···

       352
        
         tests.smokeping = callTest tests/smokeping.nix {};

     

       353
        
         tests.snapper = callTest tests/snapper.nix {};

     

       354
        
         tests.statsd = callTest tests/statsd.nix {};

     

       0
        
       
     

       355
        
         tests.sudo = callTest tests/sudo.nix {};

     

       356
        
         tests.switchTest = callTest tests/switch-test.nix {};

     

       357
        
         tests.taskserver = callTest tests/taskserver.nix {};

···

       352
        
         tests.smokeping = callTest tests/smokeping.nix {};

     

       353
        
         tests.snapper = callTest tests/snapper.nix {};

     

       354
        
         tests.statsd = callTest tests/statsd.nix {};

     

       355
       +
         tests.strongswan-swanctl = callTest tests/strongswan-swanctl.nix {};

     

       356
        
         tests.sudo = callTest tests/sudo.nix {};

     

       357
        
         tests.switchTest = callTest tests/switch-test.nix {};

     

       358
        
         tests.taskserver = callTest tests/taskserver.nix {};

+154

nixos/tests/strongswan-swanctl.nix

···

       1
       +
       # This strongswan-swanctl test is based on:

     

       2
       +
       # https://www.strongswan.org/testing/testresults/swanctl/rw-psk-ipv4/index.html

     

       3
       +
       # https://github.com/strongswan/strongswan/tree/master/testing/tests/swanctl/rw-psk-ipv4

     

       4
       +
       #

     

       5
       +
       # The roadwarrior carol sets up a connection to gateway moon. The authentication

     

       6
       +
       # is based on pre-shared keys and IPv4 addresses. Upon the successful

     

       7
       +
       # establishment of the IPsec tunnels, the specified updown script automatically

     

       8
       +
       # inserts iptables-based firewall rules that let pass the tunneled traffic. In

     

       9
       +
       # order to test both tunnel and firewall, carol pings the client alice behind

     

       10
       +
       # the gateway moon.

     

       11
       +
       #

     

       12
       +
       #     alice                       moon                        carol

     

       13
       +
       #      eth1------vlan_0------eth1        eth2------vlan_1------eth1

     

       14
       +
       #   192.168.0.1         192.168.0.3  192.168.1.3           192.168.1.2

     

       15
       +
       #

     

       16
       +
       # See the NixOS manual for how to run this test:

     

       17
       +
       # https://nixos.org/nixos/manual/index.html#sec-running-nixos-tests-interactively

     

       18
       +
       

     

       19
       +
       import ./make-test.nix ({ pkgs, ...} :

     

       20
       +
       

     

       21
       +
       let

     

       22
       +
         ifAddr = node: iface: (pkgs.lib.head node.config.networking.interfaces.${iface}.ip4).address;

     

       23
       +
       

     

       24
       +
         allowESP = "iptables --insert INPUT --protocol ESP --jump ACCEPT";

     

       25
       +
       

     

       26
       +
         # Shared VPN settings:

     

       27
       +
         vlan0         = "192.168.0.0/24";

     

       28
       +
         version       = 2;

     

       29
       +
         secret        = "0sFpZAZqEN6Ti9sqt4ZP5EWcqx";

     

       30
       +
         esp_proposals = [ "aes128gcm128-x25519" ];

     

       31
       +
         proposals     = [ "aes128-sha256-x25519" ];

     

       32
       +
       in {

     

       33
       +
         name = "strongswan-swanctl";

     

       34
       +
         meta.maintainers = with pkgs.stdenv.lib.maintainers; [ basvandijk ];

     

       35
       +
         nodes = {

     

       36
       +
       

     

       37
       +
           alice = { nodes, ... } : {

     

       38
       +
             virtualisation.vlans = [ 0 ];

     

       39
       +
             networking = {

     

       40
       +
               dhcpcd.enable = false;

     

       41
       +
               defaultGateway = ifAddr nodes.moon "eth1";

     

       42
       +
             };

     

       43
       +
           };

     

       44
       +
       

     

       45
       +
           moon = {pkgs, config, nodes, ...} :

     

       46
       +
             let

     

       47
       +
               carolIp = ifAddr nodes.carol "eth1";

     

       48
       +
               moonIp  = ifAddr nodes.moon  "eth2";

     

       49
       +
               strongswan = config.services.strongswan-swanctl.package;

     

       50
       +
             in {

     

       51
       +
               virtualisation.vlans = [ 0 1 ];

     

       52
       +
               networking = {

     

       53
       +
                 dhcpcd.enable = false;

     

       54
       +
                 firewall = {

     

       55
       +
                   allowedUDPPorts = [ 4500 500 ];

     

       56
       +
                   extraCommands = allowESP;

     

       57
       +
                 };

     

       58
       +
                 nat = {

     

       59
       +
                   enable             = true;

     

       60
       +
                   internalIPs        = [ vlan0 ];

     

       61
       +
                   internalInterfaces = [ "eth1" ];

     

       62
       +
                   externalIP         = moonIp;

     

       63
       +
                   externalInterface  = "eth2";

     

       64
       +
                 };

     

       65
       +
               };

     

       66
       +
               environment.systemPackages = [ strongswan ];

     

       67
       +
               services.strongswan-swanctl = {

     

       68
       +
                 enable = true;

     

       69
       +
                 swanctl = {

     

       70
       +
                   connections = {

     

       71
       +
                     "rw" = {

     

       72
       +
                       local_addrs = [ moonIp ];

     

       73
       +
                       local."main" = {

     

       74
       +
                         auth = "psk";

     

       75
       +
                       };

     

       76
       +
                       remote."main" = {

     

       77
       +
                         auth = "psk";

     

       78
       +
                       };

     

       79
       +
                       children = {

     

       80
       +
                         "net" = {

     

       81
       +
                           local_ts = [ vlan0 ];

     

       82
       +
                           updown = "${strongswan}/libexec/ipsec/_updown iptables";

     

       83
       +
                           inherit esp_proposals;

     

       84
       +
                         };

     

       85
       +
                       };

     

       86
       +
                       inherit version;

     

       87
       +
                       inherit proposals;

     

       88
       +
                     };

     

       89
       +
                   };

     

       90
       +
                   secrets = {

     

       91
       +
                     ike."carol" = {

     

       92
       +
                       id."main" = carolIp;

     

       93
       +
                       inherit secret;

     

       94
       +
                     };

     

       95
       +
                   };

     

       96
       +
                 };

     

       97
       +
               };

     

       98
       +
             };

     

       99
       +
       

     

       100
       +
           carol = {pkgs, config, nodes, ...} :

     

       101
       +
             let

     

       102
       +
               carolIp = ifAddr nodes.carol "eth1";

     

       103
       +
               moonIp  = ifAddr nodes.moon  "eth2";

     

       104
       +
               strongswan = config.services.strongswan-swanctl.package;

     

       105
       +
             in {

     

       106
       +
               virtualisation.vlans = [ 1 ];

     

       107
       +
               networking = {

     

       108
       +
                 dhcpcd.enable = false;

     

       109
       +
                 firewall.extraCommands = allowESP;

     

       110
       +
               };

     

       111
       +
               environment.systemPackages = [ strongswan ];

     

       112
       +
               services.strongswan-swanctl = {

     

       113
       +
                 enable = true;

     

       114
       +
                 swanctl = {

     

       115
       +
                   connections = {

     

       116
       +
                     "home" = {

     

       117
       +
                       local_addrs = [ carolIp ];

     

       118
       +
                       remote_addrs = [ moonIp ];

     

       119
       +
                       local."main" = {

     

       120
       +
                         auth = "psk";

     

       121
       +
                         id = carolIp;

     

       122
       +
                       };

     

       123
       +
                       remote."main" = {

     

       124
       +
                         auth = "psk";

     

       125
       +
                         id = moonIp;

     

       126
       +
                       };

     

       127
       +
                       children = {

     

       128
       +
                         "home" = {

     

       129
       +
                           remote_ts = [ vlan0 ];

     

       130
       +
                           start_action = "trap";

     

       131
       +
                           updown = "${strongswan}/libexec/ipsec/_updown iptables";

     

       132
       +
                           inherit esp_proposals;

     

       133
       +
                         };

     

       134
       +
                       };

     

       135
       +
                       inherit version;

     

       136
       +
                       inherit proposals;

     

       137
       +
                     };

     

       138
       +
                   };

     

       139
       +
                   secrets = {

     

       140
       +
                     ike."moon" = {

     

       141
       +
                       id."main" = moonIp;

     

       142
       +
                       inherit secret;

     

       143
       +
                     };

     

       144
       +
                   };

     

       145
       +
                 };

     

       146
       +
               };

     

       147
       +
             };

     

       148
       +
       

     

       149
       +
         };

     

       150
       +
         testScript = ''

     

       151
       +
           startAll();

     

       152
       +
           $carol->waitUntilSucceeds("ping -c 1 alice");

     

       153
       +
         '';

     

       154
       +
       })