swanctl: Convert swanctl.conf to an options file and generate config
This commit is contained in:
Tobias Brunner
committed by
Martin Willi
Martin Willi
parent
49d8a5f554
commit
5fdba04312
@@ -1 +1,2 @@
|
|||||||
swanctl
|
swanctl
|
||||||
|
swanctl.conf
|
||||||
|
|||||||
@@ -29,7 +29,15 @@ AM_CPPFLAGS = \
|
|||||||
-DSWANCTLDIR=\""${swanctldir}\"" \
|
-DSWANCTLDIR=\""${swanctldir}\"" \
|
||||||
-DPLUGINS=\""${s_plugins}\""
|
-DPLUGINS=\""${s_plugins}\""
|
||||||
|
|
||||||
EXTRA_DIST = swanctl.conf
|
BUILT_SOURCES = swanctl.conf
|
||||||
|
EXTRA_DIST = swanctl.opt swanctl.conf
|
||||||
|
|
||||||
|
.opt.conf:
|
||||||
|
$(AM_V_GEN) \
|
||||||
|
$(PYTHON) $(top_srcdir)/conf/format-options.py -f conf $< > $(srcdir)/$@
|
||||||
|
|
||||||
|
maintainer-clean-local:
|
||||||
|
cd $(srcdir) && rm -f swanctl.conf
|
||||||
|
|
||||||
install-data-local: swanctl.conf
|
install-data-local: swanctl.conf
|
||||||
test -e "$(DESTDIR)$(swanctldir)" || $(INSTALL) -d "$(DESTDIR)$(swanctldir)"
|
test -e "$(DESTDIR)$(swanctldir)" || $(INSTALL) -d "$(DESTDIR)$(swanctldir)"
|
||||||
|
|||||||
@@ -1,125 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
# # an IKE configuration named conn1
|
|
||||||
# conn1 {
|
|
||||||
# # IKE version to use
|
|
||||||
# version = 2
|
|
||||||
# # list of acceptable local addresses/subnets
|
|
||||||
# local_addrs = 0.0.0.0
|
|
||||||
# # peer address, additional addresses/subnets as responder
|
|
||||||
# remote_addrs = 192.168.5.1
|
|
||||||
# # local UPD port for IKE
|
|
||||||
# local_port = 500
|
|
||||||
# # remote UDP port for IKE
|
|
||||||
# remote_port = 500
|
|
||||||
# # Proposals for IKE, "default" is the default proposal
|
|
||||||
# proposals = aes128gcm16-prfsha256-modp2048, default
|
|
||||||
# # virtual IPs to request, such as 0.0.0.0 or ::
|
|
||||||
# vips =
|
|
||||||
# # IKEv1 aggressive mode
|
|
||||||
# aggressive = no
|
|
||||||
# # use of pull/push in IKEv1 mode config
|
|
||||||
# pull = yes
|
|
||||||
# # enforce UDP encapsulation by faking NAT-D payloads
|
|
||||||
# encap = no
|
|
||||||
# # enable IKEv2 MOBIKE
|
|
||||||
# mobike = yes
|
|
||||||
# # interval of liveness checks
|
|
||||||
# dpd_delay = 10s
|
|
||||||
# # timeout for DPD checks (IKEV1 only)
|
|
||||||
# dpd_timeout = 30s
|
|
||||||
# # use IKEv1 UDP packet fragmentation
|
|
||||||
# fragmentation = force
|
|
||||||
# # send certificate requests
|
|
||||||
# send_certreq = yes
|
|
||||||
# # send certificate payloads
|
|
||||||
# send_cert = ifasked
|
|
||||||
# # number of retransmission sequences to do before givin up
|
|
||||||
# keyingtries = 0
|
|
||||||
# # uniquness policy, never|no|keep|replace|
|
|
||||||
# unique = no
|
|
||||||
# # time to schedule IKE reauthentication
|
|
||||||
# reauth_time = 3h
|
|
||||||
# # time to schedule IKE rekeying
|
|
||||||
# rekey_time = 2h
|
|
||||||
# # hard IKE_SA lifetime if rekey/reauth does not complete
|
|
||||||
# over_time = 10m
|
|
||||||
# # range of random time to subtract from rekey/rauth times
|
|
||||||
# rand_time = 10m
|
|
||||||
#
|
|
||||||
# # local authentication, first round
|
|
||||||
# local {
|
|
||||||
# # additional certificates to load
|
|
||||||
# certs = a.pem, xy.der
|
|
||||||
# # authentication to perform locally
|
|
||||||
# auth = pubkey
|
|
||||||
# # IKE identity for local
|
|
||||||
# id = [email protected]
|
|
||||||
# # Client EAP-Identity to use
|
|
||||||
# eap_id = moon
|
|
||||||
# # Server side EAP identity to use, EAP-TTLS etc.
|
|
||||||
# aaa_identity = srv
|
|
||||||
# # IKEv1 XAuth username
|
|
||||||
# xauth_id = moon
|
|
||||||
# }
|
|
||||||
# # remote authentication, first round
|
|
||||||
# remote {
|
|
||||||
# # IKE identity for peer
|
|
||||||
# id = %any
|
|
||||||
# # list of acceptable peer certificates
|
|
||||||
# certs = client.pem
|
|
||||||
# # list of acceptable CA certificates
|
|
||||||
# cacert = ca.der
|
|
||||||
# # revocation policy, strict|ifuri
|
|
||||||
# revocation = ifuri
|
|
||||||
# # authentication to expect from remote
|
|
||||||
# auth = pubkey
|
|
||||||
# }
|
|
||||||
# children {
|
|
||||||
# # First CHILD_SA configuration
|
|
||||||
# child1 {
|
|
||||||
# # AH proposals to offer
|
|
||||||
# ah_proposals = default
|
|
||||||
# # ESP proposals to offer
|
|
||||||
# esp_proposals = aes128gcm16-modp2048, default
|
|
||||||
# # local subnets to tunnel
|
|
||||||
# local_ts = 192.168.3.0/24
|
|
||||||
# # remote subnets to tunnel
|
|
||||||
# remote_ts = 192.168.1.0/24
|
|
||||||
# # updown script to invoke
|
|
||||||
# updown = path-to-script
|
|
||||||
# # hostaccess variable to pass to updown
|
|
||||||
# hostaccess = yes
|
|
||||||
# # IPsec mode, tunnel|transport|pass|drop
|
|
||||||
# mode = tunnel
|
|
||||||
# # action to perform on DPD timeout
|
|
||||||
# dpd_action = restart
|
|
||||||
# # enable IPComp
|
|
||||||
# ipcomp = no
|
|
||||||
# # inactivity timeout before closing CHILD_SA
|
|
||||||
# inactivity = 2m
|
|
||||||
# # fixed reqid to use for this CHILD_SA
|
|
||||||
# reqid = 5
|
|
||||||
# # Netfilter mark for input traffic
|
|
||||||
# mark_in = 1
|
|
||||||
# # Netfilter mark for output traffic
|
|
||||||
# mark_out = 5/0xffffffff
|
|
||||||
# # Traffic Flow Confidentiality padding
|
|
||||||
# tfc_padding = 1500
|
|
||||||
# }
|
|
||||||
# }
|
|
||||||
# }
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
# eap-tester {
|
|
||||||
# id = tester
|
|
||||||
# secret = test
|
|
||||||
# }
|
|
||||||
# ike-moon {
|
|
||||||
# id-local = sun.strongswan.org
|
|
||||||
# id-remote = mon.strongswan.org
|
|
||||||
# secret = 0x12345678901234
|
|
||||||
# }
|
|
||||||
}
|
|
||||||
@@ -0,0 +1,188 @@
|
|||||||
|
connections.conn1 { # }
|
||||||
|
An IKE configuration named conn1
|
||||||
|
|
||||||
|
connections.conn1.version = 2
|
||||||
|
IKE version to use
|
||||||
|
|
||||||
|
connections.conn1.local_addrs = 0.0.0.0
|
||||||
|
List of acceptable local addresses/subnets
|
||||||
|
|
||||||
|
connections.conn1.remote_addrs = 192.168.5.1
|
||||||
|
Peer address, additional addresses/subnets as responder
|
||||||
|
|
||||||
|
connections.conn1.local_port = 500
|
||||||
|
Local UPD port for IKE
|
||||||
|
|
||||||
|
connections.conn1.remote_port = 500
|
||||||
|
Remote UDP port for IKE
|
||||||
|
|
||||||
|
connections.conn1.proposals = aes128gcm16-prfsha256-modp2048, default
|
||||||
|
Proposals for IKE, "default" is the default proposal
|
||||||
|
|
||||||
|
connections.conn1.vips =
|
||||||
|
Virtual IPs to request, such as 0.0.0.0 or ::
|
||||||
|
|
||||||
|
connections.conn1.aggressive = no
|
||||||
|
IKEv1 aggressive mode
|
||||||
|
|
||||||
|
connections.conn1.pull = yes
|
||||||
|
Use of pull/push in IKEv1 mode config
|
||||||
|
|
||||||
|
connections.conn1.encap = no
|
||||||
|
Enforce UDP encapsulation by faking NAT-D payloads
|
||||||
|
|
||||||
|
connections.conn1.mobike = yes
|
||||||
|
Enable IKEv2 MOBIKE
|
||||||
|
|
||||||
|
connections.conn1.dpd_delay = 10s
|
||||||
|
Interval of liveness checks
|
||||||
|
|
||||||
|
connections.conn1.dpd_timeout = 30s
|
||||||
|
Timeout for DPD checks (IKEV1 only)
|
||||||
|
|
||||||
|
connections.conn1.fragmentation = force
|
||||||
|
Use IKEv1 UDP packet fragmentation
|
||||||
|
|
||||||
|
connections.conn1.send_certreq = yes
|
||||||
|
Send certificate requests
|
||||||
|
|
||||||
|
connections.conn1.send_cert = ifasked
|
||||||
|
Send certificate payloads
|
||||||
|
|
||||||
|
connections.conn1.keyingtries = 0
|
||||||
|
Number of retransmission sequences to do before givin up
|
||||||
|
|
||||||
|
connections.conn1.unique = no
|
||||||
|
Uniquness policy, never|no|keep|replace|
|
||||||
|
|
||||||
|
connections.conn1.reauth_time = 3h
|
||||||
|
Time to schedule IKE reauthentication
|
||||||
|
|
||||||
|
connections.conn1.rekey_time = 2h
|
||||||
|
Time to schedule IKE rekeying
|
||||||
|
|
||||||
|
connections.conn1.over_time = 10m
|
||||||
|
Hard IKE_SA lifetime if rekey/reauth does not complete
|
||||||
|
|
||||||
|
connections.conn1.rand_time = 10m
|
||||||
|
Range of random time to subtract from rekey/rauth times
|
||||||
|
|
||||||
|
connections.conn1.pools = pool1
|
||||||
|
Hand out addresses and attributes from pool1 as responder
|
||||||
|
|
||||||
|
connections.conn1.vips = 0.0.0.0
|
||||||
|
Request a virtual IP as initiator
|
||||||
|
|
||||||
|
connections.conn1.local {}
|
||||||
|
Local authentication, first round
|
||||||
|
|
||||||
|
connections.conn1.local.certs = a.pem, xy.der
|
||||||
|
Additional certificates to load
|
||||||
|
|
||||||
|
connections.conn1.local.auth = pubkey
|
||||||
|
Authentication to perform locally
|
||||||
|
|
||||||
|
connections.conn1.local.id = [email protected]
|
||||||
|
IKE identity for local
|
||||||
|
|
||||||
|
connections.conn1.local.eap_id = moon
|
||||||
|
Client EAP-Identity to use
|
||||||
|
|
||||||
|
connections.conn1.local.aaa_identity = srv
|
||||||
|
Server side EAP identity to use, EAP-TTLS etc.
|
||||||
|
|
||||||
|
connections.conn1.local.xauth_id = moon
|
||||||
|
IKEv1 XAuth username
|
||||||
|
|
||||||
|
connections.conn1.remote {}
|
||||||
|
Remote authentication, first round
|
||||||
|
|
||||||
|
connections.conn1.remote.id = %any
|
||||||
|
IKE identity for peer
|
||||||
|
|
||||||
|
connections.conn1.remote.certs = client.pem
|
||||||
|
List of acceptable peer certificates
|
||||||
|
|
||||||
|
connections.conn1.remote.cacert = ca.der
|
||||||
|
List of acceptable CA certificates
|
||||||
|
|
||||||
|
connections.conn1.remote.revocation = ifuri
|
||||||
|
Revocation policy, strict|ifuri
|
||||||
|
|
||||||
|
connections.conn1.remote.auth = pubkey
|
||||||
|
Authentication to expect from remote
|
||||||
|
|
||||||
|
connections.conn1.children.child1 {}
|
||||||
|
First CHILD_SA configuration
|
||||||
|
|
||||||
|
connections.conn1.children.child1.ah_proposals = default
|
||||||
|
AH proposals to offer
|
||||||
|
|
||||||
|
connections.conn1.children.child1.esp_proposals = aes128gcm16-modp2048, default
|
||||||
|
ESP proposals to offer
|
||||||
|
|
||||||
|
connections.conn1.children.child1.local_ts = 192.168.3.0/24
|
||||||
|
Local subnets to tunnel
|
||||||
|
|
||||||
|
connections.conn1.children.child1.remote_ts = 192.168.1.0/24
|
||||||
|
Remote subnets to tunnel
|
||||||
|
|
||||||
|
connections.conn1.children.child1.updown = path-to-script
|
||||||
|
Updown script to invoke
|
||||||
|
|
||||||
|
connections.conn1.children.child1.hostaccess = yes
|
||||||
|
Hostaccess variable to pass to updown
|
||||||
|
|
||||||
|
connections.conn1.children.child1.mode = tunnel
|
||||||
|
IPsec mode, tunnel|transport|pass|drop
|
||||||
|
|
||||||
|
connections.conn1.children.child1.dpd_action = restart
|
||||||
|
Action to perform on DPD timeout
|
||||||
|
|
||||||
|
connections.conn1.children.child1.ipcomp = no
|
||||||
|
Enable IPComp
|
||||||
|
|
||||||
|
connections.conn1.children.child1.inactivity = 2m
|
||||||
|
Inactivity timeout before closing CHILD_SA
|
||||||
|
|
||||||
|
connections.conn1.children.child1.reqid = 5
|
||||||
|
Fixed reqid to use for this CHILD_SA
|
||||||
|
|
||||||
|
connections.conn1.children.child1.mark_in = 1
|
||||||
|
Netfilter mark for input traffic
|
||||||
|
|
||||||
|
connections.conn1.children.child1.mark_out = 5/0xffffffff
|
||||||
|
Netfilter mark for output traffic
|
||||||
|
|
||||||
|
connections.conn1.children.child1.tfc_padding = 1500
|
||||||
|
Traffic Flow Confidentiality padding
|
||||||
|
|
||||||
|
secrets.eap1 { # }
|
||||||
|
EAP secret section
|
||||||
|
|
||||||
|
secrets.eap1.secret = testpassword
|
||||||
|
Password for EAP secret
|
||||||
|
|
||||||
|
secrets.eap1.id = tester
|
||||||
|
User EAP secret belongs to
|
||||||
|
|
||||||
|
secrets.ike-moon { # }
|
||||||
|
IKE secret for moon
|
||||||
|
|
||||||
|
secrets.ike-moon.secret = 0x12345678
|
||||||
|
IKE shared secret for moon
|
||||||
|
|
||||||
|
secrets.ike-moon.id-local = sun.strongswan.org
|
||||||
|
First identity secret belongs to
|
||||||
|
|
||||||
|
secrets.ike-moon.id-remote = moon.strongswan.org
|
||||||
|
Second identity secret belongs to
|
||||||
|
|
||||||
|
pools.poolx { # }
|
||||||
|
Section defining an address pool
|
||||||
|
|
||||||
|
pools.poolx.addrs = 10.1.2.0/24
|
||||||
|
Define addresses for this pool
|
||||||
|
|
||||||
|
pools.poolx.dns = 10.1.1.1, 10.1.2.1
|
||||||
|
Define DNS server addresses associated to pool
|
||||||
Reference in New Issue
Block a user