src/swanctl/swanctl.opt

   1 connections { # }
   2         Section defining IKE connection configurations.
   3
   4         Section defining IKE connection configurations.
   5
   6         The connections section defines IKE connection configurations, each in
   7         its own subsections. In the keyword description below, the connection
   8         is named _<conn>_, but an arbitrary yet unique connection name can be
   9         chosen for each connection subsection.
  10
  11 connections.<conn> { # }
  12         Section for an IKE connection named <conn>.
  13
  14 connections.<conn>.version = 0
  15         IKE major version to use for connection.
  16
  17         IKE major version to use for connection. _1_ uses IKEv1 aka ISAKMP, _2_
  18         uses IKEv2. A connection using the default of _0_ accepts both IKEv1
  19         and IKEv2 as responder, and initiates the connection actively with IKEv2.
  20
  21 connections.<conn>.local_addrs = %any
  22         Local address(es) to use for IKE communication, comma separated.
  23
  24         Local address(es) to use for IKE communication, comma separated. Takes
  25         single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
  26
  27         As initiator, the first non-range/non-subnet is used to initiate the
  28         connection from. As responder, the local destination address must match at
  29         least to one of the specified addresses, subnets or ranges.
  30
  31         If FQDNs are assigned they are resolved every time a configuration lookup
  32         is done. If DNS resolution times out, the lookup is delayed for that time.
  33
  34 connections.<conn>.remote_addrs = %any
  35         Remote address(es) to use for IKE communication, comma separated.
  36
  37         Remote address(es) to use for IKE communication, comma separated. Takes
  38         single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
  39
  40         As initiator, the first non-range/non-subnet is used to initiate the
  41         connection to. As responder, the initiator source address must match at
  42         least to one of the specified addresses, subnets or ranges.
  43
  44         If FQDNs are assigned they are resolved every time a configuration lookup
  45         is done. If DNS resolution times out, the lookup is delayed for that time.
  46
  47         To initiate a connection, at least one specific address or DNS name must
  48         be specified.
  49
  50 connections.<conn>.local_port = 500
  51         Local UDP port for IKE communication.
  52
  53         Local UDP port for IKE communication. By default the port of the socket
  54         backend is used, which is usually _500_. If port _500_ is used, automatic
  55         IKE port floating to port 4500 is used to work around NAT issues.
  56
  57         Using a non-default local IKE port requires support from the socket backend
  58         in use (socket-dynamic).
  59
  60 connections.<conn>.remote_port = 500
  61         Remote UDP port for IKE communication.
  62
  63         Remote UDP port for IKE communication. If the default of port _500_ is used,
  64         automatic IKE port floating to port 4500 is used to work around NAT issues.
  65
  66 connections.<conn>.proposals = default
  67         Comma separated proposals to accept for IKE.
  68
  69         A proposal is a set of algorithms. For non-AEAD algorithms, this includes
  70         for IKE an encryption algorithm, an integrity algorithm, a pseudo random
  71         function and a Diffie-Hellman group. For AEAD algorithms, instead of
  72         encryption and integrity algorithms, a combined algorithm is used.
  73
  74         In IKEv2, multiple algorithms of the same kind can be specified in a single
  75         proposal, from which one gets selected. In IKEv1, only one algorithm per
  76         kind is allowed per proposal, more algorithms get implicitly stripped. Use
  77         multiple proposals to offer different algorithms combinations in IKEv1.
  78
  79         Algorithm keywords get separated using dashes. Multiple proposals may be
  80         separated by commas. The special value _default_ forms a default proposal
  81         of supported algorithms considered safe, and is usually a good choice
  82         for interoperability.
  83
  84 connections.<conn>.vips =
  85         Virtual IPs to request in configuration payload / Mode Config.
  86
  87         Comma separated list of virtual IPs to request in IKEv2 configuration
  88         payloads or IKEv1 Mode Config. The wildcard addresses _0.0.0.0_ and _::_
  89         request an arbitrary address, specific addresses may be defined. The
  90         responder may return a different address, though, or none at all.
  91
  92 connections.<conn>.aggressive = no
  93         Use Aggressive Mode in IKEv1.
  94
  95         Enables Aggressive Mode instead of Main Mode with Identity Protection.
  96         Aggressive Mode is considered less secure, because the ID and HASH
  97         payloads are exchanged unprotected. This allows a passive attacker to
  98         snoop peer identities, and even worse, start dictionary attacks on the
  99         Preshared Key.
 100
 101 connections.<conn>.pull = yes
 102         Set the Mode Config mode to use.
 103
 104         If the default of _yes_ is used, Mode Config works in pull mode, where
 105         the initiator actively requests a virtual IP. With _no_, push mode is used,
 106         where the responder pushes down a virtual IP to the initiating peer.
 107
 108         Push mode is currently supported for IKEv1, but not in IKEv2. It is used
 109         by a few implementations only, pull mode is recommended.
 110
 111 connections.<conn>.dscp = 000000
 112         Differentiated Services Field Codepoint to set on outgoing IKE packets (six
 113         binary digits).
 114
 115         Differentiated Services Field Codepoint to set on outgoing IKE packets for
 116         this connection. The value is a six digit binary encoded string specifying
 117         the Codepoint to set, as defined in RFC 2474.
 118
 119 connections.<conn>.encap = no
 120         Enforce UDP encapsulation by faking NAT-D payloads.
 121
 122         To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
 123         NAT detection payloads. This makes the peer believe that NAT takes
 124         place on the path, forcing it to encapsulate ESP packets in UDP.
 125
 126         Usually this is not required, but it can help to work around connectivity
 127         issues with too restrictive intermediary firewalls.
 128
 129 connections.<conn>.mobike = yes
 130         Enables MOBIKE on IKEv2 connections.
 131
 132         Enables MOBIKE on IKEv2 connections. MOBIKE is enabled by default on IKEv2
 133         connections, and allows mobility of clients and multi-homing on servers by
 134         migrating active IPsec tunnels.
 135
 136         Usually keeping MOBIKE enabled is unproblematic, as it is not used if the
 137         peer does not indicate support for it. However, due to the design of MOBIKE,
 138         IKEv2 always floats to port 4500 starting from the second exchange. Some
 139         implementations don't like this behavior, hence it can be disabled.
 140
 141 connections.<conn>.dpd_delay = 0s
 142         Interval of liveness checks (DPD).
 143
 144         Interval to check the liveness of a peer actively using IKEv2 INFORMATIONAL
 145         exchanges or IKEv1 R_U_THERE messages. Active DPD checking is only enforced
 146         if no IKE or ESP/AH packet has been received for the configured DPD delay.
 147
 148 connections.<conn>.dpd_timeout = 0s
 149         Timeout for DPD checks (IKEV1 only).
 150
 151         Charon by default uses the normal retransmission mechanism and timeouts to
 152         check the liveness of a peer, as all messages are used for liveness
 153         checking. For compatibility reasons, with IKEv1 a custom interval may be
 154         specified; this option has no effect on connections using IKE2.
 155
 156 connections.<conn>.fragmentation = yes
 157         Use IKE UDP datagram fragmentation.  (_yes_, _accept_, _no_ or _force_).
 158
 159         Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
 160         fragmentation).  Acceptable  values  are _yes_ (the     default), _accept_,
 161         _force_ and _no_. If set to _yes_, and the peer supports it, oversized IKE
 162         messages will be sent in fragments. If set to _accept_, support for
 163         fragmentation is announced to the peer but the daemon does not send its own
 164         messages in fragments.  If set to _force_ (only supported for IKEv1) the
 165         initial IKE message will already be fragmented if required. Finally, setting
 166         the option to _no_ will disable announcing support for this feature.
 167
 168         Note that fragmented IKE messages sent by a peer are always accepted
 169         irrespective of the value of this option (even when set to _no_).
 170
 171 connections.<conn>.send_certreq = yes
 172         Send certificate requests payloads (_yes_ or _no_).
 173
 174         Send certificate request payloads to offer trusted root CA certificates
 175         to the peer. Certificate requests help the peer to choose an appropriate
 176         certificate/private key for authentication and are enabled by default.
 177
 178         Disabling certificate requests can be useful if too many trusted root CA
 179         certificates are installed, as each certificate request increases the size
 180         of the initial IKE packets.
 181
 182 connections.<conn>.send_cert = ifasked
 183         Send certificate payloads (_always_, _never_ or _ifasked_).
 184
 185         Send certificate payloads when using certificate authentication. With the
 186         default of _ifasked_ the daemon sends certificate payloads only if
 187         certificate requests have been received. _never_ disables sending of
 188         certificate payloads altogether, _always_ causes certificate payloads to be
 189         sent unconditionally whenever certificate authentication is used.
 190
 191 connections.<conn>.ppk_id =
 192         String identifying the Postquantum Preshared Key (PPK) to be used.
 193
 194 connections.<conn>.ppk_required = no
 195         Whether a Postquantum Preshared Key (PPK) is required for this connection.
 196
 197 connections.<conn>.keyingtries = 1
 198         Number of retransmission sequences to perform during initial connect.
 199
 200         Number of retransmission sequences to perform during initial connect.
 201         Instead of giving up initiation after the first retransmission sequence with
 202         the default value of _1_, additional sequences may be started according to
 203         the configured value. A value of _0_ initiates a new sequence until the
 204         connection establishes or fails with a permanent error.
 205
 206 connections.<conn>.unique = no
 207         Connection uniqueness policy (_never_, _no_, _keep_ or _replace_).
 208
 209         Connection uniqueness policy to enforce. To avoid multiple connections
 210         from the same user, a uniqueness policy can be enforced. The value _never_
 211         does never enforce such a policy, even if a peer included INITIAL_CONTACT
 212         notification messages, whereas _no_ replaces existing connections for the
 213         same identity if a new one has the INITIAL_CONTACT notify. _keep_ rejects
 214         new connection attempts if the same user already has an active connection,
 215         _replace_ deletes any existing connection if a new one for the same user
 216         gets established.
 217
 218         To compare connections for uniqueness, the remote IKE identity is used. If
 219         EAP or XAuth authentication is involved, the EAP-Identity or XAuth username
 220         is used to enforce the uniqueness policy instead.
 221
 222         On initiators this setting specifies whether an INITIAL_CONTACT notify is
 223         sent during IKE_AUTH if no existing connection is found with the remote
 224         peer (determined by the identities of the first authentication round).
 225         Unless set to _never_ the client will send a notify.
 226
 227 connections.<conn>.reauth_time = 0s
 228         Time to schedule IKE reauthentication.
 229
 230         Time to schedule IKE reauthentication. IKE reauthentication recreates the
 231         IKE/ISAKMP SA from scratch and re-evaluates the credentials. In asymmetric
 232         configurations (with EAP or configuration payloads) it might not be possible
 233         to actively reauthenticate as responder. The IKEv2 reauthentication lifetime
 234         negotiation can instruct the client to perform reauthentication.
 235
 236         Reauthentication is disabled by default. Enabling it usually may lead
 237         to small connection interruptions, as strongSwan uses a break-before-make
 238         policy with IKEv2 to avoid any conflicts with associated tunnel resources.
 239
 240 connections.<conn>.rekey_time = 4h
 241         Time to schedule IKE rekeying.
 242
 243         IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
 244         does not re-check associated credentials. It is supported in IKEv2 only,
 245         IKEv1 performs a reauthentication procedure instead.
 246
 247         With the default value IKE rekeying is scheduled every 4 hours, minus the
 248         configured **rand_time**. If a **reauth_time** is configured, **rekey_time**
 249         defaults to zero disabling rekeying; explicitly set both to enforce
 250         rekeying and reauthentication.
 251
 252 connections.<conn>.over_time = 10% of rekey_time/reauth_time
 253         Hard IKE_SA lifetime if rekey/reauth does not complete, as time.
 254
 255         Hard IKE_SA lifetime if rekey/reauth does not complete, as time.
 256         To avoid having an IKE/ISAKMP kept alive if IKE reauthentication or rekeying
 257         fails perpetually, a maximum hard lifetime may be specified. If the
 258         IKE_SA fails to rekey or reauthenticate within the specified time, the
 259         IKE_SA gets closed.
 260
 261         In contrast to CHILD_SA rekeying, **over_time** is relative in time to the
 262         **rekey_time** _and_ **reauth_time** values, as it applies to both.
 263
 264         The default is 10% of the longer of **rekey_time** and **reauth_time**.
 265
 266 connections.<conn>.rand_time = over_time
 267         Range of random time to subtract from rekey/reauth times.
 268
 269         Time range from which to choose a random value to subtract from
 270         rekey/reauth times. To avoid having both peers initiating the rekey/reauth
 271         procedure simultaneously, a random time gets subtracted from the
 272         rekey/reauth times.
 273
 274         The default is equal to the configured **over_time**.
 275
 276 connections.<conn>.pools =
 277         Comma separated list of named IP pools.
 278
 279         Comma separated list of named IP pools to allocate virtual IP addresses and
 280         other configuration attributes from. Each name references a pool by name
 281         from either the **pools** section or an external pool.
 282
 283 connections.<conn>.mediation = no
 284         Whether this connection is a mediation connection.
 285
 286         Whether this connection is a mediation connection, that is, whether this
 287         connection is used to mediate other connections using the IKEv2 Mediation
 288         Extension.  Mediation connections create no CHILD_SA.
 289
 290 connections.<conn>.mediated_by =
 291         The name of the connection to mediate this connection through.
 292
 293         The name of the connection to mediate this connection through. If given, the
 294         connection will be mediated through the named mediation connection.
 295         The     mediation connection must have **mediation** enabled.
 296
 297 connections.<conn>.mediation_peer =
 298         Identity under which the peer is registered at the mediation server.
 299
 300         Identity under which the peer is registered at the mediation server, that
 301         is, the IKE identity the other end of this connection uses as its local
 302         identity on its connection to the mediation server. This is the identity we
 303         request the mediation server to mediate us with. Only relevant on
 304         connections that set **mediated_by**. If it is not given, the remote IKE
 305         identity of the first authentication round of this connection will be used.
 306
 307 connections.<conn>.local<suffix> {}
 308         Section for a local authentication round.
 309
 310         Section for a local authentication round. A local authentication round
 311         defines the rules how authentication is performed for the local peer.
 312         Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple Authentication
 313         or IKEv1 XAuth.
 314
 315         Each round is defined in a section having _local_ as prefix, and an optional
 316         unique suffix. To define a single authentication round, the suffix may be
 317         omitted.
 318
 319 connections.<conn>.local<suffix>.round = 0
 320         Optional numeric identifier by which authentication rounds are sorted.  If
 321         not specified rounds are ordered by their position in the config file/VICI
 322         message.
 323
 324 connections.<conn>.local<suffix>.certs =
 325         Comma separated list of certificate candidates to use for authentication.
 326
 327         Comma separated list of certificate candidates to use for authentication.
 328         The certificates may use a relative path from the **swanctl** _x509_
 329         directory or an absolute path.
 330
 331         The certificate used for authentication is selected based on the received
 332         certificate request payloads. If no appropriate CA can be located, the
 333         first certificate is used.
 334
 335 connections.<conn>.local<suffix>.cert<suffix> =
 336         Section for a certificate candidate to use for authentication.
 337
 338         Section for a certificate candidate to use for authentication. Certificates
 339         in _certs_ are transmitted as binary blobs, these sections offer more
 340         flexibility.
 341
 342 connections.<conn>.local<suffix>.cert<suffix>.file =
 343         Absolute path to the certificate to load.
 344
 345         Absolute path to the certificate to load. Passed as-is to the daemon, so it
 346         must be readable by it.
 347
 348         Configure either this or _handle_, but not both, in one section.
 349
 350 connections.<conn>.local<suffix>.cert<suffix>.handle =
 351         Hex-encoded CKA_ID of the certificate on a token.
 352
 353         Hex-encoded CKA_ID of the certificate on a token.
 354
 355         Configure either this or _file_, but not both, in one section.
 356
 357 connections.<conn>.local<suffix>.cert<suffix>.slot =
 358         Optional slot number of the token that stores the certificate.
 359
 360 connections.<conn>.local<suffix>.cert<suffix>.module =
 361         Optional PKCS#11 module name.
 362
 363 connections.<conn>.local<suffix>.pubkeys =
 364         Comma separated list of raw public key candidates to use for authentication.
 365
 366         Comma separated list of raw public key candidates to use for authentication.
 367         The public keys may use a relative path from the **swanctl** _pubkey_
 368         directory or an absolute path.
 369
 370         Even though multiple local public keys could be defined in principle, only
 371         the     first public key in the list is used for authentication.
 372
 373 connections.<conn>.local<suffix>.auth = pubkey
 374         Authentication to perform locally (_pubkey_, _psk_, _xauth[-backend]_ or
 375         _eap[-method]_).
 376
 377         Authentication to perform locally. _pubkey_ uses public key authentication
 378         using a private key associated to a usable certificate. _psk_ uses
 379         pre-shared key authentication. The IKEv1 specific _xauth_ is used for
 380         XAuth or Hybrid authentication, while the IKEv2 specific _eap_ keyword
 381         defines EAP authentication.
 382
 383         For _xauth_, a specific backend name may be appended, separated by a dash.
 384         The appropriate _xauth_ backend is selected to perform the XAuth exchange.
 385         For traditional XAuth, the _xauth_ method is usually defined in the second
 386         authentication round following an initial _pubkey_ (or _psk_) round. Using
 387         _xauth_ in the first round performs Hybrid Mode client authentication.
 388
 389         For _eap_, a specific EAP method name may be appended, separated by a dash.
 390         An EAP module implementing the appropriate method is selected to perform
 391         the EAP conversation.
 392
 393         If both peers support RFC 7427 ("Signature Authentication in IKEv2")
 394         specific hash algorithms to be used during IKEv2 authentication may be
 395         configured. To do so use _ike:_ followed by a trust chain signature scheme
 396         constraint (see description of the **remote** section's **auth** keyword).
 397         For example, with _ike:pubkey-sha384-sha256_ a public key signature scheme
 398         with either SHA-384 or SHA-256 would get used for authentication, in that
 399         order and depending on the hash algorithms supported by the peer. If no
 400         specific hash algorithms are configured, the default is to prefer an
 401         algorithm that matches or exceeds the strength of the signature key.
 402         If no constraints with _ike:_ prefix are configured any signature scheme
 403         constraint (without _ike:_ prefix) will also apply to IKEv2 authentication,
 404         unless this is disabled in **strongswan.conf**(5). To use RSASSA-PSS
 405         signatures use _rsa/pss_ instead of _pubkey_ or _rsa_ as in e.g.
 406         _ike:rsa/pss-sha256_. If _pubkey_ or _rsa_ constraints are configured
 407         RSASSA-PSS signatures will only be used if enabled in
 408         **strongswan.conf**(5).
 409
 410 connections.<conn>.local<suffix>.id =
 411         IKE identity to use for authentication round.
 412
 413         IKE identity to use for authentication round. When using certificate
 414         authentication, the IKE identity must be contained in the certificate,
 415         either as subject or as subjectAltName.
 416
 417         The identity can be an IP address, a fully-qualified domain name, an email
 418         address or a Distinguished Name for which the ID type is determined
 419         automatically and the string is converted to the appropriate encoding. To
 420         enforce a specific identity type, a prefix may be used, followed by a colon
 421         (:). If the number sign (#) follows the colon, the remaining data is
 422         interpreted as hex encoding, otherwise the string is used as-is as the
 423         identification data. Note that this implies that no conversion is performed
 424         for non-string identities. For example, _ipv4:10.0.0.1_ does not create a
 425         valid ID_IPV4_ADDR IKE identity, as it does not get converted to binary
 426         0x0a000001. Instead, one could use _ipv4:#0a000001_ to get a valid identity,
 427         but just using the implicit type with automatic conversion is usually
 428         simpler. The same applies to the ASN1 encoded types. The following prefixes
 429         are known: _ipv4_, _ipv6_, _rfc822_, _email_, _userfqdn_, _fqdn_, _dns_,
 430         _asn1dn_, _asn1gn_ and _keyid_. Custom type prefixes may be specified by
 431         surrounding the numerical type value by curly brackets.
 432
 433 connections.<conn>.local<suffix>.eap_id = id
 434         Client EAP-Identity to use in EAP-Identity exchange and the EAP method.
 435
 436 connections.<conn>.local<suffix>.aaa_id = remote-id
 437         Server side EAP-Identity to expect in the EAP method.
 438
 439         Server side EAP-Identity to expect in the EAP method. Some EAP methods, such
 440         as EAP-TLS, use an identity for the server to perform mutual authentication.
 441         This identity may differ from the IKE identity, especially when EAP
 442         authentication is delegated from the IKE responder to an AAA backend.
 443
 444         For EAP-(T)TLS, this defines the identity for which the server must provide
 445         a certificate in the TLS exchange.
 446
 447 connections.<conn>.local<suffix>.xauth_id = id
 448         Client XAuth username used in the XAuth exchange.
 449
 450 connections.<conn>.remote<suffix> {}
 451         Section for a remote authentication round.
 452
 453         Section for a remote authentication round. A remote authentication round
 454         defines the constraints how the peers must authenticate to use this
 455         connection. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple
 456         Authentication or IKEv1 XAuth.
 457
 458         Each round is defined in a section having _remote_ as prefix, and an
 459         optional unique suffix. To define a single authentication round, the suffix
 460         may be omitted.
 461
 462 connections.<conn>.remote<suffix>.round = 0
 463         Optional numeric identifier by which authentication rounds are sorted.  If
 464         not specified rounds are ordered by their position in the config file/VICI
 465         message.
 466
 467 connections.<conn>.remote<suffix>.id = %any
 468         IKE identity to expect for authentication round.
 469
 470         IKE identity to expect for authentication round. Refer to the _local_ _id_
 471         section for details.
 472
 473 connections.<conn>.remote<suffix>.eap_id = id
 474         Identity to use as peer identity during EAP authentication.
 475
 476         Identity to use as peer identity during EAP authentication. If set to _%any_
 477         the EAP-Identity method will be used to ask the client for an identity.
 478
 479 connections.<conn>.remote<suffix>.groups =
 480         Authorization group memberships to require.
 481
 482         Comma separated authorization group memberships to require. The peer must
 483         prove membership to at least one of the specified groups. Group membership
 484         can be certified by different means, for example by appropriate Attribute
 485         Certificates or by an AAA backend involved in the authentication.
 486
 487 connections.<conn>.remote<suffix>.cert_policy =
 488         Certificate policy OIDs the peer's certificate must have.
 489
 490         Comma separated list of certificate policy OIDs the peer's certificate must
 491         have. OIDs are specified using the numerical dotted representation.
 492
 493 connections.<conn>.remote<suffix>.certs =
 494         Comma separated list of certificate to accept for authentication.
 495
 496         Comma separated list of certificates to accept for authentication.
 497         The certificates may use a relative path from the **swanctl** _x509_
 498         directory or an absolute path.
 499
 500 connections.<conn>.remote<suffix>.cert<suffix> =
 501         Section for a certificate to accept for authentication.
 502
 503         Section for a certificate to accept for authentication. Certificates
 504         in _certs_ are transmitted as binary blobs, these sections offer more
 505         flexibility.
 506
 507 connections.<conn>.remote<suffix>.cert<suffix>.file =
 508         Absolute path to the certificate to load.
 509
 510         Absolute path to the certificate to load. Passed as-is to the daemon, so it
 511         must be readable by it.
 512
 513         Configure either this or _handle_, but not both, in one section.
 514
 515 connections.<conn>.remote<suffix>.cert<suffix>.handle =
 516         Hex-encoded CKA_ID of the certificate on a token.
 517
 518         Hex-encoded CKA_ID of the certificate on a token.
 519
 520         Configure either this or _file_, but not both, in one section.
 521
 522 connections.<conn>.remote<suffix>.cert<suffix>.slot =
 523         Optional slot number of the token that stores the certificate.
 524
 525 connections.<conn>.remote<suffix>.cert<suffix>.module =
 526         Optional PKCS#11 module name.
 527
 528 connections.<conn>.remote<suffix>.cacerts =
 529         Comma separated list of CA certificates to accept for authentication.
 530
 531         Comma separated list of CA certificates to accept for authentication.
 532         The certificates may use a relative path from the **swanctl** _x509ca_
 533         directory or an absolute path.
 534
 535 connections.<conn>.remote<suffix>.cacert<suffix> =
 536         Section for a CA certificate to accept for authentication.
 537
 538         Section for a CA certificate to accept for authentication. Certificates
 539         in _cacerts_ are transmitted as binary blobs, these sections offer more
 540         flexibility.
 541
 542 connections.<conn>.remote<suffix>.cacert<suffix>.file =
 543         Absolute path to the certificate to load.
 544
 545         Absolute path to the certificate to load. Passed as-is to the daemon, so it
 546         must be readable by it.
 547
 548         Configure either this or _handle_, but not both, in one section.
 549
 550 connections.<conn>.remote<suffix>.cacert<suffix>.handle =
 551         Hex-encoded CKA_ID of the CA certificate on a token.
 552
 553         Hex-encoded CKA_ID of the CA certificate on a token.
 554
 555         Configure either this or _file_, but not both, in one section.
 556
 557 connections.<conn>.remote<suffix>.cacert<suffix>.slot =
 558         Optional slot number of the token that stores the CA certificate.
 559
 560 connections.<conn>.remote<suffix>.cacert<suffix>.module =
 561         Optional PKCS#11 module name.
 562
 563 connections.<conn>.remote<suffix>.pubkeys =
 564         Comma separated list of raw public keys to accept for authentication.
 565
 566         Comma separated list of raw public keys to accept for authentication.
 567         The public keys may use a relative path from the **swanctl** _pubkey_
 568         directory or an absolute path.
 569
 570 connections.<conn>.remote<suffix>.revocation = relaxed
 571         Certificate revocation policy, (_strict_, _ifuri_ or _relaxed_).
 572
 573         Certificate revocation policy for CRL or OCSP revocation.
 574
 575         A _strict_ revocation policy fails if no revocation information is
 576         available, i.e. the certificate is not known to be unrevoked.
 577
 578         _ifuri_ fails only if a CRL/OCSP URI is available, but certificate
 579         revocation checking fails, i.e. there should be revocation information
 580         available, but it could not be obtained.
 581
 582         The default revocation policy _relaxed_ fails only if a certificate
 583         is revoked, i.e. it is explicitly known that it is bad.
 584
 585 connections.<conn>.remote<suffix>.auth = pubkey
 586         Authentication to expect from remote (_pubkey_, _psk_, _xauth[-backend]_ or
 587         _eap[-method]_).
 588
 589         Authentication to expect from remote. See the **local** section's **auth**
 590         keyword description about the details of supported mechanisms.
 591
 592         To require a trustchain public key strength for the remote side, specify the
 593         key type followed by the minimum strength in bits (for example _ecdsa-384_
 594         or _rsa-2048-ecdsa-256_). To limit the acceptable set of hashing algorithms
 595         for trustchain validation, append hash algorithms to _pubkey_ or a key
 596         strength definition (for example _pubkey-sha256-sha512_,
 597         _rsa-2048-sha256-sha384-sha512_ or
 598         _rsa-2048-sha256-ecdsa-256-sha256-sha384_).
 599         Unless disabled in **strongswan.conf**(5), or explicit IKEv2 signature
 600         constraints are configured (refer to the description of the **local**
 601         section's **auth** keyword for details), such key types and hash algorithms
 602         are also applied as constraints against IKEv2 signature authentication
 603         schemes used by the remote side. To require RSASSA-PSS signatures use
 604         _rsa/pss_ instead of _pubkey_ or _rsa_ as in e.g. _rsa/pss-sha256_. If
 605         _pubkey_ or _rsa_ constraints are configured RSASSA-PSS signatures will only
 606         be accepted if enabled in **strongswan.conf**(5).
 607
 608         To specify trust chain constraints for EAP-(T)TLS, append a colon to the
 609         EAP method, followed by the key type/size and hash algorithm as discussed
 610         above (e.g. _eap-tls:ecdsa-384-sha384_).
 611
 612 connections.<conn>.children.<child> {}
 613         CHILD_SA configuration sub-section.
 614
 615         CHILD_SA configuration sub-section. Each connection definition may have
 616         one or more sections in its _children_ subsection. The section name
 617         defines the name of the CHILD_SA configuration, which must be unique within
 618         the connection.
 619
 620 connections.<conn>.children.<child>.ah_proposals =
 621         AH proposals to offer for the CHILD_SA.
 622
 623         AH proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
 624         For AH, this includes an integrity algorithm and an optional Diffie-Hellman
 625         group. If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
 626         negotiation uses a separate Diffie-Hellman exchange using the specified
 627         group (refer to _esp_proposals_ for details).
 628
 629         In IKEv2, multiple algorithms of the same kind can be specified in a single
 630         proposal, from which one gets selected. In IKEv1, only one algorithm per
 631         kind is allowed per proposal, more algorithms get implicitly stripped. Use
 632         multiple proposals to offer different algorithms combinations in IKEv1.
 633
 634         Algorithm keywords get separated using dashes. Multiple proposals may be
 635         separated by commas. The special value _default_ forms a default proposal
 636         of supported algorithms considered safe, and is usually a good choice
 637         for interoperability. By default no AH proposals are included, instead ESP
 638         is proposed.
 639
 640 connections.<conn>.children.<child>.esp_proposals = default
 641         ESP proposals to offer for the CHILD_SA.
 642
 643         ESP proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
 644         For ESP non-AEAD proposals, this includes an integrity algorithm, an
 645         encryption algorithm, an optional Diffie-Hellman group and an optional
 646         Extended Sequence Number Mode indicator. For AEAD proposals, a combined
 647         mode algorithm is used instead of the separate encryption/integrity
 648         algorithms.
 649
 650         If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
 651         negotiation use a separate Diffie-Hellman exchange using the specified
 652         group. However, for IKEv2, the keys of the CHILD_SA created implicitly with
 653         the IKE_SA will always be derived from the IKE_SA's key material. So any DH
 654         group specified here will only apply when the CHILD_SA is later rekeyed or
 655         is created with a separate CREATE_CHILD_SA exchange. A proposal mismatch
 656         might, therefore, not immediately be noticed when the SA is established, but
 657         may later cause rekeying to fail.
 658
 659         Extended Sequence Number support may be indicated with the _esn_ and _noesn_
 660         values, both may be included to indicate support for both modes. If omitted,
 661         _noesn_ is assumed.
 662
 663         In IKEv2, multiple algorithms of the same kind can be specified in a single
 664         proposal, from which one gets selected. In IKEv1, only one algorithm per
 665         kind is allowed per proposal, more algorithms get implicitly stripped. Use
 666         multiple proposals to offer different algorithms combinations in IKEv1.
 667
 668         Algorithm keywords get separated using dashes. Multiple proposals may be
 669         separated by commas. The special value _default_ forms a default proposal
 670         of supported algorithms considered safe, and is usually a good choice
 671         for interoperability. If no algorithms are specified for AH nor ESP,
 672         the _default_ set of algorithms for ESP is included.
 673
 674 connections.<conn>.children.<child>.sha256_96 = no
 675         Use incorrect 96-bit truncation for HMAC-SHA-256.
 676
 677         HMAC-SHA-256 is used with 128-bit truncation with IPsec. For compatibility
 678         with implementations that incorrectly use 96-bit truncation this option may
 679         be enabled to configure the shorter truncation length in the kernel.  This
 680         is not negotiated, so this only works with peers that use the incorrect
 681         truncation length (or have this option enabled).
 682
 683 connections.<conn>.children.<child>.local_ts = dynamic
 684         Local traffic selectors to include in CHILD_SA.
 685
 686         Comma separated list of local traffic selectors to include in CHILD_SA.
 687         Each selector is a CIDR subnet definition, followed by an optional
 688         proto/port selector. The special value _dynamic_ may be used instead of a
 689         subnet definition, which gets replaced by the tunnel outer address or the
 690         virtual IP, if negotiated. This is the default.
 691
 692         A protocol/port selector is surrounded by opening and closing square
 693         brackets. Between these brackets, a numeric or **getservent**(3) protocol
 694         name may be specified. After the optional protocol restriction, an optional
 695         port restriction may be specified, separated by a slash. The port
 696         restriction may be numeric, a **getservent**(3) service name, or the special
 697         value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
 698         as well, none of the kernel backends currently support port ranges, though.
 699
 700         When IKEv1 is used only the first selector is interpreted, except if
 701         the Cisco Unity extension plugin is used. This is due to a limitation of the
 702         IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA.
 703         So to tunnel traffic matched by several pairs of selectors when using IKEv1
 704         several children (CHILD_SAs) have to be defined that cover the selectors.
 705
 706         The IKE daemon uses traffic selector narrowing for IKEv1, the same way it is
 707         standardized and implemented for IKEv2. However, this may lead to problems
 708         with other implementations. To avoid that, configure identical selectors in
 709         such scenarios.
 710
 711 connections.<conn>.children.<child>.remote_ts = dynamic
 712         Remote selectors to include in CHILD_SA.
 713
 714         Comma separated list of remote selectors to include in CHILD_SA. See
 715         **local_ts** for a description of the selector syntax.
 716
 717 connections.<conn>.children.<child>.rekey_time = 1h
 718         Time to schedule CHILD_SA rekeying.
 719
 720         Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key
 721         material, optionally using a Diffie-Hellman exchange if a group is
 722         specified in the proposal.
 723
 724         To avoid rekey collisions initiated by both ends simultaneously, a value
 725         in the range of **rand_time** gets subtracted to form the effective soft
 726         lifetime.
 727
 728         By default CHILD_SA rekeying is scheduled every hour, minus **rand_time**.
 729
 730 connections.<conn>.children.<child>.life_time = rekey_time + 10%
 731         Maximum lifetime before CHILD_SA gets closed, as time.
 732
 733         Maximum lifetime before CHILD_SA gets closed. Usually this hard lifetime
 734         is never reached, because the CHILD_SA gets rekeyed before.
 735         If that fails for whatever reason, this limit closes the CHILD_SA.
 736
 737         The default is 10% more than the **rekey_time**.
 738
 739 connections.<conn>.children.<child>.rand_time = life_time - rekey_time
 740         Range of random time to subtract from **rekey_time**.
 741
 742         Time range from which to choose a random value to subtract from
 743         **rekey_time**. The default is the difference between **life_time** and
 744         **rekey_time**.
 745
 746 connections.<conn>.children.<child>.rekey_bytes = 0
 747         Number of bytes processed before initiating CHILD_SA rekeying.
 748
 749         Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA
 750         rekeying refreshes key material, optionally using a Diffie-Hellman exchange
 751         if a group is specified in the proposal.
 752
 753         To avoid rekey collisions initiated by both ends simultaneously, a value
 754         in the range of **rand_bytes** gets subtracted to form the effective soft
 755         volume limit.
 756
 757         Volume based CHILD_SA rekeying is disabled by default.
 758
 759 connections.<conn>.children.<child>.life_bytes = rekey_bytes + 10%
 760         Maximum bytes processed before CHILD_SA gets closed.
 761
 762         Maximum bytes processed before CHILD_SA gets closed. Usually this hard
 763         volume limit is never reached, because the CHILD_SA gets rekeyed before.
 764         If that fails for whatever reason, this limit closes the CHILD_SA.
 765
 766         The default is 10% more than **rekey_bytes**.
 767
 768 connections.<conn>.children.<child>.rand_bytes = life_bytes - rekey_bytes
 769         Range of random bytes to subtract from **rekey_bytes**.
 770
 771         Byte range from which to choose a random value to subtract from
 772         **rekey_bytes**. The default is the difference between **life_bytes** and
 773         **rekey_bytes**.
 774
 775 connections.<conn>.children.<child>.rekey_packets = 0
 776         Number of packets processed before initiating CHILD_SA rekeying.
 777
 778         Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA
 779         rekeying refreshes key material, optionally using a Diffie-Hellman exchange
 780         if a group is specified in the proposal.
 781
 782         To avoid rekey collisions initiated by both ends simultaneously, a value
 783         in the range of **rand_packets** gets subtracted to form the effective soft
 784         packet count limit.
 785
 786         Packet count based CHILD_SA rekeying is disabled by default.
 787
 788 connections.<conn>.children.<child>.life_packets = rekey_packets + 10%
 789         Maximum number of packets processed before CHILD_SA gets closed.
 790
 791         Maximum number of packets processed before CHILD_SA gets closed. Usually
 792         this hard packets limit is never reached, because the CHILD_SA gets rekeyed
 793         before. If that fails for whatever reason, this limit closes the CHILD_SA.
 794
 795         The default is 10% more than **rekey_bytes**.
 796
 797 connections.<conn>.children.<child>.rand_packets = life_packets - rekey_packets
 798         Range of random packets to subtract from **packets_bytes**.
 799
 800         Packet range from which to choose a random value to subtract from
 801         **rekey_packets**. The default is the difference between **life_packets**
 802         and **rekey_packets**.
 803
 804 connections.<conn>.children.<child>.updown =
 805         Updown script to invoke on CHILD_SA up and down events.
 806
 807 connections.<conn>.children.<child>.hostaccess = no
 808         Hostaccess variable to pass to **updown** script.
 809
 810 connections.<conn>.children.<child>.mode = tunnel
 811         IPsec Mode to establish (_tunnel_, _transport_, _transport_proxy_, _beet_,
 812         _pass_ or _drop_).
 813
 814         IPsec Mode to establish CHILD_SA with. _tunnel_ negotiates the CHILD_SA
 815         in IPsec Tunnel Mode, whereas _transport_ uses IPsec Transport Mode.
 816         _transport_proxy_ signifying the special Mobile IPv6 Transport Proxy Mode.
 817         _beet_ is the Bound End to End Tunnel mixture mode, working with fixed inner
 818         addresses without the need to include them in each packet.
 819
 820         Both _transport_ and _beet_ modes are subject to mode negotiation; _tunnel_
 821         mode is negotiated if the preferred mode is not available.
 822
 823         _pass_ and _drop_ are used to install shunt policies which explicitly
 824         bypass the defined traffic from IPsec processing or drop it, respectively.
 825
 826 connections.<conn>.children.<child>.policies = yes
 827         Whether to install IPsec policies or not.
 828
 829         Whether to install IPsec policies or not. Disabling this can be useful in
 830         some scenarios e.g. MIPv6, where policies are not managed by the IKE daemon.
 831
 832 connections.<conn>.children.<child>.policies_fwd_out = no
 833         Whether to install outbound FWD IPsec policies or not.
 834
 835         Whether to install outbound FWD IPsec policies or not. Enabling this is
 836         required in case there is a drop policy that would match and block forwarded
 837         traffic for this CHILD_SA.
 838
 839 connections.<conn>.children.<child>.dpd_action = clear
 840         Action to perform on DPD timeout (_clear_, _trap_ or _restart_).
 841
 842         Action to perform for this CHILD_SA on DPD timeout. The default _clear_
 843         closes the CHILD_SA and does not take further action. _trap_ installs
 844         a trap policy, which will catch matching traffic and tries to re-negotiate
 845         the tunnel on-demand. _restart_ immediately tries to re-negotiate the
 846         CHILD_SA under a fresh IKE_SA.
 847
 848 connections.<conn>.children.<child>.ipcomp = no
 849         Enable IPComp compression before encryption.
 850
 851         Enable IPComp compression before encryption. If enabled, IKE tries to
 852         negotiate IPComp compression to compress ESP payload data prior to
 853         encryption.
 854
 855 connections.<conn>.children.<child>.inactivity = 0s
 856         Timeout before closing CHILD_SA after inactivity.
 857
 858         Timeout before closing CHILD_SA after inactivity. If no traffic has
 859         been processed in either direction for the configured timeout, the CHILD_SA
 860         gets closed due to inactivity. The default value of _0_ disables inactivity
 861         checks.
 862
 863 connections.<conn>.children.<child>.reqid = 0
 864         Fixed reqid to use for this CHILD_SA.
 865
 866         Fixed reqid to use for this CHILD_SA. This might be helpful in some
 867         scenarios, but works only if each CHILD_SA configuration is instantiated
 868         not more than once. The default of _0_ uses dynamic reqids, allocated
 869         incrementally.
 870
 871 connections.<conn>.children.<child>.priority = 0
 872         Optional fixed priority for IPsec policies.
 873
 874         Optional fixed priority for IPsec policies. This could be useful to install
 875         high-priority drop policies.  The default of _0_ uses dynamically calculated
 876         priorities based on the size of the traffic selectors.
 877
 878 connections.<conn>.children.<child>.interface =
 879         Optional interface name to restrict IPsec policies.
 880
 881 connections.<conn>.children.<child>.mark_in = 0/0x00000000
 882         Netfilter mark and mask for input traffic.
 883
 884         Netfilter mark and mask for input traffic. On Linux, Netfilter may require
 885         marks on each packet to match an SA/policy having that option set. This
 886         allows installing duplicate policies and enables Netfilter rules to select
 887         specific SAs/policies for incoming traffic.  Note that inbound marks are
 888         only set on policies, by default, unless *mark_in_sa* is enabled. The
 889         special value _%unique_ sets a unique mark on each CHILD_SA instance, beyond
 890         that the value _%unique-dir_ assigns a different unique mark for each
 891         CHILD_SA direction (in/out).
 892
 893         An additional mask may be appended to the mark, separated by _/_. The
 894         default mask if omitted is 0xffffffff.
 895
 896 connections.<conn>.children.<child>.mark_in_sa = no
 897         Whether to set *mark_in* on the inbound SA.
 898
 899         Whether to set *mark_in* on the inbound SA. By default, the inbound mark is
 900         only set on the inbound policy. The tuple destination address, protocol and
 901         SPI is unique and the mark is not required to find the correct SA, allowing
 902         to mark traffic after decryption instead (where more specific selectors may
 903         be used) to match different policies. Marking packets before decryption is
 904         still possible, even if no mark is set on the SA.
 905
 906 connections.<conn>.children.<child>.mark_out = 0/0x00000000
 907         Netfilter mark and mask for output traffic.
 908
 909         Netfilter mark and mask for output traffic. On Linux, Netfilter may require
 910         marks on each packet to match a policy/SA having that option set. This
 911         allows installing duplicate policies and enables Netfilter rules to select
 912         specific policies/SAs for outgoing traffic. The special value _%unique_ sets
 913         a unique mark on each CHILD_SA instance, beyond that the value _%unique-dir_
 914         assigns a different unique mark for each CHILD_SA direction (in/out).
 915
 916         An additional mask may be appended to the mark, separated by _/_. The
 917         default mask if omitted is 0xffffffff.
 918
 919 connections.<conn>.children.<child>.set_mark_in = 0/0x00000000
 920         Netfilter mark applied to packets after the inbound IPsec SA processed them.
 921
 922         Netfilter mark applied to packets after the inbound IPsec SA processed them.
 923         This way it's not necessary to mark packets via Netfilter before decryption
 924         or right afterwards to match policies or process them differently (e.g. via
 925         policy routing).
 926
 927         An additional mask may be appended to the mark, separated by _/_. The
 928         default mask if omitted is 0xffffffff. The special value _%same_ uses
 929         the value (but not the mask) from **mark_in** as mark value, which can be
 930         fixed, _%unique_ or _%unique-dir_.
 931
 932         Setting marks in XFRM input requires Linux 4.19 or higher.
 933
 934 connections.<conn>.children.<child>.set_mark_out = 0/0x00000000
 935         Netfilter mark applied to packets after the outbound IPsec SA processed
 936         them.
 937
 938         Netfilter mark applied to packets after the outbound IPsec SA processed
 939         them. This allows processing ESP packets differently than the original
 940         traffic (e.g. via policy routing).
 941
 942         An additional mask may be appended to the mark, separated by _/_. The
 943         default mask if omitted is 0xffffffff. The special value _%same_ uses
 944         the value (but not the mask) from **mark_out** as mark value, which can be
 945         fixed, _%unique_ or _%unique-dir_.
 946
 947         Setting marks in XFRM output is supported since Linux 4.14. Setting a mask
 948         requires at least Linux 4.19.
 949
 950 connections.<conn>.children.<child>.tfc_padding = 0
 951         Traffic Flow Confidentiality padding.
 952
 953         Pads ESP packets with additional data to have a consistent ESP packet size
 954         for improved Traffic Flow Confidentiality. The padding defines the minimum
 955         size of all ESP packets sent.
 956
 957         The default value of 0 disables TFC padding, the special value _mtu_ adds
 958         TFC padding to create a packet size equal to the Path Maximum Transfer Unit.
 959
 960 connections.<conn>.children.<child>.replay_window = 32
 961         IPsec replay window to configure for this CHILD_SA.
 962
 963         IPsec replay window to configure for this CHILD_SA. Larger values than the
 964         default of 32 are supported using the Netlink backend only, a value of 0
 965         disables IPsec replay protection.
 966
 967 connections.<conn>.children.<child>.hw_offload = no
 968         Enable hardware offload for this CHILD_SA, if supported by the IPsec
 969         implementation.
 970
 971         Enable hardware offload for this CHILD_SA, if supported by the IPsec
 972         implementation. The value _yes_ enforces offloading and the installation
 973         will fail if it's not supported by either kernel or device.     The value _auto_
 974         enables offloading, if it's supported, but the installation does not fail
 975         otherwise.
 976
 977 connections.<conn>.children.<child>.copy_df = yes
 978         Whether to copy the DF bit to the outer IPv4 header in tunnel mode.
 979
 980         Whether to copy the DF bit to the outer IPv4 header in tunnel mode. This
 981         effectively disables Path MTU discovery (PMTUD).  Controlling this behavior
 982         is not supported by all kernel interfaces.
 983
 984 connections.<conn>.children.<child>.copy_ecn = yes
 985         Whether to copy the ECN header field to/from the outer IP header in tunnel
 986         mode.
 987
 988         Whether to copy the ECN (Explicit Congestion Notification) header field
 989         to/from the outer IP header in tunnel mode. Controlling this behavior is not
 990         supported by all kernel interfaces.
 991
 992 connections.<conn>.children.<child>.copy_dscp = out
 993         Whether to copy the DSCP header field to/from the outer IP header in tunnel
 994         mode.
 995
 996         Whether to copy the DSCP (Differentiated Services Field Codepoint) header
 997         field to/from the outer IP header in tunnel mode. The value _out_ only
 998         copies the field from the inner to the outer header, the value _in_ does the
 999         opposite and only copies the field from the outer to the inner header when
1000         decapsulating, the value _yes_ copies the field in both directions, and the
1001         value _no_ disables copying the field altogether.  Setting this to _yes_ or
1002         _in_ could allow an attacker to adversely affect other traffic at the
1003         receiver, which is why the default is _out_. Controlling this behavior is
1004         not supported by all kernel interfaces.
1005
1006 connections.<conn>.children.<child>.start_action = none
1007         Action to perform after loading the configuration (_none_, _trap_, _start_).
1008
1009         Action to perform after loading the configuration. The default of _none_
1010         loads the connection only, which then can be manually initiated or used as
1011         a responder configuration.
1012
1013         The value _trap_ installs a trap policy, which triggers the tunnel as soon
1014         as matching traffic has been detected. The value _start_ initiates
1015         the connection actively.
1016
1017         When unloading or replacing a CHILD_SA configuration having a
1018         **start_action** different from _none_, the inverse action is performed.
1019         Configurations with _start_ get closed, while such with _trap_ get
1020         uninstalled.
1021
1022 connections.<conn>.children.<child>.close_action = none
1023         Action to perform after a CHILD_SA gets closed (_none_, _trap_, _start_).
1024
1025         Action to perform after a CHILD_SA gets closed by the peer. The default of
1026         _none_ does not take any action, _trap_ installs a trap policy for the
1027         CHILD_SA. _start_ tries to re-create the CHILD_SA.
1028
1029         **close_action** does not provide any guarantee that the CHILD_SA is kept
1030         alive. It acts on explicit close messages only, but not on negotiation
1031         failures. Use trap policies to reliably re-create failed CHILD_SAs.
1032
1033 secrets { # }
1034         Section defining secrets for IKE/EAP/XAuth authentication and private
1035         key decryption.
1036
1037         Section defining secrets for IKE/EAP/XAuth authentication and private key
1038         decryption. The **secrets** section takes sub-sections having a specific
1039         prefix which defines the secret type.
1040
1041         It is not recommended to define any private key decryption passphrases,
1042         as then there is no real security benefit in having encrypted keys. Either
1043         store the key unencrypted or enter the keys manually when loading
1044         credentials.
1045
1046 secrets.eap<suffix> { # }
1047         EAP secret section for a specific secret.
1048
1049         EAP secret section for a specific secret. Each EAP secret is defined in
1050         a unique section having the _eap_ prefix. EAP secrets are used for XAuth
1051         authentication as well.
1052
1053 secrets.xauth<suffix> { # }
1054         XAuth secret section for a specific secret.
1055
1056         XAuth secret section for a specific secret. **xauth** is just an alias
1057         for **eap**, secrets under both section prefixes are used for both EAP and
1058         XAuth authentication.
1059
1060 secrets.eap<suffix>.secret =
1061         Value of the EAP/XAuth secret.
1062
1063         Value of the EAP/XAuth secret. It may either be an ASCII string, a hex
1064         encoded string if it has a _0x_ prefix or a Base64 encoded string if it
1065         has a _0s_ prefix in its value.
1066
1067 secrets.eap<suffix>.id<suffix> =
1068         Identity the EAP/XAuth secret belongs to.
1069
1070         Identity the EAP/XAuth secret belongs to. Multiple unique identities may
1071         be specified, each having an _id_ prefix, if a secret is shared between
1072         multiple users.
1073
1074 secrets.ntlm<suffix> { # }
1075         NTLM secret section for a specific secret.
1076
1077         NTLM secret section for a specific secret. Each NTLM secret is defined in
1078         a unique section having the _ntlm_ prefix. NTLM secrets may only be used for
1079         EAP-MSCHAPv2 authentication.
1080
1081 secrets.ntlm<suffix>.secret =
1082         Value of the NTLM secret.
1083
1084         Value of the NTLM secret, which is the NT Hash of the actual secret, that
1085         is, MD4(UTF-16LE(secret)). The resulting 16-byte value may either be given
1086         as a hex encoded string with a _0x_ prefix or as a Base64 encoded string
1087         with a _0s_ prefix.
1088
1089 secrets.ntlm<suffix>.id<suffix> =
1090         Identity the NTLM secret belongs to.
1091
1092         Identity the NTLM secret belongs to. Multiple unique identities may
1093         be specified, each having an _id_ prefix, if a secret is shared between
1094         multiple users.
1095
1096 secrets.ike<suffix> { # }
1097         IKE preshared secret section for a specific secret.
1098
1099         IKE preshared secret section for a specific secret. Each IKE PSK is defined
1100         in a unique section having the _ike_ prefix.
1101
1102 secrets.ike<suffix>.secret =
1103         Value of the IKE preshared secret.
1104
1105         Value of the IKE preshared secret. It may either be an ASCII string,
1106         a hex encoded string if it has a _0x_ prefix or a Base64 encoded string if
1107         it has a _0s_ prefix in its value.
1108
1109 secrets.ike<suffix>.id<suffix> =
1110         IKE identity the IKE preshared secret belongs to.
1111
1112         IKE identity the IKE preshared secret belongs to. Multiple unique identities
1113         may be specified, each having an _id_ prefix, if a secret is shared between
1114         multiple peers.
1115
1116 secrets.ppk<suffix> { # }
1117         Postquantum Preshared Key (PPK) section for a specific secret.
1118
1119         Postquantum Preshared Key (PPK) section for a specific secret. Each PPK is
1120         defined in a unique section having the _ppk_ prefix.
1121
1122 secrets.ppk<suffix>.secret =
1123         Value of the PPK.
1124
1125         Value of the PPK. It may either be an ASCII string,     a hex encoded string if
1126         it has a _0x_ prefix or a Base64 encoded string if it has a _0s_ prefix in
1127         its value. Should have at least 256 bits of entropy for 128-bit security.
1128
1129 secrets.ppk<suffix>.id<suffix> =
1130         PPK identity the PPK belongs to.
1131
1132         PPK identity the PPK belongs to. Multiple unique identities
1133         may be specified, each having an _id_ prefix, if a secret is shared between
1134         multiple peers.
1135
1136 secrets.private<suffix> { # }
1137         Private key decryption passphrase for a key in the _private_ folder.
1138
1139 secrets.private<suffix>.file =
1140         File name in the _private_ folder for which this passphrase should be used.
1141
1142 secrets.private<suffix>.secret
1143         Value of decryption passphrase for private key.
1144
1145 secrets.rsa<suffix> { # }
1146         Private key decryption passphrase for a key in the _rsa_ folder.
1147
1148 secrets.rsa<suffix>.file =
1149         File name in the _rsa_ folder for which this passphrase should be used.
1150
1151 secrets.rsa<suffix>.secret
1152         Value of decryption passphrase for RSA key.
1153
1154 secrets.ecdsa<suffix> { # }
1155         Private key decryption passphrase for a key in the _ecdsa_ folder.
1156
1157 secrets.ecdsa<suffix>.file =
1158         File name in the _ecdsa_ folder for which this passphrase should be used.
1159
1160 secrets.ecdsa<suffix>.secret
1161         Value of decryption passphrase for ECDSA key.
1162
1163 secrets.pkcs8<suffix> { # }
1164         Private key decryption passphrase for a key in the _pkcs8_ folder.
1165
1166 secrets.pkcs8<suffix>.file =
1167         File name in the _pkcs8_ folder for which this passphrase should be used.
1168
1169 secrets.pkcs8<suffix>.secret
1170         Value of decryption passphrase for PKCS#8 key.
1171
1172 secrets.pkcs12<suffix> { # }
1173         PKCS#12 decryption passphrase for a container in the _pkcs12_ folder.
1174
1175 secrets.pkcs12<suffix>.file =
1176         File name in the _pkcs12_ folder for which this passphrase should be used.
1177
1178 secrets.pkcs12<suffix>.secret
1179         Value of decryption passphrase for PKCS#12 container.
1180
1181 secrets.token<suffix> { # }
1182         Definition for a private key that's stored on a token/smartcard.
1183
1184 secrets.token<suffix>.handle =
1185         Hex-encoded CKA_ID of the private key on the token.
1186
1187 secrets.token<suffix>.slot =
1188         Optional slot number to access the token.
1189
1190 secrets.token<suffix>.module =
1191         Optional PKCS#11 module name to access the token.
1192
1193 secrets.token<suffix>.pin =
1194         Optional PIN required to access the key on the token. If none is provided
1195         the user is prompted during an interactive --load-creds call.
1196
1197 pools { # }
1198         Section defining named pools.
1199
1200         Section defining named pools. Named pools may be referenced by connections
1201         with the **pools** option to assign virtual IPs and other configuration
1202         attributes.
1203
1204 pools.<name> { # }
1205         Section defining a single pool with a unique name.
1206
1207 pools.<name>.addrs =
1208         Addresses allocated in pool.
1209
1210         Subnet or range defining addresses allocated in pool. Accepts a single CIDR
1211         subnet defining the pool to allocate addresses from or an address range
1212         (<from>-<to>).  Pools must be unique and non-overlapping.
1213
1214 pools.<name>.<attr> =
1215         Comma separated list of additional attributes from type <attr>.
1216
1217         Comma separated list of additional attributes of type **<attr>**. The
1218         attribute type may be one of _dns_, _nbns_, _dhcp_, _netmask_, _server_,
1219         _subnet_, _split_include_ and _split_exclude_ to define addresses or CIDR
1220         subnets for the corresponding attribute types. Alternatively, **<attr>** can
1221         be a numerical identifier, for which string attribute values are accepted
1222         as well.
1223
1224 authorities { # }
1225         Section defining attributes of certification authorities.
1226
1227 authorities.<name> { # }
1228         Section defining a certification authority with a unique name.
1229
1230 authorities.<name>.cacert =
1231         CA certificate belonging to the certification authority.
1232
1233         CA certificate belonging to the certification authority. The certificates
1234         may use a relative path from the **swanctl** _x509ca_ directory or an
1235         absolute path.
1236
1237         Configure one of _cacert_, _file_, or _handle_ per section.
1238
1239 authorities.<name>.file =
1240         Absolute path to the certificate to load.
1241
1242         Absolute path to the certificate to load. Passed as-is to the daemon, so it
1243         must be readable by it.
1244
1245         Configure one of _cacert_, _file_, or _handle_ per section.
1246
1247 authorities.<name>.handle =
1248         Hex-encoded CKA_ID of the CA certificate on a token.
1249
1250         Hex-encoded CKA_ID of the CA certificate on a token.
1251
1252         Configure one of _cacert_, _file_, or _handle_ per section.
1253
1254 authorities.<name>.slot =
1255         Optional slot number of the token that stores the CA certificate.
1256
1257 authorities.<name>.module =
1258         Optional PKCS#11 module name.
1259
1260 authorities.<name>.crl_uris =
1261         Comma-separated list of CRL distribution points.
1262
1263         Comma-separated list of CRL distribution points (ldap, http, or file URI).
1264
1265 authorities.<name>.ocsp_uris =
1266         Comma-separated list of OCSP URIs.
1267
1268 authorities.<name>.cert_uri_base =
1269         Defines the base URI for the Hash and URL feature supported by IKEv2.
1270
1271         Defines the base URI for the Hash and URL feature supported by IKEv2.
1272         Instead of exchanging complete certificates, IKEv2 allows one to send an
1273         URI that resolves to the DER encoded certificate. The certificate URIs are
1274         built by appending the SHA1 hash of the DER encoded certificates to this
1275         base URI.
1276
1277 include conf.d/*.conf
1278         Include config snippets