summaryrefslogtreecommitdiff
path: root/conf/options
diff options
context:
space:
mode:
authorYves-Alexis Perez <corsac@debian.org>2016-10-20 16:18:38 +0200
committerYves-Alexis Perez <corsac@debian.org>2016-10-20 16:18:38 +0200
commit25663e04c3ab01ef8dc9f906608282319cfea2db (patch)
treea0ca5e70f66d74dbe552c996a4f3a285cdfc35e4 /conf/options
parentbf372706c469764d59e9f29c39e3ecbebd72b8d2 (diff)
downloadvyos-strongswan-25663e04c3ab01ef8dc9f906608282319cfea2db.tar.gz
vyos-strongswan-25663e04c3ab01ef8dc9f906608282319cfea2db.zip
New upstream version 5.5.1
Diffstat (limited to 'conf/options')
-rw-r--r--conf/options/aikpub2.conf7
-rw-r--r--conf/options/aikpub2.opt2
-rw-r--r--conf/options/charon-nm.conf8
-rw-r--r--conf/options/charon-nm.opt3
-rw-r--r--conf/options/charon.conf15
-rw-r--r--conf/options/charon.opt15
6 files changed, 42 insertions, 8 deletions
diff --git a/conf/options/aikpub2.conf b/conf/options/aikpub2.conf
new file mode 100644
index 000000000..fd48f2c7a
--- /dev/null
+++ b/conf/options/aikpub2.conf
@@ -0,0 +1,7 @@
+aikpub2 {
+
+ # Plugins to load in aikpub2 tool.
+ # load =
+
+}
+
diff --git a/conf/options/aikpub2.opt b/conf/options/aikpub2.opt
new file mode 100644
index 000000000..6a755d211
--- /dev/null
+++ b/conf/options/aikpub2.opt
@@ -0,0 +1,2 @@
+aikpub2.load =
+ Plugins to load in aikpub2 tool.
diff --git a/conf/options/charon-nm.conf b/conf/options/charon-nm.conf
new file mode 100644
index 000000000..85d64480d
--- /dev/null
+++ b/conf/options/charon-nm.conf
@@ -0,0 +1,8 @@
+charon-nm {
+
+ # Directory from which to load CA certificates if no certificate is
+ # configured.
+ # ca_dir = <default>
+
+}
+
diff --git a/conf/options/charon-nm.opt b/conf/options/charon-nm.opt
new file mode 100644
index 000000000..6372934bd
--- /dev/null
+++ b/conf/options/charon-nm.opt
@@ -0,0 +1,3 @@
+charon-nm.ca_dir = <default>
+ Directory from which to load CA certificates if no certificate is
+ configured.
diff --git a/conf/options/charon.conf b/conf/options/charon.conf
index 78411250e..f72041e6a 100644
--- a/conf/options/charon.conf
+++ b/conf/options/charon.conf
@@ -7,6 +7,12 @@ charon {
# Maximum number of half-open IKE_SAs for a single peer IP.
# block_threshold = 5
+ # Whether Certicate Revocation Lists (CRLs) fetched via HTTP or LDAP should
+ # be saved under a unique file name derived from the public key of the
+ # Certification Authority (CA) to /etc/ipsec.d/crls (stroke) or
+ # /etc/swanctl/x509crl (vici), respectively.
+ # cache_crls = no
+
# Whether relations in validated certificate chains should be cached in
# memory.
# cert_cache = yes
@@ -51,10 +57,11 @@ charon {
# follow_redirects = yes
# Maximum size (complete IP datagram size in bytes) of a sent IKE fragment
- # when using proprietary IKEv1 or standardized IKEv2 fragmentation (0 for
- # address family specific default values). If specified this limit is
- # used for both IPv4 and IPv6.
- # fragment_size = 0
+ # when using proprietary IKEv1 or standardized IKEv2 fragmentation, defaults
+ # to 1280 (use 0 for address family specific default values, which uses a
+ # lower value for IPv4). If specified this limit is used for both IPv4 and
+ # IPv6.
+ # fragment_size = 1280
# Name of the group the daemon changes to after startup.
# group =
diff --git a/conf/options/charon.opt b/conf/options/charon.opt
index 3970012d2..6e0b37c57 100644
--- a/conf/options/charon.opt
+++ b/conf/options/charon.opt
@@ -30,6 +30,12 @@ charon.cert_cache = yes
Whether relations in validated certificate chains should be cached in
memory.
+charon.cache_crls = no
+ Whether Certicate Revocation Lists (CRLs) fetched via HTTP or LDAP should
+ be saved under a unique file name derived from the public key of the
+ Certification Authority (CA) to **/etc/ipsec.d/crls** (stroke) or
+ **/etc/swanctl/x509crl** (vici), respectively.
+
charon.cisco_unity = no
Send Cisco Unity vendor ID payload (IKEv1 only).
@@ -100,11 +106,12 @@ charon.flush_auth_cfg = no
charon.follow_redirects = yes
Whether to follow IKEv2 redirects (RFC 5685).
-charon.fragment_size = 0
+charon.fragment_size = 1280
Maximum size (complete IP datagram size in bytes) of a sent IKE fragment
- when using proprietary IKEv1 or standardized IKEv2 fragmentation (0 for
- address family specific default values). If specified this limit is used
- for both IPv4 and IPv6.
+ when using proprietary IKEv1 or standardized IKEv2 fragmentation, defaults
+ to 1280 (use 0 for address family specific default values, which uses a
+ lower value for IPv4). If specified this limit is used for both IPv4 and
+ IPv6.
charon.group
Name of the group the daemon changes to after startup.