309 lines
12 KiB
Mathematica
309 lines
12 KiB
Mathematica
/* 01ike.cdf - IKE configuration file */
|
|
|
|
/*
|
|
* Copyright (c) 2006-2007 Wind River Systems, Inc.
|
|
*
|
|
* The right to copy, distribute or otherwise make use of this software
|
|
* may be licensed only pursuant to the terms of an applicable Wind River
|
|
* license agreement. No license to Wind River intellectual property rights
|
|
* is granted herein. All rights not licensed by Wind River are reserved
|
|
* by Wind River.
|
|
*/
|
|
|
|
/*
|
|
modification history
|
|
--------------------
|
|
01g,12may08,brg Removed IPIKE_ALLOW_DUPLICATE_SA. Its an internal
|
|
configuration variable.((WIND00108854))
|
|
01f,11oct07,jho Fixed bad IPIKE_NAT_PORT default value.
|
|
01e,19sep07,rme Added missing backslash
|
|
01d,07sep07,rme Replaced SELECTION_IPCOM_FS with SELECT_IPCOM_FS in INCLUDE_INTERNET_KEY_EXCHANGE
|
|
01c,06mar07,kch Added support for dynamic address, IPIKE_MAX_EXCHANGES and
|
|
IPIKE_ALLOW_DUPLICATE_SA configuration parameters
|
|
(WIND00089895).
|
|
01b,07feb07,tkf Add IPIKE dependency on SELECTION_IPCOM_FS.
|
|
01a,08jan07,kch Removed trailing ctrl-M characters.
|
|
*/
|
|
|
|
#ifdef _WRS_CONFIG_COMPONENT_IPIKE
|
|
|
|
Component INCLUDE_INTERNET_KEY_EXCHANGE
|
|
{
|
|
NAME Internet Key Exchange (IKE)
|
|
SYNOPSIS Dynamic keying for security association
|
|
CONFIGLETTES ipike_config.c
|
|
CFG_PARAMS IPIKE_SOCK_BUF_SIZE \
|
|
IPIKE_MAX_EXCHANGES \
|
|
IPIKE_PORT \
|
|
IPIKE_NAT_PORT \
|
|
IPIKE_NAT_KEEPALIVE \
|
|
IPIKE_LIVENESS_TIMER_RESOLUTION \
|
|
IPIKE_RESEND_DELAY \
|
|
IPIKE_CONFIG_FILE_NAME \
|
|
IPIKE_CONFIG_FILE_PATH \
|
|
IPIKE_NONCE_SIZE \
|
|
IPIKE_CREATE_DEFAULT_CONFIG_FILE \
|
|
IPIKE_FLUSH_STARTUP \
|
|
IPIKE_FLUSH_SHUTDOWN \
|
|
IPIKE_FLUSH_RECONFIGURE \
|
|
IPIKE_SOFT_TO_HARD_TIME \
|
|
IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4 \
|
|
IPIKE_DYNAMIC_ADDRESS_POOL_DNS4 \
|
|
IPIKE_DYNAMIC_ADDRESS_MODE \
|
|
IPIKE_DYNAMIC_ADDRESS_ANYFLOW \
|
|
IPIKE_DYNAMIC_ADDRESS_HOMEADDR \
|
|
IPIKE_REKEY_FUZZINESS \
|
|
IPIKE_USE_HASH_AND_URL \
|
|
IPIKE_HTTP_REQUEST_TIMEOUT \
|
|
IPIKE_HTTP_RESPONSE_BUF_SIZE \
|
|
IPIKE_MAX_IKE_SA_NUM \
|
|
IPIKE_MAX_IPSEC_SA_NUM \
|
|
IPIKE_MAX_MESSAGE_SIZE \
|
|
MODULES ipike.o
|
|
REQUIRES INCLUDE_IPNET_SOCKET INCLUDE_IPCRYPTO \
|
|
SELECT_IPCOM_FS INCLUDE_IP_SECURITY \
|
|
INCLUDE_IPCOM_USE_KEY_DB
|
|
}
|
|
|
|
Parameter IPIKE_SOCK_BUF_SIZE
|
|
{
|
|
NAME Socket buffer size
|
|
SYNOPSIS ISAKMP socket buffer size (in bytes), this is the largest ISAKMP message the IKE daemon can send and receive.
|
|
TYPE string
|
|
DEFAULT "10000"
|
|
}
|
|
|
|
Parameter IPIKE_MAX_EXCHANGES
|
|
{
|
|
NAME Maximum number of active exchanges
|
|
SYNOPSIS The maximum number of active exchanges, ISAKMP packets for new \
|
|
exchanges will be dropped when the maximum is reached. \
|
|
Set to 0 to allow infinite number of exchanges.
|
|
TYPE string
|
|
DEFAULT "32"
|
|
}
|
|
Parameter IPIKE_PORT
|
|
{
|
|
NAME IKE Port
|
|
SYNOPSIS Specifies the UDP port on which to listen for ISAKMP packets. Should be 500 in most cases.
|
|
TYPE string
|
|
DEFAULT "500"
|
|
}
|
|
|
|
Parameter IPIKE_NAT_PORT
|
|
{
|
|
NAME IKE NAT-T port
|
|
SYNOPSIS Specifies the UDP port on which to listen for ISAKMP NATTraversal packets. Must be 4500 to interoperate with other clients.
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_NAT_KEEPALIVE
|
|
{
|
|
NAME Time between NAT keepalive messages
|
|
SYNOPSIS Specifies the number of seconds between keep alive packets when NAT-Traversal is used.
|
|
TYPE string
|
|
DEFAULT "20"
|
|
}
|
|
|
|
Parameter IPIKE_RESEND_DELAY
|
|
{
|
|
NAME IKE message resend delay
|
|
SYNOPSIS The time (in seconds) the IKE daemon will wait before doing the \
|
|
first resend of a packet. IKE will wait two times this value between \
|
|
the first and second resend, three times the value until the \
|
|
third resend, etc.
|
|
TYPE string
|
|
DEFAULT "2"
|
|
}
|
|
|
|
Parameter IPIKE_LIVENESS_TIMER_RESOLUTION
|
|
{
|
|
NAME IKE liveness timer resolution
|
|
SYNOPSIS The time period (in seconds) in which the IKE daemon will traverse \
|
|
all IPsec SA entries and perform liveness check (any packets received). \
|
|
A lower value will allow faster detection of dead remote peers but use more \
|
|
CPU resources. A value of 0 will disable the timer and liveness checking.
|
|
TYPE string
|
|
DEFAULT "10"
|
|
}
|
|
|
|
Parameter IPIKE_CONFIG_FILE_NAME
|
|
{
|
|
NAME Name of the IKE config file
|
|
SYNOPSIS The name of the file that will be used to configure the IKE daemon on startup.
|
|
TYPE string
|
|
DEFAULT "ike.cfg"
|
|
}
|
|
|
|
Parameter IPIKE_CONFIG_FILE_PATH
|
|
{
|
|
NAME Path to the IKE config file
|
|
SYNOPSIS The path the IKE daemon will use to locate the configuration file.
|
|
TYPE string
|
|
DEFAULT "/ram/"
|
|
}
|
|
|
|
Parameter IPIKE_NONCE_SIZE
|
|
{
|
|
NAME Size of created nonces
|
|
SYNOPSIS The size (in bytes) of the nonce (random number) that the IKE \
|
|
daemon will generate during phase 1 exchange. Must be between \
|
|
8 and 256 (inclusive) bytes.
|
|
TYPE string
|
|
DEFAULT "64"
|
|
}
|
|
|
|
Parameter IPIKE_CREATE_DEFAULT_CONFIG_FILE
|
|
{
|
|
NAME Create IKE config file
|
|
SYNOPSIS IPIKE will create a default configuration file for acting as a \
|
|
responder using preshared secret if this variable is set to 1 \
|
|
and there is no configuration file with the name specified by \
|
|
ipike.filename present.
|
|
TYPE string
|
|
DEFAULT "1"
|
|
}
|
|
|
|
Parameter IPIKE_FLUSH_STARTUP
|
|
{
|
|
NAME Flush keys at startup
|
|
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys at startup.
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_FLUSH_SHUTDOWN
|
|
{
|
|
NAME Flush keys at shutdown
|
|
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys at shutdown.
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_FLUSH_RECONFIGURE
|
|
{
|
|
NAME Flush keys on reconfigure
|
|
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys when reconfigured.
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_SOFT_TO_HARD_TIME
|
|
{
|
|
NAME IPSec SA soft to hard time
|
|
SYNOPSIS The IPSec SA soft timeout expires this many seconds earlier than the hard timeout.
|
|
TYPE string
|
|
DEFAULT "300"
|
|
}
|
|
|
|
Parameter IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4
|
|
{
|
|
NAME Dynamic address pool network4
|
|
SYNOPSIS This string is used to specify ip network for IPv4 dynamic address pool (responder).
|
|
TYPE string
|
|
DEFAULT "10.1.111.1/24"
|
|
}
|
|
|
|
Parameter IPIKE_DYNAMIC_ADDRESS_POOL_DNS4
|
|
{
|
|
NAME Dynamic address pool dns4
|
|
SYNOPSIS This string is used to specify dns ip address for IPv4 dynamic address pool (responder).
|
|
TYPE string
|
|
DEFAULT "10.1.1.1"
|
|
}
|
|
|
|
Parameter IPIKE_DYNAMIC_ADDRESS_MODE
|
|
{
|
|
NAME Dynamic address mode
|
|
SYNOPSIS This string is used to specify dynamic address mode for IKE version 1 protocol (initiator).
|
|
TYPE string
|
|
DEFAULT "1"
|
|
}
|
|
|
|
Parameter IPIKE_DYNAMIC_ADDRESS_ANYFLOW
|
|
{
|
|
NAME Dynamic address anyflow
|
|
SYNOPSIS Set this flag to 1 to make the responder traffic selector match any address in case of dynamic addresses with IKEv2 (responder).
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_DYNAMIC_ADDRESS_HOMEADDR
|
|
{
|
|
NAME Dynamic address home address
|
|
SYNOPSIS Set this flag to 1 to add the initiator's dynamic address as a home address (initiator). \
|
|
The home address is the preferred source address.
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_REKEY_FUZZINESS
|
|
{
|
|
NAME IKE rekey fuzziness
|
|
SYNOPSIS The rekey fuzziness is used for avoiding situations where both IKE peers initiate a rekey exchange simultaneously. \
|
|
A value of 20 will delay the rekey timer with a random amount of time between 0 and 20 seconds. The rekey fuzziness applies on \
|
|
both IKE SA and IPsec SA rekey. A value of 0 disables the fuzziness.
|
|
TYPE string
|
|
DEFAULT "20"
|
|
}
|
|
|
|
Parameter IPIKE_USE_HASH_AND_URL
|
|
{
|
|
NAME Enable Hash and URL
|
|
SYNOPSIS The Hash and URL feature allows IKEv2 peers to send and receive a hash digest of a certificate followed by a URL \
|
|
pointing out the actual location of the certificate. This allows IKE messages to be small and IP fragmentation can be avoided \
|
|
since certificates are fetched using HTTP instead. The feature is disabled by default since there is a potential \
|
|
security risk of accepting a URL from an unauthenticated peer, set this flag to 1 to enable support for it.
|
|
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_HTTP_REQUEST_TIMEOUT
|
|
{
|
|
NAME IKE HTTP request timeout
|
|
SYNOPSIS The maximum number of seconds the IKE daemon will wait for an HTTP response.
|
|
|
|
TYPE string
|
|
DEFAULT "5"
|
|
}
|
|
|
|
Parameter IPIKE_HTTP_RESPONSE_BUF_SIZE
|
|
{
|
|
NAME IKE HTTP response buffer size
|
|
SYNOPSIS This value controls the largest possible HTTP response the IKE dameon can receive.
|
|
|
|
TYPE string
|
|
DEFAULT "4096"
|
|
}
|
|
|
|
Parameter IPIKE_MAX_IKE_SA_NUM
|
|
{
|
|
NAME Maximum number of IKE SAs
|
|
SYNOPSIS Specifies the maximum number of concurrent IKE SAs that can be established. \
|
|
Set to 0 to allow infinite number of IKE SAs.
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_MAX_IPSEC_SA_NUM
|
|
{
|
|
NAME Maximum number of IPsec SAs
|
|
SYNOPSIS Specifies the maximum number of concurrent IPsec SAs that can be established. \
|
|
Set to 0 to allow infinite number of IPsec SAs.
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
|
|
Parameter IPIKE_MAX_MESSAGE_SIZE
|
|
{
|
|
NAME Maximum size of an IKE message
|
|
SYNOPSIS Specifies the maximum size of an IKE message. This restriction will be applied \
|
|
on both outgoing and incoming IKE traffic.
|
|
Set to 0 to for unlimited size (limited by the maximum UDP packet size).
|
|
TYPE string
|
|
DEFAULT "0"
|
|
}
|
|
#endif
|