[ViewVC] Diff of: cvs/gvpe/doc/gvpe.conf.5.pod

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.28 by root, Sun Mar 6 19:40:27 2011 UTC vs.
Revision 1.35 by root, Fri Oct 11 07:56:07 2013 UTC

 values, but not within the variable names or values themselves.
 All settings are applied "in order", that is, later settings of the same
 variable overwrite earlier ones.
-The only exceptions to the above are the "on" and "include" directives:
+The only exceptions to the above are the following directives:
 =over 4
+=item node nodename
+Introduces a node section. The nodename is used to select the right
+configuration section and is the same string as is passed as an argument
+to the gvpe daemon.
+Multiple C<node> statements with the same node name are supported and will
+be merged together.
+=item global
+This statement switches back to the global section, which is mainly
+useful if you want to include a second config file, e..g for local
+customisations. To do that, simply include this at the very end of your
+config file:
+   global
+   include local.conf
 =item on nodename ...
 =item on !nodename ...
 is, they are in some sense node-specific (config files can set different
 values on different nodes using C<on>), but will affect the behaviour of
 the gvpe daemon and all connections it creates.
 =over 4
+=item chroot = path or /
+Tells GVPE to chroot(2) to the specified path after reading all necessary
+files, binding to sockets and running the C<if-up> script, but before
+running C<node-up> or any other scripts.
+The special path F</> instructs GVPE to create (and remove) an empty
+temporary directory to use as new root. This is most secure, but makes it
+impossible to use any scripts other than the C<if-up> one.
+=item chuid = numerical-uid
+=item chgid = numerical-gid
+These two options tell GVPE to change to the given user and/or group id
+after reading all necessary files, binding to sockets and running the
+C<if-up> script.
+Other scripts, such as C<node-up>, are run with the new user id or group id.
+=item chuser = username
+Alternative to C<chuid> and C<chgid>: Sets both C<chuid> and C<chgid>
+to the user and (primary) group ids of the specified user (for example,
+C<nobody>).
 =item dns-forw-host = hostname/ip
 The DNS server to forward DNS requests to for the DNS tunnel protocol
 (default: C<127.0.0.1>, changing it is highly recommended).
 =item keepalive = seconds
 Sets the keepalive probe interval in seconds (default: C<60>). After this
 many seconds of inactivity the daemon will start to send keepalive probe
-every 3 seconds until it receives a reply from the other end.  If no reply
+every 3 seconds until it receives a reply from the other end. If no reply
 is received within 15 seconds, the peer is considered unreachable and the
 connection is closed.
 =item loglevel = noise|trace|debug|info|notice|warn|error|critical
 Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp).
 This value must be the minimum of the MTU values of all nodes.
-=item node = nickname
+=item nfmark = integer
-Not really a config setting but introduces a node section. The nickname is
+This advanced option, when set to a nonzero value (default: C<0>), tries
-used to select the right configuration section and must be passed as an
+to set the netfilter mark (or fwmark) value on all sockets gvpe uses to
-argument to the gvpe daemon.
+send packets.
+This can be used to make gvpe use a different set of routing rules. For
+example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
+put all routing rules into table C<99> and then use an ip rule to make
+gvpe traffic avoid that routing table, in effect routing normal traffic
+via gvpe and gvpe traffic via the normal system routing tables:
+   ip rule add not fwmark 1000 lookup 99
 =item node-up = relative-or-absolute-path
 Sets a command (default: none) that should be called whenever a connection
 is established (even on rekeying operations). Note that node-up/down
    #!/bin/sh
    {
      echo update delete $DESTNODE.lowttl.example.net. a
      echo update add $DESTNODE.lowttl.example.net. 1 in a $DESTIP
      echo
    } | nsupdate -d -k $CONFBASE:key.example.net.
 =item node-change = relative-or-absolute-path
 Same as C<node-change>, but gets called whenever something about a
 Same as C<node-up>, but gets called whenever a connection is lost.
 =item pid-file = path
 The path to the pid file to check and create
-(default: C<LOCALSTATEDIR/run/gvpe.pid>).
+(default: C<LOCALSTATEDIR/run/gvpe.pid>). The first C<%s> is replaced by
+the nodename - any other use of C<%> must be written as C<%%>.
 =item private-key = relative-path-to-key
 Sets the path (relative to the config directory) to the private key
 (default: C<hostkey>). This is a printf format string so every C<%> must
 private key file should be kept secret per-node to avoid spoofing, it is
 not recommended to use this feature.
 =item rekey = seconds
-Sets the rekeying interval in seconds (default: C<3600>). Connections are
+Sets the rekeying interval in seconds (default: C<3607>). Connections are
 reestablished every C<rekey> seconds, making them use a new encryption
 key.
-=item nfmark = integer
+=item seed-device = path
-This advanced option, when set to a nonzero value (default: C<0>), tries
+The random device used to initially and regularly seed the random
-to set the netfilter mark (or fwmark) value on all sockets gvpe uses to
+number generator (default: F</dev/urandom>). Randomness is of paramount
-send packets.
+importance to the security of the algorithms used in gvpe.
-This can be used to make gvpe use a different set of routing rules. For
+On program start and every seed-interval, gvpe will read 64 octets.
-example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
-put all routing rules into table C<99> and then use an ip rule to make
-gvpe traffic avoid that routing table, in effect routing normal traffic
-via gvpe and gvpe traffic via the normal system routing tables:
-   ip rule add not fwmark 1000 lookup 99
+Setting this path to the empty string will disable this functionality
+completely (the underlying crypto library will likely look for entropy
+sources on it's own though, so not all is lost).
+=item seed-interval = seconds
+The number of seconds between reseeds of the random number generator
+(default: C<3613>). A value of C<0> disables this regular reseeding.
+=item serial = string
+The configuration serial number. This can be any string up to 16 bytes
+length. Only when the serial matches on both sides of a conenction will
+the connection succeed. This is I<not> a security mechanism and eay to
+spoof, this mechanism exists to alert users that their config is outdated.
+It's recommended to specify this is a date string such as C<2013-05-05> or
+C<20121205084417).
+The exact algorithm is as this: if a connection request is received form a
+node with an identical serial, then it succeeds normally.
+If the remote serial is lower than the local serial, it is ignored.
+If the remote serial is higher than the local serial, a warning message is
+logged.
 =back
 =head2 NODE SPECIFIC SETTINGS
 Whether to inherit the TOS settings of packets sent to the tunnel when
 sending packets to this node (default: C<yes>). If set to C<yes> then
 outgoing tunnel packets will have the same TOS setting as the packets sent
 to the tunnel device, which is usually what you want.
+=item low-power = yes|true|on | no|false|off
+If true, designates a node as a low-power node. Low-power nodes use
+larger timeouts and try to reduce cpu time. Other nodes talking to a
+low-power node will also use larger timeouts, and will use less aggressive
+optimisations, in the hope of reducing load. Security is not compromised.
+The typical low-power node would be a mobile phone, where wakeups and
+encryption can significantly increase power drain.
 =item max-retry = positive-number
 The maximum interval in seconds (default: C<3600>, one hour) between
 retries to establish a connection to this node. When a connection cannot
 be established, gvpe uses exponential back-off capped at this value. It's
 If used the node up or node-down scripts.
 =item hostkey
-The private key (taken from C<hostkeys/nodename>) of the current host.
+The (default path of the) private key of the current host.
 =item pubkey/nodename
 The public keys of the other nodes, one file per node.

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/doc/gvpe.conf.5.pod (file contents): Revision 1.28 by root, Sun Mar 6 19:40:27 2011 UTC vs. Revision 1.35 by root, Fri Oct 11 07:56:07 2013 UTC

Diff Legend

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.28 by root, Sun Mar 6 19:40:27 2011 UTC vs.
Revision 1.35 by root, Fri Oct 11 07:56:07 2013 UTC