ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.conf.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.31 by root, Sat Jul 13 04:10:29 2013 UTC vs.
Revision 1.38 by root, Sat Nov 12 21:45:49 2016 UTC

… …
31values, but not within the variable names or values themselves. 31values, but not within the variable names or values themselves.
32 32
33All settings are applied "in order", that is, later settings of the same 33All settings are applied "in order", that is, later settings of the same
34variable overwrite earlier ones. 34variable overwrite earlier ones.
35 35
36The only exceptions to the above are the "on" and "include" directives: 36The only exceptions to the above are the following directives:
37 37
38=over 4 38=over 4
39
40=item node nodename
41
42Introduces a node section. The nodename is used to select the right
43configuration section and is the same string as is passed as an argument
44to the gvpe daemon.
45
46Multiple C<node> statements with the same node name are supported and will
47be merged together.
48
49=item global
50
51This statement switches back to the global section, which is mainly
52useful if you want to include a second config file, e..g for local
53customisations. To do that, simply include this at the very end of your
54config file:
55
56 global
57 include local.conf
39 58
40=item on nodename ... 59=item on nodename ...
41 60
42=item on !nodename ... 61=item on !nodename ...
43 62
… …
384gvpe traffic avoid that routing table, in effect routing normal traffic 403gvpe traffic avoid that routing table, in effect routing normal traffic
385via gvpe and gvpe traffic via the normal system routing tables: 404via gvpe and gvpe traffic via the normal system routing tables:
386 405
387 ip rule add not fwmark 1000 lookup 99 406 ip rule add not fwmark 1000 lookup 99
388 407
389=item node = nickname
390
391Not really a config setting but introduces a node section. The nickname is
392used to select the right configuration section and must be passed as an
393argument to the gvpe daemon.
394
395=item node-up = relative-or-absolute-path 408=item node-up = relative-or-absolute-path
396 409
397Sets a command (default: none) that should be called whenever a connection 410Sets a command (default: none) that should be called whenever a connection
398is established (even on rekeying operations). Note that node-up/down 411is established (even on rekeying operations). Note that node-up/down
399scripts will be run asynchronously, but execution is serialised, so there 412scripts will be run asynchronously, but execution is serialised, so there
… …
453Same as C<node-up>, but gets called whenever a connection is lost. 466Same as C<node-up>, but gets called whenever a connection is lost.
454 467
455=item pid-file = path 468=item pid-file = path
456 469
457The path to the pid file to check and create 470The path to the pid file to check and create
458(default: C<LOCALSTATEDIR/run/gvpe.pid>). 471(default: C<LOCALSTATEDIR/run/gvpe.pid>). The first C<%s> is replaced by
472the nodename - any other use of C<%> must be written as C<%%>.
459 473
460=item private-key = relative-path-to-key 474=item private-key = relative-path-to-key
461 475
462Sets the path (relative to the config directory) to the private key 476Sets the path (relative to the config directory) to the private key
463(default: C<hostkey>). This is a printf format string so every C<%> must 477(default: C<hostkey>). This is a printf format string so every C<%> must
464be doubled. A single C<%s> is replaced by the hostname, so you could 478be doubled. A single C<%s> is replaced by the hostname, so you could use
465use paths like C<hostkeys/%s> to fetch the files at the location where 479paths like C<hostkeys/%s> to be able to share the same config directory
466C<gvpectrl> puts them. 480between nodes.
467 481
468Since only the private key file of the current node is used and the 482Since only the private key file of the current node is used and the
469private key file should be kept secret per-node to avoid spoofing, it is 483private key file should be kept secret per-node to avoid spoofing, it is
470not recommended to use this feature. 484not recommended to use this feature this way though.
471 485
472=item rekey = seconds 486=item rekey = seconds
473 487
474Sets the rekeying interval in seconds (default: C<3607>). Connections are 488Sets the rekeying interval in seconds (default: C<3607>). Connections are
475reestablished every C<rekey> seconds, making them use a new encryption 489reestablished every C<rekey> seconds, making them use a new encryption
… …
489 503
490=item seed-interval = seconds 504=item seed-interval = seconds
491 505
492The number of seconds between reseeds of the random number generator 506The number of seconds between reseeds of the random number generator
493(default: C<3613>). A value of C<0> disables this regular reseeding. 507(default: C<3613>). A value of C<0> disables this regular reseeding.
508
509=item serial = string
510
511The configuration serial number. This can be any string up to 16 bytes
512length. Only when the serial matches on both sides of a connection will
513the connection succeed. This is I<not> a security mechanism and eay to
514spoof, this mechanism exists to alert users that their config is outdated.
515
516It's recommended to specify this is a date string such as C<2013-05-05> or
517C<20121205084417>.
518
519The exact algorithm is as this: if a connection request is received form a
520node with an identical serial, then it succeeds normally.
521
522If the remote serial is lower than the local serial, it is ignored.
523
524If the remote serial is higher than the local serial, a warning message is
525logged.
494 526
495=back 527=back
496 528
497=head2 NODE SPECIFIC SETTINGS 529=head2 NODE SPECIFIC SETTINGS
498 530
… …
647Whether to inherit the TOS settings of packets sent to the tunnel when 679Whether to inherit the TOS settings of packets sent to the tunnel when
648sending packets to this node (default: C<yes>). If set to C<yes> then 680sending packets to this node (default: C<yes>). If set to C<yes> then
649outgoing tunnel packets will have the same TOS setting as the packets sent 681outgoing tunnel packets will have the same TOS setting as the packets sent
650to the tunnel device, which is usually what you want. 682to the tunnel device, which is usually what you want.
651 683
684=item low-power = yes|true|on | no|false|off
685
686If true, designates a node as a low-power node. Low-power nodes use
687larger timeouts and try to reduce cpu time. Other nodes talking to a
688low-power node will also use larger timeouts, and will use less aggressive
689optimisations, in the hope of reducing load. Security is not compromised.
690
691The typical low-power node would be a mobile phone, where wakeups and
692encryption can significantly increase power drain.
693
652=item max-retry = positive-number 694=item max-retry = positive-number
653 695
654The maximum interval in seconds (default: C<3600>, one hour) between 696The maximum interval in seconds (default: C<3600>, one hour) between
655retries to establish a connection to this node. When a connection cannot 697retries to establish a connection to this node. When a connection cannot
656be established, gvpe uses exponential back-off capped at this value. It's 698be established, gvpe uses exponential back-off capped at this value. It's
… …
729 771
730If used the node up or node-down scripts. 772If used the node up or node-down scripts.
731 773
732=item hostkey 774=item hostkey
733 775
734The private key (taken from C<hostkeys/nodename>) of the current host. 776The (default path of the) private key of the current host.
735 777
736=item pubkey/nodename 778=item pubkey/nodename
737 779
738The public keys of the other nodes, one file per node. 780The public keys of the other nodes, one file per node.
739 781

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines