strongswan

This module allows to manage strongswan on Debian via swanctl / VICI, route-based or otherwise.

Table of Contents

1. Setup
2. Usage
3. Limitations
4. Development

Setup

Besides installing the module, no special setup steps are necessary.

Usage

strongswan supplies parameters which are directly mapped to the according blocks in strongswan.conf and swanctl.conf. Therefore, it is recommended to use it via include and put the config into hiera. The keys are named as in strongswan, except that - is replaced by _. Hashes are mapped to blocks. Key/value pairs are mapped to key = value with the exception of include as key. In this case, the = is omitted.

Special Values

There are a few values which are not passed through to the config files:

• strongswan::route_based: If set to true, XFRM interfaces are added for each interface ID occuring in the config.
• strongswan::connections/<connection>/base_interface sets the base interface for an XFRM device.
• strongswan::connections/<connection>/if_id is copied into if_id_in and if_id_out.

Example

strongswan::charon:
  load_modular: yes
    plugins:
        include: strongswan.d/charon/*.conf

yields this strongswan.conf

charon {
    load_modular = true
    plugins {
        include strongswan.d/charon/*.conf
    }
}

Limitations

This module was only tested on Debian and uses /etc/network/interfaces (i.e. no networkd etc.) for route based VPNs.

Development

The repo is located at https://software.service.zit-rlp.de/puppet/strongswan.

Reference

Table of Contents

Classes

• strongswan: Manage strongswan service via vici/swanctl.

Defined types

• strongswan::xfrm: Create interface file for xfrm device.

Functions

• strongswan::extract_xfrm_devices_from_connections: Build strongswan::xfrm resource hashes from connections. Get if_id(_in/_out) from each connection. For each if_id, create one xfrm resrouces.
• strongswan::hash_to_strongswan_config

Classes

strongswan

Besides ensuring that strongswan-swantcl is installed active and the stroke-based service is disabled, this module writes strongswan.conf and swanctl.conf. If route based is enabled, xfrm interfaces are also managed.

Examples

include strongswan

Parameters

The following parameters are available in the strongswan class:

• aikgen
• attest
• charon
• charon_mm
• charon_systemd
• imv_policy_manager
• libimcs
• libtls
• libtnccs
• manager
• medcli
• medsrv
• pki
• pool
• pt_tls_client
• sec_updater
• sw_collector
• starter
• swanctl
• authorities
• connections
• secrets
• pools
• route_based
• xfrm_default_base_interface

aikgen

Data type: Hash

aikgen block in strongswan.conf.

Default value: {}

attest

Data type: Hash

attest block in strongswan.conf.

Default value: {}

charon

Data type: Hash

charon block in strongswan.conf.

Default value: {}

charon_mm

Data type: Hash

charon-mm block in strongswan.conf.

Default value: {}

charon_systemd

Data type: Hash

charon-systemd block in strongswan.conf.

Default value: {}

imv_policy_manager

Data type: Hash

imv_policy_manager block in strongswan.conf.

Default value: {}

libimcs

Data type: Hash

libimcs block in strongswan.conf.

Default value: {}

libtls

Data type: Hash

libtls block in strongswan.conf.

Default value: {}

libtnccs

Data type: Hash

libtnccs block in strongswan.conf.

Default value: {}

manager

Data type: Hash

manager block in strongswan.conf.

Default value: {}

medcli

Data type: Hash

medcli block in strongswan.conf.

Default value: {}

medsrv

Data type: Hash

medsrv block in strongswan.conf.

Default value: {}

pki

Data type: Hash

pki block in strongswan.conf.

Default value: {}

pool

Data type: Hash

pool block in strongswan.conf.

Default value: {}

pt_tls_client

Data type: Hash

pt-tls-client block in strongswan.conf.

Default value: {}

sec_updater

Data type: Hash

sec-updater block in strongswan.conf.

Default value: {}

sw_collector

Data type: Hash

sw-collector block in strongswan.conf.

Default value: {}

starter

Data type: Hash

starter block in strongswan.conf.

Default value: {}

swanctl

Data type: Hash

swanctl block in strongswan.conf.

Default value: {}

authorities

Data type: Hash

authorities block in swanctl.conf.

Default value: {}

connections

Data type: Hash

connections block in swanctl.conf. Besides keys allowed in swanctl, these ones are added:

• base_interface: base interface for xfrm device.
• if_id: interface ID for xfrm device used for in and out. In swanctl.conf, this value is used for id_id_in and if_id_out.

Default value: {}

secrets

Data type: Hash

secrets block in swanctl.conf.

Default value: {}

pools

Data type: Hash

pools block in swanctl.conf.

Default value: {}

route_based

Data type: Boolean

Whether route based VPN is configured.

Default value: false

xfrm_default_base_interface

Data type: String

XRFM base interface used if none is specified in connection.

Default value: 'lo'

Defined types

strongswan::xfrm

Create interface file for xfrm device.

Parameters

The following parameters are available in the strongswan::xfrm defined type:

• base_interface
• routes
• interface_id

base_interface

Data type: String

Interface used as PHYS_DEV for xfrm interface.

routes

Data type: Array

Array of networks which are routed onto the xfrm interface.

interface_id

Data type: Integer

IF_ID of the interface (required to match IPSec policy).

Functions

strongswan::extract_xfrm_devices_from_connections

Type: Ruby 4.x API

Build strongswan::xfrm resource hashes from connections. Get if_id(_in/_out) from each connection. For each if_id, create one xfrm resrouces. Add routes for all children on out interfaces

strongswan::extract_xfrm_devices_from_connections(Hash $connections, String $default_base_interface)

Build strongswan::xfrm resource hashes from connections. Get if_id(_in/_out) from each connection. For each if_id, create one xfrm resrouces. Add routes for all children on out interfaces

Returns: Any

connections

Data type: Hash

default_base_interface

Data type: String

strongswan::hash_to_strongswan_config

Type: Ruby 4.x API

The strongswan::hash_to_strongswan_config function.

strongswan::hash_to_strongswan_config(Hash $data)

The strongswan::hash_to_strongswan_config function.

Returns: Any

data

Data type: Hash

Changelog

Release 0.1.0

• Initial release.