tcp-proxy.cfg — format of tcp-proxy program configuration file
General syntax rules of Kernun Firewall configuration files are described in configuration(7). This man page describes types, sections and items specific for the tcp-proxy.cfg configuration file.
Repeatable sections/items are marked by
the '*' before section/item name.
Configuration directives have attributes of several value-types. For the basic types description, see configuration(7).
Enumeration is a list of words (names) representing integer values. Some enumerations accept both names and direct integer values; in this case, enumeration description contains values for every name (in parenthesis next to name). For other enumerations, using of names is obligatory.
The following enumerations are used in tcp-proxy.cfg configuration directives:
enabling (see common(5))yes-no (see common(5))direction (see common(5))ip-version (see common(5))osi4-proto (see common(5))time-cond (see common(5))zip-mode (see common(5))obligation (see common(5))inline-file-format (see common(5))dbglev (see log(5))logfail-mode (see log(5))week-day (see time(5))month (see time(5))lock-type (see ipc(5))radius-attr (see radius(5))ldap-tls-reqcert-mode (see ldap(5))ldap-search-scope (see ldap(5))ldap-group-match (see ldap(5))auth-method (see auth(5))oob-authentication-method (see auth(5))bandwidth-mode (see pf-queue(5))pf-sc-setting (see pf-queue(5))source-address-mode (see source-address(5))transparency (see acl(5))user-auth-spec (see acl(5))doctype-ident-method (see acl(5))lagg-protocol (see interface(5))listen-on-sock (see listen-on(5))log-in-vain-proto (see sysctl(5))blackhole-proto (see sysctl(5))ssl-ver (see ssl(5))extension-op (see ssl(5))veri-fail-action (see ssl(5))auth-cert-type (see ssl(5))distrusted-cert-type (see ssl(5))data-match-action (see mod-match(5))Program tcp-proxy recognizes following items and sections:
* data-match name { ... }
* fake-cert name { ... }
* interface name { ... }
* ldap-client-auth name { ... }
* oob-auth name { ... }
* pf-queue name { ... }
* radius-client name { ... }
* resolver name { ... }
* shared-dir name { ... }
* shared-file name { ... }
* ssl-params name { ... }
sysctl { ... }
use-resolver ... ;
* tcp-proxy name { ... }
ipv6-mode ... ;
data-match name {
max-size ... ;
init-match ... ;
max-match ... ;
step-size ... ;
step-match ... ;
* test ... ;
}
data-match section is derived from
data-match section prototype.
For detail description of it, see mod-match(5).
fake-cert name {
key ... ;
auth-ca ... ;
fail-ca ... ;
* extension ... ;
purge ... ;
}
fake-cert section is derived from
fake-cert section prototype.
For detail description of it, see ssl(5).
interface name {
dev ... ;
ipv4 ... ;
ipv6 ... ;
mac ... ;
aggregate ... ;
pike ... ;
vlan ... ;
tunnel ... ;
dhcp-client ... ;
ipv6-rtadv { ... }
* alias name { ... }
* tag ... ;
}
interface section is derived from
interface section prototype.
For detail description of it, see interface(5).
ldap-client-auth name {
server ... ;
ssl { ... }
bindinfo ... ;
kerberos ... ;
users ... ;
groups ... ;
active-directory ... ;
}
ldap-client-auth section is derived from
ldap-client-auth section prototype.
For detail description of it, see ldap(5).
oob-auth name {
method ... ;
max-sessions ... ;
max-user ... ;
max-groups ... ;
truncate-groups ... ;
file ... ;
lock ... ;
}
oob-auth section is derived from
oob-auth section prototype.
For detail description of it, see auth(5).
pf-queue name {
parent ... ;
bandwidth ... ;
priority ... ;
qlimit ... ;
cbq { ... }
priq { ... }
hfsc { ... }
}
pf-queue section is derived from
pf-queue section prototype.
For detail description of it, see pf-queue(5).
radius-client name {
nas ... ;
groups ... ;
* server ... ;
}
radius-client section is derived from
radius-client section prototype.
For detail description of it, see radius(5).
resolver name {
* server ... ;
search ... ;
preference ... ;
edns ... ;
conf-timeout ... ;
initial-timeout ... ;
final-timeout ... ;
conn-timeout ... ;
disable-deresolution ... ;
}
resolver section is derived from
resolver section prototype.
For detail description of it, see resolver(5).
shared-dir name {
path ... ;
}
shared-dir section is derived from
shared-dir section prototype.
For detail description of it, see common(5).
shared-file name {
path ... ;
format ... ;
}
shared-file section is derived from
shared-file section prototype.
For detail description of it, see common(5).
ssl-params name {
versions ... ;
ciphers ... ;
tcp-eof ... ;
id ... ;
* auth-cert ... ;
distrusted-certs ... ;
dont-check-crl ... ;
* crl ... ;
verify-peer ... ;
cache-timeout ... ;
use-ticket ... ;
enable-renegotiation ... ;
fake-cert ... ;
prefer_server_ciphers ... ;
enable-ecdh ... ;
}
ssl-params section is derived from
ssl-params section prototype.
For detail description of it, see ssl(5).
sysctl {
* variable ... ;
portrange-default ... ;
portrange-high ... ;
portrange-low ... ;
portrange-reserved ... ;
somaxconn ... ;
log-in-vain ... ;
blackhole ... ;
}
sysctl section is derived from
sysctl section prototype.
For detail description of it, see sysctl(5).
use-resolver name;Resolver Section Specification.
This item defines name of global (system) resolver section used in particular configuration environment. Namely, it is applicable within SYSTEM section and within any section derived from PROXY prototype. The former usage defines system-wide values, the latter one values valid for particular proxy.
name (type: name of resolver, see resolver(5))tcp-proxy name {
phase ... ;
* tag ... ;
log-debug { ... }
log-stats { ... }
use-resolver ... ;
cfg-resolution ... ;
monitoring { ... }
stats-daily { ... }
stats-weekly { ... }
stats-monthly { ... }
nodaemon ... ;
singleproc ... ;
app-user ... ;
idle-timeout ... ;
run-block-sigalrm ... ;
listen-on { ... }
tcpserver { ... }
source-address ... ;
doctype-identification { ... }
client-conn { ... }
server-conn { ... }
err-reset ... ;
ssl-session-cache { ... }
client-ssl ... ;
client-ssl-timeout ... ;
data-mime-db ... ;
auth ... ;
* session-acl name { ... }
}
tcp-proxy section is derived from
tcp-proxy section prototype.
For detail description of it, see tcp-proxy(5).
ipv6-mode [status];Enabling/Disabling IPv6 Mode.
status (type: enabling, optional, default: enable)