denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,707 Commits 1 Branch 0 Tags
693107f6aeae523ff2b4e9db05143a355d8a5a7c
Commit Graph
138 Commits
Author SHA1 Message Date
Noel Kuntze 693107f6ae swanctl: Reformulate IKEv1 selector restriction, describe problems with TS narrowing 2017-03-23 18:27:05 +01:00
Tobias Brunner a7cd424206 swanctl: Mention including files when referring to strongswan.conf(5) 2017-03-23 18:27:05 +01:00
Tobias Brunner d5a19a17dc swanctl: Describe what happens when a FQDN is specified in local|remote_addrs 2017-03-20 10:18:51 +01:00
Tobias Brunner f927ba975b vici: Add support for mediation extension 2017-02-16 19:24:09 +01:00
Tobias Brunner e2d9971215 swanctl: Add --rekey command 2017-02-16 19:24:09 +01:00
Tobias Brunner 04c0219e55 vici: Use unique names for CHILD_SAs in the list-sas command 
The original name is returned in the new "name" attribute.

This fixes an issue with bindings that map VICI messages to
dictionaries.  For instance, in roadwarrior scenarios where every
CHILD_SA has the same name only the information of the last CHILD_SA
would end up in the dictionary for that name.
 2017-02-16 19:24:08 +01:00
Tobias Brunner 75665375b7 swanctl: Allow specifying pubkeys directly via 0x/0s prefix 2017-02-16 19:24:08 +01:00
Tobias Brunner bd6ef6be7e vici: Add support to load CA certificates from tokens and paths in authority sections 2017-02-16 19:24:08 +01:00
Tobias Brunner 2f8354ca6c vici: Add support to load certificates from file paths 
Probably not that useful via swanctl.conf but could be when used via VICI.
 2017-02-16 19:24:08 +01:00
Tobias Brunner 00bf6a2a49 vici: Add support to load certificates from tokens 2017-02-16 19:24:08 +01:00
Tobias Brunner d2e3ff8e0c swanctl: Add token secrets for keys on tokens/smartcards 2017-02-16 19:24:07 +01:00
Tobias Brunner ebb517581f swanctl: Pass optional connection name to --initiate/install/uninstall 2017-02-16 19:24:07 +01:00
Tobias Brunner ed105f45af vici: Add support for NT Hash secrets 
Fixes #1002.
 2017-02-16 19:23:51 +01:00
Tobias Brunner 3bedf10b25 vici: Add support for IPv6 Transport Proxy Mode 2017-02-16 19:23:50 +01:00
Tobias Brunner e00bc9f6b2 vici: Add support for certificate policies 2017-02-16 19:23:50 +01:00
Tobias Brunner 44fcc83310 vici: Add missing dscp setting for IKE_SAs 
Fixes #2170.
 2017-02-16 19:23:31 +01:00
Tobias Brunner d460ab2bff swanctl: Automatically unload removed shared keys 2017-02-16 19:21:13 +01:00
Tobias Brunner 04180409ad swanctl: Automatically unload removed private keys 2017-02-16 19:21:12 +01:00
Tobias Brunner 257f6cb8e7 swanctl: Add possibility to query a specific pool by name 2017-02-16 19:21:12 +01:00
Martin Willi 72547830fb swanctl: List CHILD_SA marks, if set 2017-02-13 15:11:20 +01:00
Tobias Brunner 7caba2eb55 swanctl: Add 'private' directory/section to load any type of private key 2016-10-05 11:33:36 +02:00
Tobias Brunner d5c6a0bac4 vici: Enable IKE fragmentation by default 2016-10-04 10:08:21 +02:00
Tobias Brunner 50721a61d8 vici: Make installation of outbound FWD policies configurable 2016-09-28 17:56:43 +02:00
Tobias Brunner 318a48a589 swanctl: Add man page entry for flush-certs command 2016-09-15 11:58:51 +02:00
Andreas Steffen 2c7cfe7630 vici: flush-certs command flushes certificate cache 
When fresh CRLs are released with a high update frequency (e.g.
every 24 hours) or OCSP is used then the certificate cache gets
quickly filled with stale CRLs or OCSP responses. The new VICI
flush-certs command allows to flush e.g. cached CRLs or OCSP
responses only. Without the type argument all kind of certificates
(e.g. also received end entity and intermediate CA certificates)
are purged.
 2016-09-13 17:02:59 +02:00
Tobias Brunner f883cd6df6 swanctl: Document how DH groups in CHILD_SA proposals are applied 
References #1039.
 2016-08-31 11:47:25 +02:00
Andreas Steffen 7f65a8c271 vici: Increased various string buffers to BUF_LEN (512 bytes) 2016-07-29 12:34:40 +02:00
Martin Willi 518a5b2ece configure: Check for and explicitly link against -latomic 
Some C libraries, such as uClibc, require an explicit link for some atomic
functions. Check for any libatomic, and explcily link it.
 2016-06-14 14:27:20 +02:00
Andreas Steffen 6a6876390d swanctl: indicate initiator and responder in --list-sas 2016-05-07 17:54:56 +02:00
Andreas Steffen b9522f9d64 swanctl: Do not display rekey times for shunts 2016-05-05 14:53:22 +02:00
Andreas Steffen b1df631212 vici list-conns sends reauthentication and rekeying time information 2016-05-04 18:13:52 +02:00
Andreas Steffen e88f21cf65 swanctl: --list-conns shows eap_id, xauth_id and aaa_id 2016-05-04 18:13:52 +02:00
Andreas Steffen afcd466192 swanctl: list EAP type in --list-conns 2016-04-26 17:15:37 +02:00
Andreas Steffen 4e3234afb4 swanctl: log errors to stderr 2016-04-24 23:33:23 +02:00
Andreas Steffen e9704e90cf Include manual policy priorities and restriction to interfaces in vici list-conn command 2016-04-09 16:51:02 +02:00
Andreas Steffen c26e4330e7 Implemented IPsec policies restricted to given network interface 2016-04-09 16:51:02 +02:00
Andreas Steffen 7f57c4f9fb Support manually-set IPsec policy priorities 2016-04-09 16:51:01 +02:00
Tobias Brunner b31e8c04f2 swanctl: Fix documented directory name for remote pubkeys 2016-03-22 18:11:51 +01:00
Tobias Brunner 229cdf6bc8 vici: Order auth rounds by optional round parameter instead of by position in the request 2016-03-08 10:04:55 +01:00
Andreas Steffen 99b794a4cf Display IKE ports with swanctl --list-sas 2016-03-05 18:19:00 +01:00
Tobias Brunner 130c485be6 swanctl: Document signature scheme constraints 2016-03-04 16:19:54 +01:00
Tobias Brunner 27074f3155 vici: Match subnets and ranges against peer IP in redirect command 2016-03-04 16:03:00 +01:00
Tobias Brunner bef4518de7 vici: Match identity with wildcards against remote ID in redirect command 2016-03-04 16:02:59 +01:00
Tobias Brunner e92364db66 swanctl: Add --redirect command 2016-03-04 16:02:59 +01:00
Chris Patterson b84e905482 swanctl: Fix minor typos in documentation 
"UPD" should be "UDP".

Signed-off-by: Chris Patterson <pattersonc@ainfosec.com>
 2016-02-29 11:05:44 +01:00
Andreas Steffen abe6d07463 swanctl: Load pubkeys with load-creds 2016-01-09 07:23:30 +01:00
Andreas Steffen 4c38c79452 vici: list-cert sends subject, not-before and not-after attributes for pubkeys 2016-01-09 07:23:30 +01:00
Andreas Steffen 87371460f6 vici: Support of raw public keys 2016-01-09 07:23:29 +01:00
Andreas Steffen e333d4c0f1 swanctl.conf: IKEv2 fragmentation supported 2016-01-09 00:06:12 +01:00
Tobias Brunner 3f2c305226 swanctl: Slightly change usage summary for --list-certs 2015-12-16 12:20:35 +01:00