denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,153 Commits 1 Branch 0 Tags
b00a4e778f9e9afe3d3bfbb1daa3463096d4c50f
Commit Graph
197 Commits
Author SHA1 Message Date
Tobias Brunner c00c5e5a35 vici: Make combination of 'trap' and 'start' configurable 2022-04-14 18:42:01 +02:00
Tobias Brunner 128d054407 Clear static buffer returned by getpass() 2021-10-04 11:30:03 +02:00
Tobias Brunner de442491d9 swanctl: Clear config from memory 
The 'secrets' section in the config file may contain passwords/PINs.
 2021-10-04 11:30:03 +02:00
Tobias Brunner b667eb37b9 swanctl: Clear possibly unencrypted key/container files from memory 2021-10-04 11:30:03 +02:00
Tobias Brunner 4dc9edfa55 swanctl: Don't print status message if nothing was loaded to stderr 
This is not an error (as reflected by the returned status code) so we
should not print to stderr as output there might still be considered an
error (or at least an audit-worthy event) by some scripts.
 2021-02-04 16:50:36 +01:00
Tobias Brunner 30d47ea4cb swanctl: Support any key type for decrypted keys 
The previous code required explicit support for a particular key type,
of which Ed25519 and Ed448 were missing.  While a fallback to `any` would
have been possible (this is already the case for unencrypted keys in the
`private` and `pkcs8` directories, which are not parsed by swanctl), it's
not necessary (as long as swanctl and the daemon are from the same release)
and does not require the daemon to detect the key type again.

Fixes #3586.
 2020-10-27 11:17:44 +01:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Tobias Brunner 73ee7b6664 swanctl: Add missing header guards for load commands 2020-01-28 15:29:40 +01:00
Tobias Brunner 91c6387e69 swanctl: Add missing extern for swanctl_dir variable in header 
This clearly never was correct, but didn't cause problems so far.
However, GCC 10 will default to `-fno-common` instead of
`-fcommon` (https://gcc.gnu.org/PR85678), so compilation there fails
with something like:

```
libtool: link: gcc ... -o .libs/swanctl ...
ld: commands/load_authorities.o:strongswan/src/swanctl/./swanctl.h:33:
  multiple definition of `swanctl_dir'; commands/load_all.o:strongswan/src/swanctl/./swanctl.h:33: first defined here
```

Fixes: 501bd53a6c ("swanctl: Make credential directories relative to swanctl.conf")
Closes strongswan/strongswan#163.
 2020-01-28 15:29:40 +01:00
Martin Willi 026024bc02 swanctl: Include ca_id property in list-conns command 2019-12-06 10:07:46 +01:00
Martin Willi 55fc514ed2 swanctl: Document the remote ca_id option for identity based CA constraints 2019-12-06 10:07:46 +01:00
Tobias Brunner 7cde77c638 swanctl: Document wildcard matching for remote identities 2019-11-12 10:59:38 +01:00
Tobias Brunner b9949e98c2 Some whitespace fixes 
Didn't change some of the larger testing scripts that use an inconsistent
indentation style.
 2019-08-22 15:18:06 +02:00
Tobias Brunner b31bff125c swanctl: Move documentation of if_id_in/out after all mark-related options 
Also fix a typo.
 2019-04-29 17:38:28 +02:00
Tobias Brunner c863960eb1 vici: Support initiation of IKE_SAs 
The configuration must allow the initiation of a childless IKE_SA (which
is already the case with the default of 'accept').
 2019-04-25 15:23:19 +02:00
Tobias Brunner 2889b77da2 vici: Make childless initiation of IKE_SAs configurable 2019-04-25 15:23:19 +02:00
Tobias Brunner 0396969a36 vici: Add support for interface ID configurable on IKE_SA 2019-04-04 09:36:38 +02:00
Tobias Brunner 801a5d3133 kernel-netlink: Don't install routes for CHILD_SAs with interface ID 2019-04-04 09:31:38 +02:00
Tobias Brunner 19b6d9a622 swanctl: Report interface IDs in --list-sas 2019-04-04 09:31:38 +02:00
Tobias Brunner 18ed5a07db vici: Make interface ID configurable 2019-04-03 12:00:08 +02:00
Tobias Brunner 4ad397ef79 swanctl: Fix documentation of default value of hostaccess 2019-03-07 18:49:29 +01:00
Tobias Brunner 501bd53a6c swanctl: Make credential directories relative to swanctl.conf 
All directories are now considered relative to the loaded swanctl.conf
file, in particular, when loading it from a custom location via --file
argument.  The base directory, which is used if no custom location for
swanctl.conf is specified, is now also configurable at runtime via
SWANCTL_DIR environment variable.

Closes strongswan/strongswan#120.
 2018-12-14 09:11:14 +01:00
Matt Selsky b98db90763 swanctl: Fix typos in usage for swanctl rekey/terminate commands 
Closes strongswan/strongswan#113.
 2018-10-02 09:30:03 +02:00
Tobias Brunner b01327b5e1 swanctl: Document PPKs 2018-09-18 10:12:45 +02:00
Tobias Brunner 784d96e031 Fixed some typos, courtesy of codespell 2018-09-17 18:51:44 +02:00
Tobias Brunner 0b8d00adaf counters: Fix exit status in error case 2018-09-17 18:51:42 +02:00
Tobias Brunner 80e8845d36 swanctl: Allow passing a custom config file for each --load* command 
Mainly for debugging, but could also be used to e.g. use a separate file
for connections and secrets.
 2018-09-11 18:14:45 +02:00
Tobias Brunner 755985867e swanctl: Report the use of a PPK in --list-sas 
If we later decide the PPK_ID would be helpful, printing this on a
separate line would probably make sense.
 2018-09-10 18:03:30 +02:00
Tobias Brunner 1fb46f7119 swanctl: Report PPK configuration in --list-conns 2018-09-10 18:03:02 +02:00
Tobias Brunner 7f94528061 vici: Make PPK related options configurable 2018-09-10 18:03:02 +02:00
Tobias Brunner 3703dff2aa swanctl: Add support for PPKs 2018-09-10 18:03:01 +02:00
Tobias Brunner 8505c28289 swanctl: Add --reauth option to --rekey command 2018-08-31 12:39:46 +02:00
Martin Willi 902dc29f7a child-sa: Use SA matching mark as SA set mark if the latter is %same 
For inbound processing, it can be rather useful to apply the mark to the
packet in the SA, so the associated policy with that mark implicitly matches.
When using %unique as match mark, we don't know the mark beforehand, so
we most likely want to set the mark we match against.
 2018-08-31 12:26:40 +02:00
Martin Willi b9aacf9adc vici: Document kernel requirements for set_mark_in/set_mark_out options 2018-08-31 12:26:40 +02:00
Tobias Brunner 60f7896923 vici: Make in-/outbound marks the SA should set configurable 2018-08-31 12:26:40 +02:00
Tobias Brunner c993eaf9d1 kernel: Add option to control DS field behavior 2018-08-29 11:36:04 +02:00
Tobias Brunner dc8b015d78 kernel: Add options to control DF and ECN header bits/fields via XFRM 
The options control whether the DF and ECN header bits/fields are copied
from the unencrypted packets to the encrypted packets in tunnel mode (DF only
for IPv4), and for ECN whether the same is done for inbound packets.

Note: This implementation only works with Linux/Netlink/XFRM.

Based on a patch by Markus Sattler.
 2018-08-29 11:36:04 +02:00
Tobias Brunner 61c3870bef conf: Document reference syntax 2018-06-27 14:19:35 +02:00
Andreas Steffen ef4a63524f vici: list cert_policy parameter 2018-06-22 10:39:40 +02:00
Tobias Brunner 2c7a4b0704 swanctl: Document new HW offload options/behavior 2018-05-24 10:49:19 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner c057cd26fa swanctl: Add option to force IKE_SA termination 2018-05-22 10:06:07 +02:00
Andreas Steffen 4eaf08c35b vici: list-conn reports DPD settings and swanctl displays them 2018-02-15 16:28:06 +01:00
Tobias Brunner e698bdea24 man: Fix documentation of pubkey constraints 
Hash algorithms have to be repeated for multiple key types.

References #2514.
 2018-02-09 10:42:13 +01:00
Tobias Brunner 6d98bb926e swanctl: Allow dots in authority/shared secret/pool names 
Use argument evaluation provided by settings_t instead of using strings
to enumerate key/values.

If section names contain dots the latter causes the names to get split
and interpreted as non-existing sections and subsections.

This currently doesn't work for connections and their subsections due to
the recursion.
 2017-12-22 10:11:21 +01:00
Tobias Brunner c87b16d256 swanctl: Add check for conflicting short options 2017-11-13 10:09:41 +01:00
Tobias Brunner f0c7cbd1d7 swanctl: Properly register --counters commmand 
Use C instead of c, which is already used for --load-conns.
 2017-11-13 09:45:14 +01:00
Tobias Brunner fde0c763b6 auth-cfg: Add RSA/PSS schemes for pubkey and rsa if enabled in strongswan.conf 
Also document the rsa/pss prefix.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 052bccfac4 swanctl: Add --counters command 2017-11-08 16:28:28 +01:00
Thomas Egerer 2dad293647 ike: Do not send initial contact only for UNIQUE_NEVER 
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
 2017-11-02 10:17:24 +01:00