Tobias Brunner
bf438cb182
vici: Make IKEv2 the default IKE version
...
We don't want to accept IKEv1 clients anymore by default, so we also
warn them about it in the log.
2026-07-31 16:07:52 +02:00
Tobias Brunner
5185b6f6e8
swanctl: Add option to only list a specific connection with --list-conns
2026-05-28 16:54:06 +02:00
Tobias Brunner
7bdd4bf77b
swanctl: Make sure options array passed to getopt_long() ends with a NULL entry
2026-05-19 17:27:33 +02:00
Tobias Brunner
ec2d1dc911
Use distinct identifier for "command" group in pki/swanctl to fix apidoc
2026-03-02 16:45:01 +01:00
Tobias Brunner
9b4bbbbccf
swanctl: Check for conflicts with shared options when registering commands
...
Also suppress errors when pre-processing shared options (this was missing
here but already used in pki).
2026-02-23 11:24:56 +01:00
Tobias Brunner
357296a4d4
swanctl: Avoid conflict between --uninstall and --uri
...
Also update the man page (including the -V change in the previous commit
and documenting the global options).
2026-02-23 11:24:44 +01:00
Andreas Steffen
3141a5fc4f
swanctl: Assigned -V to --version since -v is now used for global --debug
2026-02-22 10:22:19 +01:00
Tobias Brunner
22e502b286
vici: Make ICMP forwarding configurable
2026-02-12 15:33:44 +01:00
Tobias Brunner
e2786cbcb8
swanctl: Add global --debug, --options and --uri arguments
...
Similarly to the previous commit for pki, this allows setting these
options before the command, and by pre-parsing them we can see log
messages during the initialization.
2026-02-06 11:25:13 +01:00
Tobias Brunner
5fe1d71204
swanctl: Use a custom default plugin list
...
Loading all libstrongswan plugins isn't necessary as the tool only uses
the plugins to parse/decrypt credentials. So it's similar to pki, but
it doesn't do (online) certificate validation, access tokens, or need
access to databases.
While it's usually not an issue to load unnecessary plugins, one thing
that came up recently are the new capabilities required by the agent
plugin. Since Debian's AppArmor policy for swanctl doesn't grant them,
this produces an error message that might confuse users.
2026-02-06 11:21:34 +01:00
Tobias Brunner
80e2cf44a3
swanctl: Allow connection and child config names to be longer
...
VICI imposes an upper limit of 256 characters for names, which we should
allow for connection and child configs.
2025-11-19 10:50:06 +01:00
Mathias Aerts
a24dc2e9ad
vici: Include configured local and remote ports in list-conns
...
Closes strongswan/strongswan#2869
2025-08-22 15:22:13 +02:00
Tobias Brunner
f02033664e
vici: Add support for P-CSCF server attributes
...
Was apparently forgotten when support was added to the attr plugin
with 98a3ba8a5astrongswan/strongswan#2396
2025-08-21 16:04:39 +02:00
Tobias Brunner
a153626af7
identification: Clarify that ID_USER_FQDN is just an alias for ID_RFC822_ADDR
...
This means userfqdn: is a valid prefix for regular expressions.
2025-06-20 10:37:40 +02:00
Tobias Brunner
e58ef258b5
swanctl: Document that IP-TFS mode is subject to mode negotiation
2025-06-20 10:37:35 +02:00
Tobias Brunner
1afc76dd56
vici: Make IP-TFS mode configurable
2025-05-28 16:37:46 +02:00
Tobias Brunner
73083503f2
vici: Make UDP encapsulation for per-CPU SAs configurable
2025-05-28 16:35:27 +02:00
Tobias Brunner
f95bdb6fb0
swanctl: Report per-CPU information in --list-sas
2025-05-28 16:35:27 +02:00
Tobias Brunner
fbfae44dd1
vici: Make per-CPU CHILD_SAs configurable
2025-05-28 16:35:27 +02:00
Tobias Brunner
6e274271af
vici: Include reqid when listing trap policies
2025-05-28 10:11:53 +02:00
Tobias Brunner
981c82ab50
vici: Add support for POSIX regular expressions in identity fields
2025-05-28 09:58:17 +02:00
Tobias Brunner
5f4988eb7c
swanctl: Reduce indentation in usage output and print command descriptions
...
Also print error message at the end of the output.
2025-05-27 17:38:24 +02:00
Tobias Brunner
9a9d0a0bf7
swanctl: Document maximum log level of messages received by --log
2025-05-22 14:24:43 +02:00
Tobias Brunner
2f2e4abe3c
ikev2: Add support to switch peer configs based on EAP-Identities
...
This changes how EAP identities are used from the config. Instead of
setting a statically configured identity != %any, an EAP-Identity
exchange is now always initiated (and required). If the received identity
doesn't match, the peer config is switched to one with a matching
identity (wildcards are supported for that match). This allows switching
to a config with a different EAP method or child settings based on the
EAP identity.
There is currently no "best" match. The configs are evaluated based on
the order returned from the initial peer config lookup.
References strongswan/strongswan#2702
2025-04-14 12:05:24 +02:00
Tobias Brunner
8cb36be188
swanctl: Document "none" keyword for ESP proposals
2025-04-10 08:31:10 +02:00
Tobias Brunner
fcaee9e123
vici: Document ICMP type/code traffic selector restrictions
2025-03-05 10:55:51 +01:00
Tobias Brunner
e6b9f82a87
swanctl: Fix memory leak in --load-creds if --clear fails
2025-03-04 14:30:35 +01:00
Tobias Brunner
c8f16d18d8
swanctl: Document keX_ prefix and replace DH with KE
2024-12-04 17:59:27 +01:00
Tobias Brunner
6cf84547d7
swanctl: Update note about reauth approaches for reauth_time
2024-11-27 11:08:05 +01:00
Andreas Steffen
4833f29b15
bliss: Remove legacy BLISS signatures
2024-11-22 14:05:36 +01:00
Tobias Brunner
8ea6997482
swanctl: Document soft lifetime defaults if hard lifetimes are configured
2024-10-30 12:07:04 +01:00
Andreas Steffen and Tobias Brunner
355f917532
vici: List additional key exchanges
...
Co-authored-by: Tobias Brunner <[email protected]
2024-08-07 16:20:18 +02:00
Tobias Brunner
afeac365fd
swanctl: Document possibility of non-zero base addresses for in-memory pools
...
References strongswan/strongswan#2205
2024-04-15 09:50:34 +02:00
Jean-François Hren and Tobias Brunner
15612b3a42
Add support for IKEv2 OCSP extensions (RFC 4806)
...
Closes strongswan/strongswan#2016
Co-authored-by: Tobias Brunner <[email protected]
2024-03-13 15:10:50 +01:00
Tobias Brunner
6dee8587f0
Remove obvious empty statements (i.e. stray semicolons)
2024-02-29 15:30:40 +01:00
Tobias Brunner
a5ba701783
swanctl: Fix Windows build of --monitor-sas command
...
Fixes: 4784c92c55
2023-02-22 14:33:34 +01:00
Tobias Brunner
1efdb0f791
ikev2: Add option to prefer childless IKE_SAs as initiator
2023-02-22 13:19:46 +01:00
Tobias Brunner
4784c92c55
swanctl: Terminate --monitor-sa command if daemon closes connection
2023-02-22 11:44:14 +01:00
Tobias Brunner
2b8f26308f
vici: Update offloading configuration for full packet HW offloading
2023-02-16 13:25:34 +01:00
Tobias Brunner
29e3247097
swanctl: Don't use hard-coded path to sysconfdir
2023-01-16 11:39:29 +01:00
Tobias Brunner
cf6f56f619
Fixed some typos, courtesy of codespell
2022-12-22 19:03:37 +01:00
Tobias Brunner
c1c85b0fd1
swanctl: Document the type/size of interface IDs
2022-11-10 16:50:02 +01:00
Tobias Brunner
284fc2f796
swanctl: Document the behavior of %unique[-dir] on IKE_SAs
2022-11-10 16:50:02 +01:00
Tobias Brunner
64b10dfb28
conf: Document accepted number and time formats
2022-11-10 16:50:02 +01:00
Tobias Brunner
19ef2aec15
Update copyright headers after acquisition by secunet
2022-06-28 10:22:56 +02:00
Tobias Brunner
955b526be8
swanctl: Add options to filter CHILD_SAs in --list-sas
2022-04-14 18:42:01 +02:00
Tobias Brunner
b67f7fb861
swanctl: Report labels in --list-* commands
2022-04-14 18:42:01 +02:00
Tobias Brunner
7cf6f29ac5
vici: Make security labels and mode configurable
2022-04-14 18:42:01 +02:00
Tobias Brunner
c00c5e5a35
vici: Make combination of 'trap' and 'start' configurable
2022-04-14 18:42:01 +02:00
Tobias Brunner
128d054407
Clear static buffer returned by getpass()
2021-10-04 11:30:03 +02:00
Tobias Brunner