Tobias Brunner
a5ba701783
swanctl: Fix Windows build of --monitor-sas command
...
Fixes: 4784c92c55
2023-02-22 14:33:34 +01:00
Tobias Brunner
1efdb0f791
ikev2: Add option to prefer childless IKE_SAs as initiator
2023-02-22 13:19:46 +01:00
Tobias Brunner
4784c92c55
swanctl: Terminate --monitor-sa command if daemon closes connection
2023-02-22 11:44:14 +01:00
Tobias Brunner
2b8f26308f
vici: Update offloading configuration for full packet HW offloading
2023-02-16 13:25:34 +01:00
Tobias Brunner
29e3247097
swanctl: Don't use hard-coded path to sysconfdir
2023-01-16 11:39:29 +01:00
Tobias Brunner
cf6f56f619
Fixed some typos, courtesy of codespell
2022-12-22 19:03:37 +01:00
Tobias Brunner
c1c85b0fd1
swanctl: Document the type/size of interface IDs
2022-11-10 16:50:02 +01:00
Tobias Brunner
284fc2f796
swanctl: Document the behavior of %unique[-dir] on IKE_SAs
2022-11-10 16:50:02 +01:00
Tobias Brunner
64b10dfb28
conf: Document accepted number and time formats
2022-11-10 16:50:02 +01:00
Tobias Brunner
19ef2aec15
Update copyright headers after acquisition by secunet
2022-06-28 10:22:56 +02:00
Tobias Brunner
955b526be8
swanctl: Add options to filter CHILD_SAs in --list-sas
2022-04-14 18:42:01 +02:00
Tobias Brunner
b67f7fb861
swanctl: Report labels in --list-* commands
2022-04-14 18:42:01 +02:00
Tobias Brunner
7cf6f29ac5
vici: Make security labels and mode configurable
2022-04-14 18:42:01 +02:00
Tobias Brunner
c00c5e5a35
vici: Make combination of 'trap' and 'start' configurable
2022-04-14 18:42:01 +02:00
Tobias Brunner
128d054407
Clear static buffer returned by getpass()
2021-10-04 11:30:03 +02:00
Tobias Brunner
de442491d9
swanctl: Clear config from memory
...
The 'secrets' section in the config file may contain passwords/PINs.
2021-10-04 11:30:03 +02:00
Tobias Brunner
b667eb37b9
swanctl: Clear possibly unencrypted key/container files from memory
2021-10-04 11:30:03 +02:00
Tobias Brunner
4dc9edfa55
swanctl: Don't print status message if nothing was loaded to stderr
...
This is not an error (as reflected by the returned status code) so we
should not print to stderr as output there might still be considered an
error (or at least an audit-worthy event) by some scripts.
2021-02-04 16:50:36 +01:00
Tobias Brunner
30d47ea4cb
swanctl: Support any key type for decrypted keys
...
The previous code required explicit support for a particular key type,
of which Ed25519 and Ed448 were missing. While a fallback to `any` would
have been possible (this is already the case for unencrypted keys in the
`private` and `pkcs8` directories, which are not parsed by swanctl), it's
not necessary (as long as swanctl and the daemon are from the same release)
and does not require the daemon to detect the key type again.
Fixes #3586 .
2020-10-27 11:17:44 +01:00
Josh Soref
b3ab7a48cc
Spelling fixes
...
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior
Closes strongswan/strongswan#164 .
2020-02-11 18:23:07 +01:00
Tobias Brunner
73ee7b6664
swanctl: Add missing header guards for load commands
2020-01-28 15:29:40 +01:00
Tobias Brunner
91c6387e69
swanctl: Add missing extern for swanctl_dir variable in header
...
This clearly never was correct, but didn't cause problems so far.
However, GCC 10 will default to `-fno-common` instead of
`-fcommon` (https://gcc.gnu.org/PR85678 ), so compilation there fails
with something like:
```
libtool: link: gcc ... -o .libs/swanctl ...
ld: commands/load_authorities.o:strongswan/src/swanctl/./swanctl.h:33:
multiple definition of `swanctl_dir'; commands/load_all.o:strongswan/src/swanctl/./swanctl.h:33: first defined here
```
Fixes: 501bd53a6cCloses strongswan/strongswan#163 .
2020-01-28 15:29:40 +01:00
Martin Willi
026024bc02
swanctl: Include ca_id property in list-conns command
2019-12-06 10:07:46 +01:00
Martin Willi
55fc514ed2
swanctl: Document the remote ca_id option for identity based CA constraints
2019-12-06 10:07:46 +01:00
Tobias Brunner
7cde77c638
swanctl: Document wildcard matching for remote identities
2019-11-12 10:59:38 +01:00
Tobias Brunner
b9949e98c2
Some whitespace fixes
...
Didn't change some of the larger testing scripts that use an inconsistent
indentation style.
2019-08-22 15:18:06 +02:00
Tobias Brunner
b31bff125c
swanctl: Move documentation of if_id_in/out after all mark-related options
...
Also fix a typo.
2019-04-29 17:38:28 +02:00
Tobias Brunner
c863960eb1
vici: Support initiation of IKE_SAs
...
The configuration must allow the initiation of a childless IKE_SA (which
is already the case with the default of 'accept').
2019-04-25 15:23:19 +02:00
Tobias Brunner
2889b77da2
vici: Make childless initiation of IKE_SAs configurable
2019-04-25 15:23:19 +02:00
Tobias Brunner
0396969a36
vici: Add support for interface ID configurable on IKE_SA
2019-04-04 09:36:38 +02:00
Tobias Brunner
801a5d3133
kernel-netlink: Don't install routes for CHILD_SAs with interface ID
2019-04-04 09:31:38 +02:00
Tobias Brunner
19b6d9a622
swanctl: Report interface IDs in --list-sas
2019-04-04 09:31:38 +02:00
Tobias Brunner
18ed5a07db
vici: Make interface ID configurable
2019-04-03 12:00:08 +02:00
Tobias Brunner
4ad397ef79
swanctl: Fix documentation of default value of hostaccess
2019-03-07 18:49:29 +01:00
Tobias Brunner
501bd53a6c
swanctl: Make credential directories relative to swanctl.conf
...
All directories are now considered relative to the loaded swanctl.conf
file, in particular, when loading it from a custom location via --file
argument. The base directory, which is used if no custom location for
swanctl.conf is specified, is now also configurable at runtime via
SWANCTL_DIR environment variable.
Closes strongswan/strongswan#120 .
2018-12-14 09:11:14 +01:00
Matt Selsky
b98db90763
swanctl: Fix typos in usage for swanctl rekey/terminate commands
...
Closes strongswan/strongswan#113 .
2018-10-02 09:30:03 +02:00
Tobias Brunner
b01327b5e1
swanctl: Document PPKs
2018-09-18 10:12:45 +02:00
Tobias Brunner
784d96e031
Fixed some typos, courtesy of codespell
2018-09-17 18:51:44 +02:00
Tobias Brunner
0b8d00adaf
counters: Fix exit status in error case
2018-09-17 18:51:42 +02:00
Tobias Brunner
80e8845d36
swanctl: Allow passing a custom config file for each --load* command
...
Mainly for debugging, but could also be used to e.g. use a separate file
for connections and secrets.
2018-09-11 18:14:45 +02:00
Tobias Brunner
755985867e
swanctl: Report the use of a PPK in --list-sas
...
If we later decide the PPK_ID would be helpful, printing this on a
separate line would probably make sense.
2018-09-10 18:03:30 +02:00
Tobias Brunner
1fb46f7119
swanctl: Report PPK configuration in --list-conns
2018-09-10 18:03:02 +02:00
Tobias Brunner
7f94528061
vici: Make PPK related options configurable
2018-09-10 18:03:02 +02:00
Tobias Brunner
3703dff2aa
swanctl: Add support for PPKs
2018-09-10 18:03:01 +02:00
Tobias Brunner
8505c28289
swanctl: Add --reauth option to --rekey command
2018-08-31 12:39:46 +02:00
Martin Willi
902dc29f7a
child-sa: Use SA matching mark as SA set mark if the latter is %same
...
For inbound processing, it can be rather useful to apply the mark to the
packet in the SA, so the associated policy with that mark implicitly matches.
When using %unique as match mark, we don't know the mark beforehand, so
we most likely want to set the mark we match against.
2018-08-31 12:26:40 +02:00
Martin Willi
b9aacf9adc
vici: Document kernel requirements for set_mark_in/set_mark_out options
2018-08-31 12:26:40 +02:00
Tobias Brunner
60f7896923
vici: Make in-/outbound marks the SA should set configurable
2018-08-31 12:26:40 +02:00
Tobias Brunner
c993eaf9d1
kernel: Add option to control DS field behavior
2018-08-29 11:36:04 +02:00
Tobias Brunner
dc8b015d78
kernel: Add options to control DF and ECN header bits/fields via XFRM
...
The options control whether the DF and ECN header bits/fields are copied
from the unencrypted packets to the encrypted packets in tunnel mode (DF only
for IPv4), and for ECN whether the same is done for inbound packets.
Note: This implementation only works with Linux/Netlink/XFRM.
Based on a patch by Markus Sattler.
2018-08-29 11:36:04 +02:00
Tobias Brunner