Tobias Brunner
6e274271af
vici: Include reqid when listing trap policies
2025-05-28 10:11:53 +02:00
Tobias Brunner
981c82ab50
vici: Add support for POSIX regular expressions in identity fields
2025-05-28 09:58:17 +02:00
Tobias Brunner
5f4988eb7c
swanctl: Reduce indentation in usage output and print command descriptions
...
Also print error message at the end of the output.
2025-05-27 17:38:24 +02:00
Tobias Brunner
9a9d0a0bf7
swanctl: Document maximum log level of messages received by --log
2025-05-22 14:24:43 +02:00
Tobias Brunner
2f2e4abe3c
ikev2: Add support to switch peer configs based on EAP-Identities
...
This changes how EAP identities are used from the config. Instead of
setting a statically configured identity != %any, an EAP-Identity
exchange is now always initiated (and required). If the received identity
doesn't match, the peer config is switched to one with a matching
identity (wildcards are supported for that match). This allows switching
to a config with a different EAP method or child settings based on the
EAP identity.
There is currently no "best" match. The configs are evaluated based on
the order returned from the initial peer config lookup.
References strongswan/strongswan#2702
2025-04-14 12:05:24 +02:00
Tobias Brunner
8cb36be188
swanctl: Document "none" keyword for ESP proposals
2025-04-10 08:31:10 +02:00
Tobias Brunner
fcaee9e123
vici: Document ICMP type/code traffic selector restrictions
2025-03-05 10:55:51 +01:00
Tobias Brunner
e6b9f82a87
swanctl: Fix memory leak in --load-creds if --clear fails
2025-03-04 14:30:35 +01:00
Tobias Brunner
c8f16d18d8
swanctl: Document keX_ prefix and replace DH with KE
2024-12-04 17:59:27 +01:00
Tobias Brunner
6cf84547d7
swanctl: Update note about reauth approaches for reauth_time
2024-11-27 11:08:05 +01:00
Andreas Steffen
4833f29b15
bliss: Remove legacy BLISS signatures
2024-11-22 14:05:36 +01:00
Tobias Brunner
8ea6997482
swanctl: Document soft lifetime defaults if hard lifetimes are configured
2024-10-30 12:07:04 +01:00
Andreas Steffen and Tobias Brunner
355f917532
vici: List additional key exchanges
...
Co-authored-by: Tobias Brunner <[email protected]
2024-08-07 16:20:18 +02:00
Tobias Brunner
afeac365fd
swanctl: Document possibility of non-zero base addresses for in-memory pools
...
References strongswan/strongswan#2205
2024-04-15 09:50:34 +02:00
Jean-François Hren and Tobias Brunner
15612b3a42
Add support for IKEv2 OCSP extensions (RFC 4806)
...
Closes strongswan/strongswan#2016
Co-authored-by: Tobias Brunner <[email protected]
2024-03-13 15:10:50 +01:00
Tobias Brunner
6dee8587f0
Remove obvious empty statements (i.e. stray semicolons)
2024-02-29 15:30:40 +01:00
Tobias Brunner
a5ba701783
swanctl: Fix Windows build of --monitor-sas command
...
Fixes: 4784c92c55
2023-02-22 14:33:34 +01:00
Tobias Brunner
1efdb0f791
ikev2: Add option to prefer childless IKE_SAs as initiator
2023-02-22 13:19:46 +01:00
Tobias Brunner
4784c92c55
swanctl: Terminate --monitor-sa command if daemon closes connection
2023-02-22 11:44:14 +01:00
Tobias Brunner
2b8f26308f
vici: Update offloading configuration for full packet HW offloading
2023-02-16 13:25:34 +01:00
Tobias Brunner
29e3247097
swanctl: Don't use hard-coded path to sysconfdir
2023-01-16 11:39:29 +01:00
Tobias Brunner
cf6f56f619
Fixed some typos, courtesy of codespell
2022-12-22 19:03:37 +01:00
Tobias Brunner
c1c85b0fd1
swanctl: Document the type/size of interface IDs
2022-11-10 16:50:02 +01:00
Tobias Brunner
284fc2f796
swanctl: Document the behavior of %unique[-dir] on IKE_SAs
2022-11-10 16:50:02 +01:00
Tobias Brunner
64b10dfb28
conf: Document accepted number and time formats
2022-11-10 16:50:02 +01:00
Tobias Brunner
19ef2aec15
Update copyright headers after acquisition by secunet
2022-06-28 10:22:56 +02:00
Tobias Brunner
955b526be8
swanctl: Add options to filter CHILD_SAs in --list-sas
2022-04-14 18:42:01 +02:00
Tobias Brunner
b67f7fb861
swanctl: Report labels in --list-* commands
2022-04-14 18:42:01 +02:00
Tobias Brunner
7cf6f29ac5
vici: Make security labels and mode configurable
2022-04-14 18:42:01 +02:00
Tobias Brunner
c00c5e5a35
vici: Make combination of 'trap' and 'start' configurable
2022-04-14 18:42:01 +02:00
Tobias Brunner
128d054407
Clear static buffer returned by getpass()
2021-10-04 11:30:03 +02:00
Tobias Brunner
de442491d9
swanctl: Clear config from memory
...
The 'secrets' section in the config file may contain passwords/PINs.
2021-10-04 11:30:03 +02:00
Tobias Brunner
b667eb37b9
swanctl: Clear possibly unencrypted key/container files from memory
2021-10-04 11:30:03 +02:00
Tobias Brunner
4dc9edfa55
swanctl: Don't print status message if nothing was loaded to stderr
...
This is not an error (as reflected by the returned status code) so we
should not print to stderr as output there might still be considered an
error (or at least an audit-worthy event) by some scripts.
2021-02-04 16:50:36 +01:00
Tobias Brunner
30d47ea4cb
swanctl: Support any key type for decrypted keys
...
The previous code required explicit support for a particular key type,
of which Ed25519 and Ed448 were missing. While a fallback to `any` would
have been possible (this is already the case for unencrypted keys in the
`private` and `pkcs8` directories, which are not parsed by swanctl), it's
not necessary (as long as swanctl and the daemon are from the same release)
and does not require the daemon to detect the key type again.
Fixes #3586 .
2020-10-27 11:17:44 +01:00
Josh Soref
b3ab7a48cc
Spelling fixes
...
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior
Closes strongswan/strongswan#164 .
2020-02-11 18:23:07 +01:00
Tobias Brunner
73ee7b6664
swanctl: Add missing header guards for load commands
2020-01-28 15:29:40 +01:00
Tobias Brunner
91c6387e69
swanctl: Add missing extern for swanctl_dir variable in header
...
This clearly never was correct, but didn't cause problems so far.
However, GCC 10 will default to `-fno-common` instead of
`-fcommon` (https://gcc.gnu.org/PR85678 ), so compilation there fails
with something like:
```
libtool: link: gcc ... -o .libs/swanctl ...
ld: commands/load_authorities.o:strongswan/src/swanctl/./swanctl.h:33:
multiple definition of `swanctl_dir'; commands/load_all.o:strongswan/src/swanctl/./swanctl.h:33: first defined here
```
Fixes: 501bd53a6cCloses strongswan/strongswan#163 .
2020-01-28 15:29:40 +01:00
Martin Willi
026024bc02
swanctl: Include ca_id property in list-conns command
2019-12-06 10:07:46 +01:00
Martin Willi
55fc514ed2
swanctl: Document the remote ca_id option for identity based CA constraints
2019-12-06 10:07:46 +01:00
Tobias Brunner
7cde77c638
swanctl: Document wildcard matching for remote identities
2019-11-12 10:59:38 +01:00
Tobias Brunner
b9949e98c2
Some whitespace fixes
...
Didn't change some of the larger testing scripts that use an inconsistent
indentation style.
2019-08-22 15:18:06 +02:00
Tobias Brunner
b31bff125c
swanctl: Move documentation of if_id_in/out after all mark-related options
...
Also fix a typo.
2019-04-29 17:38:28 +02:00
Tobias Brunner
c863960eb1
vici: Support initiation of IKE_SAs
...
The configuration must allow the initiation of a childless IKE_SA (which
is already the case with the default of 'accept').
2019-04-25 15:23:19 +02:00
Tobias Brunner
2889b77da2
vici: Make childless initiation of IKE_SAs configurable
2019-04-25 15:23:19 +02:00
Tobias Brunner
0396969a36
vici: Add support for interface ID configurable on IKE_SA
2019-04-04 09:36:38 +02:00
Tobias Brunner
801a5d3133
kernel-netlink: Don't install routes for CHILD_SAs with interface ID
2019-04-04 09:31:38 +02:00
Tobias Brunner
19b6d9a622
swanctl: Report interface IDs in --list-sas
2019-04-04 09:31:38 +02:00
Tobias Brunner
18ed5a07db
vici: Make interface ID configurable
2019-04-03 12:00:08 +02:00
Tobias Brunner
4ad397ef79
swanctl: Fix documentation of default value of hostaccess
2019-03-07 18:49:29 +01:00
Tobias Brunner