denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,012 Commits 1 Branch 0 Tags
afeac365fd0a29cbdda312284df0ea877ad1c886
Commit Graph
73 Commits
Author SHA1 Message Date
Tobias Brunner afeac365fd swanctl: Document possibility of non-zero base addresses for in-memory pools 
References strongswan/strongswan#2205
 2024-04-15 09:50:34 +02:00
Jean-François HrenandTobias Brunner 15612b3a42 Add support for IKEv2 OCSP extensions (RFC 4806) 
Closes strongswan/strongswan#2016

Co-authored-by: Tobias Brunner <[email protected]>
 2024-03-13 15:10:50 +01:00
Tobias Brunner 1efdb0f791 ikev2: Add option to prefer childless IKE_SAs as initiator 2023-02-22 13:19:46 +01:00
Tobias Brunner 2b8f26308f vici: Update offloading configuration for full packet HW offloading 2023-02-16 13:25:34 +01:00
Tobias Brunner cf6f56f619 Fixed some typos, courtesy of codespell 2022-12-22 19:03:37 +01:00
Tobias Brunner c1c85b0fd1 swanctl: Document the type/size of interface IDs 2022-11-10 16:50:02 +01:00
Tobias Brunner 284fc2f796 swanctl: Document the behavior of %unique[-dir] on IKE_SAs 2022-11-10 16:50:02 +01:00
Tobias Brunner 7cf6f29ac5 vici: Make security labels and mode configurable 2022-04-14 18:42:01 +02:00
Tobias Brunner c00c5e5a35 vici: Make combination of 'trap' and 'start' configurable 2022-04-14 18:42:01 +02:00
Martin Willi 55fc514ed2 swanctl: Document the remote ca_id option for identity based CA constraints 2019-12-06 10:07:46 +01:00
Tobias Brunner 7cde77c638 swanctl: Document wildcard matching for remote identities 2019-11-12 10:59:38 +01:00
Tobias Brunner b31bff125c swanctl: Move documentation of if_id_in/out after all mark-related options 
Also fix a typo.
 2019-04-29 17:38:28 +02:00
Tobias Brunner 2889b77da2 vici: Make childless initiation of IKE_SAs configurable 2019-04-25 15:23:19 +02:00
Tobias Brunner 0396969a36 vici: Add support for interface ID configurable on IKE_SA 2019-04-04 09:36:38 +02:00
Tobias Brunner 801a5d3133 kernel-netlink: Don't install routes for CHILD_SAs with interface ID 2019-04-04 09:31:38 +02:00
Tobias Brunner 18ed5a07db vici: Make interface ID configurable 2019-04-03 12:00:08 +02:00
Tobias Brunner 4ad397ef79 swanctl: Fix documentation of default value of hostaccess 2019-03-07 18:49:29 +01:00
Tobias Brunner b01327b5e1 swanctl: Document PPKs 2018-09-18 10:12:45 +02:00
Tobias Brunner 7f94528061 vici: Make PPK related options configurable 2018-09-10 18:03:02 +02:00
Martin Willi 902dc29f7a child-sa: Use SA matching mark as SA set mark if the latter is %same 
For inbound processing, it can be rather useful to apply the mark to the
packet in the SA, so the associated policy with that mark implicitly matches.
When using %unique as match mark, we don't know the mark beforehand, so
we most likely want to set the mark we match against.
 2018-08-31 12:26:40 +02:00
Martin Willi b9aacf9adc vici: Document kernel requirements for set_mark_in/set_mark_out options 2018-08-31 12:26:40 +02:00
Tobias Brunner 60f7896923 vici: Make in-/outbound marks the SA should set configurable 2018-08-31 12:26:40 +02:00
Tobias Brunner c993eaf9d1 kernel: Add option to control DS field behavior 2018-08-29 11:36:04 +02:00
Tobias Brunner dc8b015d78 kernel: Add options to control DF and ECN header bits/fields via XFRM 
The options control whether the DF and ECN header bits/fields are copied
from the unencrypted packets to the encrypted packets in tunnel mode (DF only
for IPv4), and for ECN whether the same is done for inbound packets.

Note: This implementation only works with Linux/Netlink/XFRM.

Based on a patch by Markus Sattler.
 2018-08-29 11:36:04 +02:00
Tobias Brunner 2c7a4b0704 swanctl: Document new HW offload options/behavior 2018-05-24 10:49:19 +02:00
Tobias Brunner e698bdea24 man: Fix documentation of pubkey constraints 
Hash algorithms have to be repeated for multiple key types.

References #2514.
 2018-02-09 10:42:13 +01:00
Tobias Brunner fde0c763b6 auth-cfg: Add RSA/PSS schemes for pubkey and rsa if enabled in strongswan.conf 
Also document the rsa/pss prefix.
 2017-11-08 16:48:10 +01:00
Thomas Egerer 2dad293647 ike: Do not send initial contact only for UNIQUE_NEVER 
Signed-off-by: Thomas Egerer <[email protected]>
 2017-11-02 10:17:24 +01:00
Tobias Brunner 2d244f178f vici: Make setting mark on inbound SA configurable 2017-11-02 09:59:38 +01:00
Eyal Birger 32e5c49234 child-sa: Allow requesting different unique marks for in/out 
When requiring unique flags for CHILD_SAs, allow the configuration to
request different marks for each direction by using the %unique-dir keyword.

This is useful when different marks are desired for each direction but the
number of peers is not predefined.

An example use case is when implementing a site-to-site route-based VPN
without VTI devices.

A use of 0.0.0.0/0 - 0.0.0.0/0 traffic selectors with identical in/out marks
results in outbound traffic being wrongfully matched against the 'fwd'
policy - for which the underlay 'template' does not match - and dropped.

Using different marks for each direction avoids this issue as the 'fwd' policy
uses the 'in' mark will not match outbound traffic.

Closes strongswan/strongswan#78.
 2017-08-07 14:22:27 +02:00
Tobias Brunner ae48325a59 swanctl: Include config snippets from conf.d subdirectory 
Fixes #2371.
 2017-07-27 13:20:24 +02:00
Tobias Brunner 93e0898f60 swanctl: Document eap_id in remote sections 2017-07-05 18:08:04 +02:00
Tobias Brunner 0afe0eca67 vici: Make 96-bit truncation for SHA-256 configurable 2017-05-26 11:22:28 +02:00
Tobias Brunner 7c4f88d4be vici: Make hardware offload configurable 2017-05-23 16:58:00 +02:00
Tobias Brunner 46a3f92a76 Add an option to announce support for IKE fragmentation but not sending fragments 2017-05-23 16:41:57 +02:00
Noel Kuntze 693107f6ae swanctl: Reformulate IKEv1 selector restriction, describe problems with TS narrowing 2017-03-23 18:27:05 +01:00
Tobias Brunner d5a19a17dc swanctl: Describe what happens when a FQDN is specified in local|remote_addrs 2017-03-20 10:18:51 +01:00
Tobias Brunner f927ba975b vici: Add support for mediation extension 2017-02-16 19:24:09 +01:00
Tobias Brunner bd6ef6be7e vici: Add support to load CA certificates from tokens and paths in authority sections 2017-02-16 19:24:08 +01:00
Tobias Brunner 2f8354ca6c vici: Add support to load certificates from file paths 
Probably not that useful via swanctl.conf but could be when used via VICI.
 2017-02-16 19:24:08 +01:00
Tobias Brunner 00bf6a2a49 vici: Add support to load certificates from tokens 2017-02-16 19:24:08 +01:00
Tobias Brunner d2e3ff8e0c swanctl: Add token secrets for keys on tokens/smartcards 2017-02-16 19:24:07 +01:00
Tobias Brunner ed105f45af vici: Add support for NT Hash secrets 
Fixes #1002.
 2017-02-16 19:23:51 +01:00
Tobias Brunner 3bedf10b25 vici: Add support for IPv6 Transport Proxy Mode 2017-02-16 19:23:50 +01:00
Tobias Brunner e00bc9f6b2 vici: Add support for certificate policies 2017-02-16 19:23:50 +01:00
Tobias Brunner 44fcc83310 vici: Add missing dscp setting for IKE_SAs 
Fixes #2170.
 2017-02-16 19:23:31 +01:00
Tobias Brunner 7caba2eb55 swanctl: Add 'private' directory/section to load any type of private key 2016-10-05 11:33:36 +02:00
Tobias Brunner d5c6a0bac4 vici: Enable IKE fragmentation by default 2016-10-04 10:08:21 +02:00
Tobias Brunner 50721a61d8 vici: Make installation of outbound FWD policies configurable 2016-09-28 17:56:43 +02:00
Tobias Brunner f883cd6df6 swanctl: Document how DH groups in CHILD_SA proposals are applied 
References #1039.
 2016-08-31 11:47:25 +02:00