aboutsummaryrefslogtreecommitdiff
path: root/net/strongswan/files
Commit message (Collapse)AuthorAge
* strongswan: Add missing declarations in swanctlPhilip Prindeville2024-05-06
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: add empty configGlen Huang2024-02-20
| | | | | | | Without it, using uci to manipulate ipsec config can result in errors, making it much difficult to use in uci-defaults for example. Signed-off-by: Glen Huang <me@glenhuang.com>
* strongswan: trigger reload when interfaces are specifiedJoel Low2023-12-18
| | | | | | | | | | Fixes #20848 Add interface triggers if interfaces to listen to are specified in `/etc/config/ipsec`. This fixes the "running with no instances" scenario after rebooting a router. Signed-off-by: Joel Low <joel@joelsplace.sg>
* strongswan: swanctl: add support for replay windowTiago Gaspar2023-11-17
| | | | | | Add support for replay window configuration in UCI. Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
* strongswan: make parsing more consistentPhilip Prindeville2023-06-15
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: local_gateway unused in swanctl.initPhilip Prindeville2023-04-22
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: add support for remote cacertsGlen Huang2023-04-10
| | | | Signed-off-by: Glen Huang <me@glenhuang.com>
* strongswan: add support for pools sectionGlen Huang2023-04-10
| | | | Signed-off-by: Glen Huang <me@glenhuang.com>
* strongswan: simplify indentationPhilip Prindeville2023-03-26
| | | | | | Allow passing multiple config lines with the same indent level. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: Fix indent for hw_offload, interface, priorityPhilip Prindeville2023-03-26
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: Fix PSK's when using multiple connectionsPhilip Prindeville2022-11-08
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: support child rekey by bytes and packetsJoel Low2022-05-09
| | | | | | | This adds support for the child SA to be rekeyed through the byte/packet threshold. The default is blank (which disables the byte/packet thresholds). Signed-off-by: Joel Low <joel@joelsplace.sg>
* strongswan: add priority optionPhilip Prindeville2021-06-27
| | | | | | Also from Vincent Wiemann <vincent.wiemann@ironai.com>. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: add ipcomp supportPhilip Prindeville2021-06-27
| | | | | | Also from Vincent Wiemann <vincent.wiemann@ironai.com>. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: add interface option for childrenPhilip Prindeville2021-06-27
| | | | | | | | This option sets the interface of the policy. Also from Vincent Wiemann <vincent.wiemann@ironai.com>. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: add support for hw_offloadPhilip Prindeville2021-06-27
| | | | | | Also from Vincent Wiemann <vincent.wiemann@ironai.com>. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: miscellaneous cleanup of config file, etcPhilip Prindeville2021-06-27
| | | | | | | | | | | | | | | | | Use list's where appropriate for multi-value config variables. Forbid absolute/relative paths for certificate and key files. Get rid of last remnants of left/right naming. Factor invariant code paths. Drop redundant secrets.rsa.filename section. Thanks to Vincent Wiemann <vincent.wiemann@ironai.com> for calling out many of these improvements. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: rename config functionsPhilip Prindeville2021-06-27
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: fix PSK config generationVincent Wiemann2021-06-18
| | | | | | | There were closing curly braces missing and it was checking for empty strings while it should have been checking for non-empty strings. Signed-off-by: Vincent Wiemann <vincent.wiemann@ironai.com>
* strongswan: use correct directory for CA'sPhilip Prindeville2021-06-17
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: fix sharing of ipsec section variablesPhilip Prindeville2021-06-17
| | | | | | | | | | Variables set in config_ipsec() need to be shared with do_postamble() function, so change scoping to parent (prepare_env()). Also, remove unused settings like "remote_sourceip", "reqid", and "packet_marker". Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: start charon directly from swanctlPhilip Prindeville2021-06-02
| | | | | | | | | | | ipsec uses starter, and reads /etc/ipsec.conf (which then includes /var/ipsec/ipsec.conf, etc). This is overly complicated, and can be problematic if you're using both swanctl and ipsec for migration. Running charon directly from procd via the init.d script avoid all of this. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: swanctl init script doesn't load connectionsPhilip Prindeville2021-05-05
| | | | | | Fixes issue #15446 Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: change name of config base directoryPhilip Prindeville2021-04-15
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: add certificate generation utilityPhilip Prindeville2021-04-15
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: add deprecation warning to ipsec scriptPhilip Prindeville2021-04-14
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: handle chacha20poly1305 as AEADPhilip Prindeville2021-04-13
| | | | | | | | | chacha20policy1305 is also an AEAD cipher, and hence does not permit a hash algorithm. Fixes issue #15397. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: fail on serious configuration errorsPhilip Prindeville2021-04-13
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: drop subshell when possiblePhilip Prindeville2021-04-13
| | | | | | | A subshell caused by $(...) can't persistently modify globals as a side-effect. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: migrate to swanctl configsPhilip Prindeville2021-04-04
| | | | | | | | | | | | | Derived from the ipsec initd script, with the following changes: (1) various code improvements, corrections (get rid of left/right updown scripts, since there's only one), etc; (2) add reauth and fragmentation parameters; (3) add x.509 certificate-based authentication; and other minor changes. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: remove synthesized ipsec conf filesPhilip Prindeville2021-04-01
| | | | | | | | | | If you shutdown ipsec service, and it doesn't clean up /var/ipsec/ipsec.conf, then when you start swanctl service it might see an incompatible file on startup. Remedy is to remove unneeded files when shutting down the service. They can always be regenerated when the service starts again. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: make the include's in the .conf files persistentPhilip Prindeville2021-03-26
| | | | | | | | | | | | | | | | | | Having scripts diddle user written config files seems potentially dangerous. Plus there's really no downside to including some empty files. Best to just make the includes be permanent. Additional feature suggested by Luiz: if a -opkg version of the config file was created unnecessarily, remove it as part of the upgrade process since changes won't be happening to that file as an artifact of the service starting. The include lines are now permanent, which means that (1) additional configuration synthesized by UCI won't be anywhere that opkg (or sysupgrade, for that matter) cares about since it won't be persistent, and (2) if changes are being made, then they're being done by a person with an editor and they really should be distinguished. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: fix local_gateway discoveryPhilip Prindeville2021-02-16
| | | | | | | | | | | | | | | This has been observed by myself and @luizluca: ip route get is appending uid0 to the output, as seen from: root@OpenWrt2:~# ip route get 1.1.1.1 1.1.1.1 via 174.27.160.1 dev eth3 src 174.27.182.184 uid 0 cache root@OpenWrt2:~# so the fix is an anchored match, discarding all else. Also, using ip -o means never having to do multiline matches... Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: avoid duplicate loggingPhilip Prindeville2021-02-05
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* strongswan: add left and mark configuration to UCIMichael C. Bazarewsky2020-08-27
| | | | | | | | This commit allows for UCI configuration of the "left=" and the "mark=" values in a StrongSwan IPSec connection. This improves VTI support and allows certain stricter connection scenarios. Signed-off-by: Michael C. Bazarewsky <github@bazstuff.com>
* strongswan: allow to specify per-connection reqid with UCIPaul Fertser2019-11-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is useful to assign all traffic to a fw3 zone, e.g.: /etc/config/ipsec: config remote 'test' list tunnel 'dev' ... config 'tunnel' 'dev' option reqid '33' ... /etc/config/firewall: config zone option name wan option extra_src "-m policy --pol none --dir in" option extra_dest "-m policy --pol none --dir out" ... config zone option name vpn # subnet needed for firewall3 before 22 Nov 2019, 8174814a list subnet '0.0.0.0/0' option extra_src "-m policy --pol ipsec --dir in --reqid 33" option extra_dest "-m policy --pol ipsec --dir out --reqid 33" ... Signed-off-by: Paul Fertser <fercerpav@gmail.com>
* strongswan: add openwrt hotplug script handlingFlorian Eckert2018-07-16
| | | | | | | | Ipsec user script (/etc/ipsec.user) now get called indirectly by openwrt "/sbin/hotplug-call". So other packages could also install their scripts in "/etc/hotplug.d/ipsec". Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* strongswan: add interface uci listHans Dedecker2017-12-13
| | | | | | | | | | | | | The interface config option allows users to configure logical OpenWRT interface names in the ipsec section; it allows StrongSwan to listen and send traffic on specified interface(s). It translates to interfaces_use StrongSwan option which is a comma sepearted list of network devices that should be used by charon. Since StrongSwan can only be started when one of the specified logical OpenWRT interface is up procd interface triggers are installed to trigger the reload script. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* strongswan: fix reload serviceHans Dedecker2017-12-13
| | | | | | | | | | | | Based on the ipsec running state reload_service is either reloading ipsec or starting ipsec. However in the latter case it calls ipsec start which bypasses the procd start_service function which means the running ipsec instance is not managed by procd. Fix this by calling start in case ipsec is not running; at the same time add service_running function which is used by procd provided running function. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* strongswan: use -eq when testing booleansStijn Tintel2017-08-07
| | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* strongswan: convert init script to procdStijn Tintel2017-08-07
| | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* strongswan: check return value instead of outputStijn Tintel2017-08-07
| | | | | | | | | | When the strongswan service is running, `ipsec status` returns 0. Check the return value instead of checking its output. While at it, remove the [[ ]] bashism, use rereadall instead of (reread)secrets, and move it inside the if statement. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* strongswan: remove checks for UCI configStijn Tintel2017-08-07
| | | | | | | | | | | In commit 36e073d8201fe7cf133ef3eea41f8855c3344c71, some checks were added to see if the UCI config file exists and if there are any peers configured in it. Due to these checks, if /etc/config/ipsec exists, but contains no enabled peers, strongswan will not be started. This is not ideal, as a user might want to experiment with the UCI config while keeping existing connections in /etc/ipsec.conf operational. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* strongswan: uci config supportHans Dedecker2017-01-06
| | | | | | | | | | | | | | | Add support to configure strongswan via uci. uci support is based on the following sections -ipsec : Global config items belonging in the strongswan.conf file -remote : Defines the remote peer(s) -tunnel : Defines the IPSec connections in tunnel mode -transport : Defines the IPSec connections in transport mode -crypto_proposal : Defines the different crypto proposals Signed-off-by: Pierre Lebleu <pme.lebleu@gmail.com> Signed-off-by: Gino Peeters <peeters.gino@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* strongswan: import, update, adoptSteven Barth2014-08-17
Signed-off-by: Steven Barth <steven@midlink.org>
Powered by cgit, Themed by Ted Yin.