When the strongswan service is running, `ipsec status` returns 0. Check
the return value instead of checking its output.
While at it, remove the [[ ]] bashism, use rereadall instead of
(reread)secrets, and move it inside the if statement.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
In commit 36e073d820, some checks were
added to see if the UCI config file exists and if there are any peers
configured in it. Due to these checks, if /etc/config/ipsec exists, but
contains no enabled peers, strongswan will not be started. This is not
ideal, as a user might want to experiment with the UCI config while
keeping existing connections in /etc/ipsec.conf operational.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Since the strongswan-utils package now only contains the aging ipsec
utility, rename it to strongswan-ipsec.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
We currently include the SCEP client in strongswan-utils, which is a
dependency of the strongswan-default meta-package. As it's generally not
recommended to generate keys on embedded devices due to lack of entropy,
move the SCEP client to a separate package, and only depend on it in the
strongswan-full meta-package.
While at it, add scepclient.conf to the package.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
We currently include the PKI tool in strongswan-utils, which is a
dependency of the strongswan-default meta-package. As it's generally not
recommended to generate keys on embedded devices due to lack of entropy,
move the PKI tool to a separate package, and only depend on it in the
strongswan-full meta-package.
While at it, add pki.conf to the package.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* Switch back to upstream repo
* Follow the same configuration style as ffmpeg and mpg123 for using float vs
fixed point codepaths.
* Remove unneeded cpp variables (musl provides C99 math library)
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
* Update nmap-suite to 7.60
* Use PKG_HASH as PKG_MD5SUM is deprecated
* Switch download URL to HTTPS
* Add zlib as dependency and link libpcre dynamically
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
* Start dnscrypt-proxy from procd interface trigger rather than
immediately in init, to fix a possible race condition during boot and
get rid of rc.local restarts. You can restrict trigger interface(s) by
'procd_trigger' in new global config section.
* tab/whitespace cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
linux-utils (fdisk) provides the functionality I need and I have no interest
in maintaining this package as it more or less overlaps the functionality
of the previously mentioned alternative.
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
Update (lib)expat to 2.2.3
Remove poor entropy hack, 2.2.3 uses /dev/urandom in worst case
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
The release .tar.xz includes the gperf and antlr generated files, so the patch
is no longer required. The build error was from the patch being outdated.
Signed-off-by: Espen Jürgensen <espenjurgensen+openwrt@gmail.com>
* add preliminary kresd dns backend support for turris devices,
see readme (experimental / untested!)
* use tld compression for overall list, too
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
Adds support for interface tracking using either ping, arping or
httping. This allows to track interface status on networks with filtered
ICMP traffic or simply to monitor data link layer etc.
To facilitate binding to a specified interface its IP address is passed
as a new mwan3track parameter. It's currently required by httping
and possibly by other tools that may be added in the future.
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
Stijn Tintel
Philip Prindeville
Peter Wagner
Hannu Nyman
Daniel Engberg
Dirk Brenken
champtar
Christian Schoenebeck
ejurgensen
Lars Schumann
Yousong Zhou
Denis Shulyaka
Marcin Jurkowski
Jo-Philipp Wich
Alexandru Ardelean
Daniel Golle
Michael Braun
Jason A. Donenfeld