Unfortunately python-cryptography (after version 2.0.<something>)
decided to replace `pyasn1` with `asn1crypto`.
Unfortunately `pyasn1` is needed for another package,
so it can't be dropped just yet.
Not sure if dropping it would bother people.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Add new globals config section with option local_source.
With this config option the self interface generation will be done now
automatically on hotplug event. You can specify which interface (ip)
sould be used for router traffic. To replace the self intereface in the
config set local_source to "lan".
The default option is none, so it will not change default behavior if a
"self" interface is configured in the network section.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
To know how old the ubus output is, add an age parameter which indicats
how old the check informations on the interface are.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add new interface config option "inital_state".
If interface comeing up the first time(mwan3 start, boot),
there are now two option for interface behaviour:
- online (default as is now)
Set up interface regardless wether tracking ip are reachable or not.
- offline
Set up interface first to ping tracking ip and if they are reachable set up
the interface completely.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Even though error was fixed the interface checks still fails, if last_resort
was set to blackhole or unreachable.
To fix this issue do not remove failure interface from iptables change on
down event.
Reported-by: Colby Whitney <colby.whitney@luxul.com>
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
If two interface have the same prefix "wan" for example "wan" and "wan1"
pgrep returns the PID for wan1 also "pgrep -f mwan3track wan".
Before this fix "wan1" was also killed! This is not what we want.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rearrange dependencies
General cleanup of Makefile
Fix compilation and linking problems
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
Signed-off-by: Ted Hess <thess@kitschensync.net>
* print only 'missing plugins support warning' if user really configured
'blacklist' or 'block_ipv6' parameter.
Signed-off-by: Dirk Brenken <dev@brenken.org>
When the strongswan service is running, `ipsec status` returns 0. Check
the return value instead of checking its output.
While at it, remove the [[ ]] bashism, use rereadall instead of
(reread)secrets, and move it inside the if statement.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
In commit 36e073d820, some checks were
added to see if the UCI config file exists and if there are any peers
configured in it. Due to these checks, if /etc/config/ipsec exists, but
contains no enabled peers, strongswan will not be started. This is not
ideal, as a user might want to experiment with the UCI config while
keeping existing connections in /etc/ipsec.conf operational.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Since the strongswan-utils package now only contains the aging ipsec
utility, rename it to strongswan-ipsec.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
We currently include the SCEP client in strongswan-utils, which is a
dependency of the strongswan-default meta-package. As it's generally not
recommended to generate keys on embedded devices due to lack of entropy,
move the SCEP client to a separate package, and only depend on it in the
strongswan-full meta-package.
While at it, add scepclient.conf to the package.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
We currently include the PKI tool in strongswan-utils, which is a
dependency of the strongswan-default meta-package. As it's generally not
recommended to generate keys on embedded devices due to lack of entropy,
move the PKI tool to a separate package, and only depend on it in the
strongswan-full meta-package.
While at it, add pki.conf to the package.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Alexandru Ardelean
Hannu Nyman
Peter Wagner
Val Kulkov
Florian Eckert
Kevin Darbyshire-Bryant
Ted Hess
Noah Meyerhans
Daniel Engberg
Dirk Brenken
Michael Heimpold
Stijn Tintel