src - OpenBSD base system

diff options


context:
space:
mode:

author	Stuart Henderson <sthen@cvs.openbsd.org>	2019-02-27 06:33:58 +0000
committer	Stuart Henderson <sthen@cvs.openbsd.org>	2019-02-27 06:33:58 +0000
commit	33e9a40b06d0668a7c8ce75aba6d6bff87e7cb52 (patch)
tree	202f905a022fe58c166ccff1ce4e6873da3a5db2 /sbin/iked
parent	7970895f9d71d51ee676e3a4e778e9563267e63c (diff)

update RFC references, from tobias_heider at genua.de, ok claudio@

Diffstat (limited to 'sbin/iked')

-rw-r--r--

-rw-r--r--

-rw-r--r--

-rw-r--r--

138

4 files changed, 79 insertions, 78 deletions

diff --git a/sbin/iked/ca.c b/sbin/iked/ca.c
index 1911f339a09..98b6b8a40f5 100644
--- a/sbin/iked/ca.c
+++ b/sbin/iked/ca.c

@@ -1,4 +1,4 @@

-/* $OpenBSD: ca.c,v 1.46 2017/10/30 09:53:27 patrick Exp $ */

+/* $OpenBSD: ca.c,v 1.47 2019/02/27 06:33:56 sthen Exp $ */

@@ -808,7 +808,7 @@ ca_subjectpubkey_digest(X509 *x509, uint8_t *md, unsigned int *size)

* Generate a SHA-1 digest of the Subject Public Key Info

* element in the X.509 certificate, an ASN.1 sequence

* that includes the public key type (eg. RSA) and the

- * public key value (see 3.7 of RFC4306).

+ * public key value (see 3.7 of RFC7296).

if ((pkey = X509_get_pubkey(x509)) == NULL)

return (-1);

diff --git a/sbin/iked/iked.8 b/sbin/iked/iked.8
index c42e03d38e1..f715db47afd 100644
--- a/sbin/iked/iked.8
+++ b/sbin/iked/iked.8

@@ -1,4 +1,4 @@

-.\" $OpenBSD: iked.8,v 1.21 2018/07/03 13:37:11 stsp Exp $

+.\" $OpenBSD: iked.8,v 1.22 2019/02/27 06:33:56 sthen Exp $

.\"

@@ -14,7 +14,7 @@

.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

.\"

-.Dd $Mdocdate: July 3 2018 $

+.Dd $Mdocdate: February 27 2019 $

.Dt IKED 8

.Os

.Sh NAME

@@ -31,7 +31,7 @@ is an Internet Key Exchange (IKEv2) daemon which performs mutual

authentication and which establishes and maintains IPsec flows and

security associations (SAs) between the two peers.

.Pp

-The IKEv2 protocol is defined in RFC 5996,

+The IKEv2 protocol is defined in RFC 7296,

which combines and updates the previous standards:

ISAKMP/Oakley (RFC 2408),

IKE (RFC 2409),

@@ -187,8 +187,9 @@ control socket.

.%A P. Hoffman

.%A Y. Nir

.%A P. Eronen

-.%D September 2010

-.%R RFC 5996

+.%A T. Kivinen

+.%D October 2014

+.%R RFC 7296

.%T Internet Key Exchange Protocol Version 2 (IKEv2)

.Re

.Sh HISTORY

diff --git a/sbin/iked/ikev2.c b/sbin/iked/ikev2.c
index dd6264dd272..c928267a682 100644
--- a/sbin/iked/ikev2.c
+++ b/sbin/iked/ikev2.c

@@ -1,4 +1,4 @@

-/* $OpenBSD: ikev2.c,v 1.167 2019/02/26 18:05:22 patrick Exp $ */

+/* $OpenBSD: ikev2.c,v 1.168 2019/02/27 06:33:56 sthen Exp $ */

@@ -4585,7 +4585,7 @@ ikev2_sa_keys(struct iked *env, struct iked_sa *sa, struct ibuf *key)

* (Ni | Nr) is used as a PRF key, otherwise a "key" buffer

* is used and PRF is performed on the concatenation of DH

* exchange result and nonces (g^ir | Ni | Nr). See sections

- * 2.14 and 2.18 of RFC5996 for more information.

+ * 2.14 and 2.18 of RFC7296 for more information.

diff --git a/sbin/iked/ikev2.h b/sbin/iked/ikev2.h
index 48c6a6d4820..2b4bead5d42 100644
--- a/sbin/iked/ikev2.h
+++ b/sbin/iked/ikev2.h

@@ -1,4 +1,4 @@

-/* $OpenBSD: ikev2.h,v 1.27 2017/12/03 21:02:44 patrick Exp $ */

+/* $OpenBSD: ikev2.h,v 1.28 2019/02/27 06:33:57 sthen Exp $ */

@@ -184,7 +184,7 @@ extern struct iked_constmap ikev2_xformtype_map[];

extern struct iked_constmap ikev2_xformencr_map[];

-#define IKEV2_IPCOMP_OUI 1 /* RFC5996 */

+#define IKEV2_IPCOMP_OUI 1 /* UNSPECIFIED */

#define IKEV2_IPCOMP_DEFLATE 2 /* RFC2394 */

#define IKEV2_IPCOMP_LZS 3 /* RFC2395 */

#define IKEV2_IPCOMP_LZJH 4 /* RFC3051 */

@@ -283,38 +283,38 @@ struct ikev2_notify {

/* Followed by variable length notification data */

} __packed;

-#define IKEV2_N_UNSUPPORTED_CRITICAL_PAYLOAD 1 /* RFC4306 */

-#define IKEV2_N_INVALID_IKE_SPI 4 /* RFC4306 */

-#define IKEV2_N_INVALID_MAJOR_VERSION 5 /* RFC4306 */

-#define IKEV2_N_INVALID_SYNTAX 7 /* RFC4306 */

-#define IKEV2_N_INVALID_MESSAGE_ID 9 /* RFC4306 */

-#define IKEV2_N_INVALID_SPI 11 /* RFC4306 */

-#define IKEV2_N_NO_PROPOSAL_CHOSEN 14 /* RFC4306 */

-#define IKEV2_N_INVALID_KE_PAYLOAD 17 /* RFC4306 */

-#define IKEV2_N_AUTHENTICATION_FAILED 24 /* RFC4306 */

-#define IKEV2_N_SINGLE_PAIR_REQUIRED 34 /* RFC4306 */

-#define IKEV2_N_NO_ADDITIONAL_SAS 35 /* RFC4306 */

-#define IKEV2_N_INTERNAL_ADDRESS_FAILURE 36 /* RFC4306 */

-#define IKEV2_N_FAILED_CP_REQUIRED 37 /* RFC4306 */

-#define IKEV2_N_TS_UNACCEPTABLE 38 /* RFC4306 */

-#define IKEV2_N_INVALID_SELECTORS 39 /* RFC4306 */

+#define IKEV2_N_UNSUPPORTED_CRITICAL_PAYLOAD 1 /* RFC7296 */

+#define IKEV2_N_INVALID_IKE_SPI 4 /* RFC7296 */

+#define IKEV2_N_INVALID_MAJOR_VERSION 5 /* RFC7296 */

+#define IKEV2_N_INVALID_SYNTAX 7 /* RFC7296 */

+#define IKEV2_N_INVALID_MESSAGE_ID 9 /* RFC7296 */

+#define IKEV2_N_INVALID_SPI 11 /* RFC7296 */

+#define IKEV2_N_NO_PROPOSAL_CHOSEN 14 /* RFC7296 */

+#define IKEV2_N_INVALID_KE_PAYLOAD 17 /* RFC7296 */

+#define IKEV2_N_AUTHENTICATION_FAILED 24 /* RFC7296 */

+#define IKEV2_N_SINGLE_PAIR_REQUIRED 34 /* RFC7296 */

+#define IKEV2_N_NO_ADDITIONAL_SAS 35 /* RFC7296 */

+#define IKEV2_N_INTERNAL_ADDRESS_FAILURE 36 /* RFC7296 */

+#define IKEV2_N_FAILED_CP_REQUIRED 37 /* RFC7296 */

+#define IKEV2_N_TS_UNACCEPTABLE 38 /* RFC7296 */

+#define IKEV2_N_INVALID_SELECTORS 39 /* RFC7296 */

#define IKEV2_N_UNACCEPTABLE_ADDRESSES 40 /* RFC4555 */

#define IKEV2_N_UNEXPECTED_NAT_DETECTED 41 /* RFC4555 */

#define IKEV2_N_USE_ASSIGNED_HoA 42 /* RFC5026 */

-#define IKEV2_N_TEMPORARY_FAILURE 43 /* RFC5996 */

-#define IKEV2_N_CHILD_SA_NOT_FOUND 44 /* RFC5996 */

-#define IKEV2_N_INITIAL_CONTACT 16384 /* RFC4306 */

-#define IKEV2_N_SET_WINDOW_SIZE 16385 /* RFC4306 */

-#define IKEV2_N_ADDITIONAL_TS_POSSIBLE 16386 /* RFC4306 */

-#define IKEV2_N_IPCOMP_SUPPORTED 16387 /* RFC4306 */

-#define IKEV2_N_NAT_DETECTION_SOURCE_IP 16388 /* RFC4306 */

-#define IKEV2_N_NAT_DETECTION_DESTINATION_IP 16389 /* RFC4306 */

-#define IKEV2_N_COOKIE 16390 /* RFC4306 */

-#define IKEV2_N_USE_TRANSPORT_MODE 16391 /* RFC4306 */

-#define IKEV2_N_HTTP_CERT_LOOKUP_SUPPORTED 16392 /* RFC4306 */

-#define IKEV2_N_REKEY_SA 16393 /* RFC4306 */

-#define IKEV2_N_ESP_TFC_PADDING_NOT_SUPPORTED 16394 /* RFC4306 */

-#define IKEV2_N_NON_FIRST_FRAGMENTS_ALSO 16395 /* RFC4306 */

+#define IKEV2_N_TEMPORARY_FAILURE 43 /* RFC7296 */

+#define IKEV2_N_CHILD_SA_NOT_FOUND 44 /* RFC7296 */

+#define IKEV2_N_INITIAL_CONTACT 16384 /* RFC7296 */

+#define IKEV2_N_SET_WINDOW_SIZE 16385 /* RFC7296 */

+#define IKEV2_N_ADDITIONAL_TS_POSSIBLE 16386 /* RFC7296 */

+#define IKEV2_N_IPCOMP_SUPPORTED 16387 /* RFC7296 */

+#define IKEV2_N_NAT_DETECTION_SOURCE_IP 16388 /* RFC7296 */

+#define IKEV2_N_NAT_DETECTION_DESTINATION_IP 16389 /* RFC7296 */

+#define IKEV2_N_COOKIE 16390 /* RFC7296 */

+#define IKEV2_N_USE_TRANSPORT_MODE 16391 /* RFC7296 */

+#define IKEV2_N_HTTP_CERT_LOOKUP_SUPPORTED 16392 /* RFC7296 */

+#define IKEV2_N_REKEY_SA 16393 /* RFC7296 */

+#define IKEV2_N_ESP_TFC_PADDING_NOT_SUPPORTED 16394 /* RFC7296 */

+#define IKEV2_N_NON_FIRST_FRAGMENTS_ALSO 16395 /* RFC7296 */

#define IKEV2_N_MOBIKE_SUPPORTED 16396 /* RFC4555 */

#define IKEV2_N_ADDITIONAL_IP4_ADDRESS 16397 /* RFC4555 */

#define IKEV2_N_ADDITIONAL_IP6_ADDRESS 16398 /* RFC4555 */

@@ -334,8 +334,8 @@ struct ikev2_notify {

#define IKEV2_N_TICKET_NACK 16412 /* RFC5723 */

#define IKEV2_N_TICKET_OPAQUE 16413 /* RFC5723 */

#define IKEV2_N_LINK_ID 16414 /* RFC5739 */

-#define IKEV2_N_USE_WESP_MODE 16415 /* RFC-ietf-ipsecme-traffic-visibility-12.txt */

-#define IKEV2_N_ROHC_SUPPORTED 16416 /* RFC-ietf-rohc-ikev2-extensions-hcoipsec-12.txt */

+#define IKEV2_N_USE_WESP_MODE 16415 /* RFC5415 */

+#define IKEV2_N_ROHC_SUPPORTED 16416 /* RFC5857 */

#define IKEV2_N_EAP_ONLY_AUTHENTICATION 16417 /* RFC5998 */

#define IKEV2_N_CHILDLESS_IKEV2_SUPPORTED 16418 /* RFC6023 */

#define IKEV2_N_QUICK_CRASH_DETECTION 16419 /* RFC6290 */

@@ -375,13 +375,13 @@ struct ikev2_id {

} __packed;

#define IKEV2_ID_NONE 0 /* No ID */

-#define IKEV2_ID_IPV4 1 /* RFC4306 (ID_IPV4_ADDR) */

-#define IKEV2_ID_FQDN 2 /* RFC4306 */

-#define IKEV2_ID_UFQDN 3 /* RFC4306 (ID_RFC822_ADDR) */

-#define IKEV2_ID_IPV6 5 /* RFC4306 (ID_IPV6_ADDR) */

-#define IKEV2_ID_ASN1_DN 9 /* RFC4306 */

-#define IKEV2_ID_ASN1_GN 10 /* RFC4306 */

-#define IKEV2_ID_KEY_ID 11 /* RFC4306 */

+#define IKEV2_ID_IPV4 1 /* RFC7296 (ID_IPV4_ADDR) */

+#define IKEV2_ID_FQDN 2 /* RFC7296 */

+#define IKEV2_ID_UFQDN 3 /* RFC7296 (ID_RFC822_ADDR) */

+#define IKEV2_ID_IPV6 5 /* RFC7296 (ID_IPV6_ADDR) */

+#define IKEV2_ID_ASN1_DN 9 /* RFC7296 */

+#define IKEV2_ID_ASN1_GN 10 /* RFC7296 */

+#define IKEV2_ID_KEY_ID 11 /* RFC7296 */

#define IKEV2_ID_FC_NAME 12 /* RFC4595 */

extern struct iked_constmap ikev2_id_map[];

@@ -396,18 +396,18 @@ struct ikev2_cert {

} __packed;

#define IKEV2_CERT_NONE 0 /* None */

-#define IKEV2_CERT_X509_PKCS7 1 /* RFC4306 */

-#define IKEV2_CERT_PGP 2 /* RFC4306 */

-#define IKEV2_CERT_DNS_SIGNED_KEY 3 /* RFC4306 */

-#define IKEV2_CERT_X509_CERT 4 /* RFC4306 */

-#define IKEV2_CERT_KERBEROS_TOKEN 6 /* RFC4306 */

-#define IKEV2_CERT_CRL 7 /* RFC4306 */

-#define IKEV2_CERT_ARL 8 /* RFC4306 */

-#define IKEV2_CERT_SPKI 9 /* RFC4306 */

-#define IKEV2_CERT_X509_ATTR 10 /* RFC4306 */

-#define IKEV2_CERT_RSA_KEY 11 /* RFC4306 */

-#define IKEV2_CERT_HASHURL_X509 12 /* RFC4306 */

-#define IKEV2_CERT_HASHURL_X509_BUNDLE 13 /* RFC4306 */

+#define IKEV2_CERT_X509_PKCS7 1 /* UNSPECIFIED */

+#define IKEV2_CERT_PGP 2 /* UNSPECIFIED */

+#define IKEV2_CERT_DNS_SIGNED_KEY 3 /* UNSPECIFIED */

+#define IKEV2_CERT_X509_CERT 4 /* RFC7296 */

+#define IKEV2_CERT_KERBEROS_TOKEN 6 /* UNSPECIFIED */

+#define IKEV2_CERT_CRL 7 /* RFC7296 */

+#define IKEV2_CERT_ARL 8 /* UNSPECIFIED */

+#define IKEV2_CERT_SPKI 9 /* UNSPECIFIED */

+#define IKEV2_CERT_X509_ATTR 10 /* UNSPECIFIED */

+#define IKEV2_CERT_RSA_KEY 11 /* RFC7296 */

+#define IKEV2_CERT_HASHURL_X509 12 /* RFC7296 */

+#define IKEV2_CERT_HASHURL_X509_BUNDLE 13 /* RFC7296 */

#define IKEV2_CERT_OCSP 14 /* RFC4806 */

* As of November 2014, work was still in progress to add a more generic

@@ -436,8 +436,8 @@ struct ikev2_ts {

uint16_t ts_endport; /* End port */

} __packed;

-#define IKEV2_TS_IPV4_ADDR_RANGE 7 /* RFC4306 */

-#define IKEV2_TS_IPV6_ADDR_RANGE 8 /* RFC4306 */

+#define IKEV2_TS_IPV4_ADDR_RANGE 7 /* RFC7296 */

+#define IKEV2_TS_IPV6_ADDR_RANGE 8 /* RFC7296 */

#define IKEV2_TS_FC_ADDR_RANGE 9 /* RFC4595 */

extern struct iked_constmap ikev2_ts_map[];

@@ -453,9 +453,9 @@ struct ikev2_auth {

} __packed;

#define IKEV2_AUTH_NONE 0 /* None */

-#define IKEV2_AUTH_RSA_SIG 1 /* RFC4306 */

-#define IKEV2_AUTH_SHARED_KEY_MIC 2 /* RFC4306 */

-#define IKEV2_AUTH_DSS_SIG 3 /* RFC4306 */

+#define IKEV2_AUTH_RSA_SIG 1 /* RFC7296 */

+#define IKEV2_AUTH_SHARED_KEY_MIC 2 /* RFC7296 */

+#define IKEV2_AUTH_DSS_SIG 3 /* RFC7296 */

#define IKEV2_AUTH_ECDSA_256 9 /* RFC4754 */

#define IKEV2_AUTH_ECDSA_384 10 /* RFC4754 */

#define IKEV2_AUTH_ECDSA_521 11 /* RFC4754 */

@@ -504,20 +504,20 @@ struct ikev2_cfg {

/* Followed by variable-length data */

} __packed;

-#define IKEV2_CFG_INTERNAL_IP4_ADDRESS 1 /* RFC5996 */

-#define IKEV2_CFG_INTERNAL_IP4_NETMASK 2 /* RFC5996 */

-#define IKEV2_CFG_INTERNAL_IP4_DNS 3 /* RFC5996 */

-#define IKEV2_CFG_INTERNAL_IP4_NBNS 4 /* RFC5996 */

+#define IKEV2_CFG_INTERNAL_IP4_ADDRESS 1 /* RFC7296 */

+#define IKEV2_CFG_INTERNAL_IP4_NETMASK 2 /* RFC7296 */

+#define IKEV2_CFG_INTERNAL_IP4_DNS 3 /* RFC7296 */

+#define IKEV2_CFG_INTERNAL_IP4_NBNS 4 /* RFC7296 */

#define IKEV2_CFG_INTERNAL_ADDRESS_EXPIRY 5 /* RFC4306 */

-#define IKEV2_CFG_INTERNAL_IP4_DHCP 6 /* RFC5996 */

-#define IKEV2_CFG_APPLICATION_VERSION 7 /* RFC5996 */

-#define IKEV2_CFG_INTERNAL_IP6_ADDRESS 8 /* RFC5996 */

-#define IKEV2_CFG_INTERNAL_IP6_DNS 10 /* RFC5996 */

+#define IKEV2_CFG_INTERNAL_IP4_DHCP 6 /* RFC7296 */

+#define IKEV2_CFG_APPLICATION_VERSION 7 /* RFC7296 */

+#define IKEV2_CFG_INTERNAL_IP6_ADDRESS 8 /* RFC7296 */

+#define IKEV2_CFG_INTERNAL_IP6_DNS 10 /* RFC7296 */

#define IKEV2_CFG_INTERNAL_IP6_NBNS 11 /* RFC4306 */

-#define IKEV2_CFG_INTERNAL_IP6_DHCP 12 /* RFC5996 */

-#define IKEV2_CFG_INTERNAL_IP4_SUBNET 13 /* RFC5996 */

-#define IKEV2_CFG_SUPPORTED_ATTRIBUTES 14 /* RFC5996 */

-#define IKEV2_CFG_INTERNAL_IP6_SUBNET 15 /* RFC5996 */

+#define IKEV2_CFG_INTERNAL_IP6_DHCP 12 /* RFC7296 */

+#define IKEV2_CFG_INTERNAL_IP4_SUBNET 13 /* RFC7296 */

+#define IKEV2_CFG_SUPPORTED_ATTRIBUTES 14 /* RFC7296 */

+#define IKEV2_CFG_INTERNAL_IP6_SUBNET 15 /* RFC7296 */

#define IKEV2_CFG_MIP6_HOME_PREFIX 16 /* RFC5026 */

#define IKEV2_CFG_INTERNAL_IP6_LINK 17 /* RFC5739 */

#define IKEV2_CFG_INTERNAL_IP6_PREFIX 18 /* RFC5739 */