summaryrefslogtreecommitdiff
path: root/sbin/iked/config.c
AgeCommit message (Collapse)Author
2021-11-24Pass env to pfkey API. Consistently call pfkey file descriptor fd.Tobias Heider
ok bluhm@
2021-10-12Make sure all copies of MSCHAPv2 passphrase are zeroed after use.Tobias Heider
ok patrick@
2021-09-18freezero() instead of free(), because the object may contain a passwordTheo de Raadt
ok tobhe
2021-09-01Add client side support for DNS configuration. Use RTM_PROPOSAL_STATICTobias Heider
route messages to propose the name server to resolvd(8). For now, iked will only propose a single name server from the first established connection. Automatic name server configuration is enabled by default for policies using the 'iface' option. discussed with deraadt@ ok for the DNS parts florian@ ok for the rest patrick@
2021-05-13Refactor iked process shutdown and cleanup. Remember configuredtobhe
addresses and routes in iked_vroute_sc to not depend on ikev2 process for cleanup. This makes sure that all flows, routes and addresses are deleted no matter which process is killed first. ok patrick@
2021-02-22Don't pass 'id' as argument to make function signature match similartobhe
functions. config_setpfkey() is always called with id PROC_IKEV2.
2021-02-13Add dynamic address configuration for roadwarrior clients.tobhe
The new 'iface' config option can be used to specify an interface for the virtual addresses received from the peer. Routes are automatically added based on the configured flows. Input from sthen@ and claudio@ ok patrick@
2021-02-08Clean up kernel IPsec flows and security associations on shutdown.tobhe
Discussed with sthen@ ok patrick@
2021-01-21Add support for INVALID_KE_PAYLOAD in CREATE_CHILD_SAtobhe
exchange. In the case of an invalid KE error, retry CREATE_CHILD_SA exchange with different group instead of restarting the full IKE handshake. ok markus@
2020-11-29Add 'set stickyaddress' option. If this option is enabled, iked will trytobhe
to assign the same 'config address' when an IKESA is negotiated with the DSTID of an existing IKESA. The original IKESA will be closed and the address will be transferred to the new IKESA. ok patrick@
2020-11-25Fix proposal error handling. If a proposal contains an unknown transformtobhe
type or id, ignore the proposal instead of failing the exchange. ok patrick@
2020-10-29Add initial support to request IP addresses as IKEv2 initiator.tobhe
At the moment the address is only negotiated and printed to the log. If 'request addr 0.0.0.0' is configured, any address will be accepted. ok patrick@
2020-10-21Remove SAs from ike_dstid_sas on 'ikectl reset sa' to prevent use after free.tobhe
Found by csszep <csszep (at) gmail (dot) com> ok patrick@
2020-10-09More unused headers.tobhe
2020-10-09Remove unused "wait.h" includes.tobhe
2020-09-30Don't leak sa->sa_peerauth.id_buf.tobhe
ok patrick@
2020-09-25Simplify RB_TREE cleanup loops.tobhe
ok markus@
2020-09-23Add new 'set cert_partial_chain' config option to allow verification oftobhe
partial certificate chains if a trusted intermediate CA is found in /etc/iked/ca/. ok patrick@
2020-08-26Allow disabling DPD liveness checks by setting dpd_check_interval to 0.tobhe
ok patrick@
2020-08-25Add dpd_check_interval configuration option. If for any IKE SA no IPsectobhe
or IKE message has been received within the specified time interval, iked will start sending DPD messages. ok patrick@
2020-08-24Reduce the amount of boilerplate code and imsgs for config options bytobhe
grouping fixed-size values in 'struct iked_static' which is sent in a single message. ok patrick@
2020-08-23Add a new configuration option to limit the number of connections fortobhe
each peer (identified by their 'dstid'). When 'set enforcesingleikesa' is enabled, each peer can only have one active IKE SA at a time. On successful authentication of a new connection, the old IKE SA is automatically deleted. ok patrick@
2020-08-18Add optional time-stamp validaten for ocsp. The new optional 'tolerate'tobhe
parameter specifies how many seconds leeway are allowed in the check. The optional maxage parameter indicates the allowed maximum age of the `thisUpdate' OCSP attribute value. ok patrick@
2020-08-16Clean up unused parameters.tobhe
2020-08-14Clean up unused variables.tobhe
2020-07-23Fix ibuf leak in sa_localauth when SA is freed.tobhe
ok patrick@
2020-04-13Try to send a DELETE message if the SA is reset with 'ikectl reset id'.tobhe
This way the peer can delete its SAs and eventually reestablish the connection without having to wait for a timeout. ok markus@
2020-04-09Simplify socket creation logic. Normally iked needs two sockets, onetobhe
for normal operation (UDP port 500) and one for NAT traversal (UDP 4500). There are several command line options resulting in only one of the sockets being created (-T, -t and -p). Add a new 'enum natt_mode' to make the logic for those somewhat less complicated as well as some comments where it makes sense. From Wataru Ashihara <wataash (at) wataash (dot) com> ok patrick@
2020-03-24Fix user database corruption from 'ikectl reload'. Copy only the new passwordtobhe
instead of the full iked_user struct to preserve the RB_TREE pointers. From Bernardo Cunha Vieira <bernardo (dot) vieira (at) almg (dot) gov (dot) br> ok patrick@
2020-03-09Use TAILQ_FOREACH_SAFE instead of hand rolled loops.tobhe
From Wataru <wataash at wataash dot com> ok patrick@
2020-01-16Add '-p' command line option which allows to configuretobhe
the UDP encapsulation port, similar to isakmpd's '-N' flag. Being able to change the UDP encapsulation port is useful in cases where ESP and UDP ports 500 and 4500 are blocked or rate limited. ok sthen@
2020-01-07Link ESP-SA and IPcomp-SA using GRPSPIS instead of using a self-builttobhe
solution for multi-SA flows. As a result we only need a single outgoing IPCOMP flow and can get rid of the two extra transport mode flows for ESP. ok bluhm@
2019-12-03Correctly represent flows as traffic selectors as described in RFC 7296. Thistobhe
allows us to deduplicate the network ranges sent in the TS payload and saves some bytes on the wire. ok patrick@
2019-05-11Add support for IKEv2 Message Fragmentation as defined in RFC 7383.Patrick Wildt
ok sthen@
2017-11-27Implement MOBIKE (RFC 4555) support in iked(8), with us acting asPatrick Wildt
responder. In practice this support means that clients like iPhones can roam in different networks (LTE, WiFi) and change their external addresses without having to re-do the whole handshake. It allows the client to choose how and when to change the external tunnel endpoint addresses on demand, depending on which network is better or even is connected at all. ok sthen@ tweaks from jmc@ tested by a handful
2017-04-13Add a NAT-T keepalive timer in case we are behind a NAT gateway.Patrick Wildt
See RFC 5996, section 2.23, NAT Traversal: In the case of a mismatching NAT_DETECTION_DESTINATION_IP hash, it means that the system receiving the NAT_DETECTION_DESTINATION_IP payload is behind a NAT and that system SHOULD start sending keepalive packets as defined in [UDPENCAPS]. With markus@, ok reyk@
2017-03-27Factor out flows into separate configuration messagesMike Belopuhov
We reach an imsg payload limit with just a few traffic selectors so in order to load more we need to split them up and send separately. Suggested and OK reyk
2017-03-27spacingReyk Floeter
2017-03-27Fix another iked leak of SAs in pfkey_sa(), copy tags correctly.Reyk Floeter
Diff from markus@ OK mikeb@ patrick@
2017-03-13Resolve simultaneous Child SA rekeyingMike Belopuhov
From and OK markus, OK reyk
2017-01-03Fix pledge of the ca process by calling the right function on startup.Reyk Floeter
As a related change, load the local.pub and local.key keys after privsep and reload them on SIGHUP/reload. OK mikeb@
2016-06-01Implement a second address pool specifically for IPv6, so thatPatrick Wildt
clients can be given an IPv4 and IPv6 address at the same time, thus enabling dual stack usage. ok markus@ mikeb@
2015-12-07Sync proc.c, use shorter proc_compose[v]()Reyk Floeter
2015-11-18pledge exposed a simple bug: the unprivileged child tried to print theReyk Floeter
policy after receiving it from the parent. print_policy -> print_proto -> getprotobynumber -> pledge abort because it tried to access /etc/protocols without rpath. It was just a debugging message that can be moved to the parent (printing the policy on the sender side and not the receiver side). The parent has rpath and dns. Issue found by sthen@ with "proto etherip" OK sthen@ benno@
2015-10-19Remove the ikev1 stub - Since I started iked, it has an empty privsepReyk Floeter
process for ISAKMP+IKEv1. I kept it to let somebody either contribute the old protocol one day, I never intended to implement IKEv1 myself, or to add a new kind of pipe to isakmpd to hand off IKEv1 messages. As IKEv2 is widely supported by all major OS and networking vendors now, I'm happy to scrap the idea of supporting ISAKMP+IKEv1. It is still possible to use isakmpd for legacy VPNs. OK mikeb@
2015-10-15Remove some unnecessary NULL-checks before free(). Change two bzero()mmcc
calls on pf data to explicit_bzero(). ok mikeb@
2015-08-21Switch iked to C99-style fixed-width integer types.Reyk Floeter
OK mikeb@
2015-07-07repair policy-ikesa-linking by replacing the broken RB_TREE w/TAILQMarkus Friedl
(e.g. the policy might be used-after-free on 'ikectl reconfig') ok mikeb@
2015-02-06unneeded getopt.hTheo de Raadt
2015-01-16Replace <sys/param.h> with <limits.h> and other less dirty headers whereTheo de Raadt
possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-01 23:00:33 +0000