summaryrefslogtreecommitdiff
path: root/sbin/iked/config.c
AgeCommit message (Collapse)Author
2024-09-15Add handling of "Class" attribute. diff from markusYASUOKA Masahiko
ok markus
2024-07-13Add RADIUS support. Authentication, accounting, and "DynamicYASUOKA Masahiko
Authorization Extensions"(DAE) are supported. feedback markus stu ok tobhe
2024-02-15Delay enabling sockets until ikev2 process is ready.Tobias Heider
from markus@
2024-02-13Control startup of PROC_CERT and PROC_IKEV2.Tobias Heider
Currenly PROC_PARENT sends the configuration to both PROC_CERT and PROC_IKEV2 and finishes by sending IMSG_CTL_ACTIVE to PROC_IKEV2. However, when PROC_IKEV2 receives IMSG_CTL_ACTIVE it does not know the state of PROC_CERT: PROC_CERT might not have processed the initial configuration while PROC_IKEV2 already sends requests to PROC_CERT, causing failed requests, or even crashes (NULL deref of ca_certs). In order to make sure that PROC_CERT is ready before IMSG_CTL_ACTIVE is sent to PROC_IKEV2 that startup protocol is changed as follows: (1) PROC_PARENT sends configuration to both PROC_CERT and PROC_IKEV2 (2) PROC_PARENT sends IMSG_CTL_ACTIVE to PROC_CERT (3) PROC_CERT acks IMSG_CTL_ACTIVE by sending it back to PROC_PARENT (4) PROC_PARENT now knows that PROC_CERT is ready and has processed all messages from step (1) (5) PROC_PARENT sends IMSG_CTL_ACTIVE to PROC_IKEV2 and knows that IMSG_CTL_ACTIVE will be processed by PROC_IKEV2 after all messages from step (1) (6) PROC_IKEV2 can now assume that PROC_CERT is ready because it has already processed IMSG_CTL_ACTIVE from markus@
2024-01-17Convert to use imsg_get_fd()Claudio Jeker
proc_forward_imsg() does not need to forward file descriptors so just use -1 there. In other places shuffle debug messages around or use a helper variable since imsg_get_fd() can only be called once. OK tb@ tobhe@
2024-01-15Include cert_partial_chain in iked_static instead of sending a separateTobias Heider
message. from markus@
2023-08-04Convert calls to ibuf_length() where it is clear that the ibuf is notClaudio Jeker
NULL to ibuf_size(). In some cases it is clear that the ibuf pointer should just be checked for NULL since afterwards a new ibuf is allocated in its place. OK tb@
2023-05-23Replace ibuf_release() with ibuf_free() since the former just calls the latterClaudio Jeker
OK kn@ tb@
2022-12-03Consistently use uintXX_t from <stdint.h> instead of u_intXX_t.Tobias Heider
2022-11-18Revert my last two changes.Moritz Buhl
If csa_bundled is set, exactly two csas exist and they point to each other. Therefore childsa_free already sets the bundled csa pointer to NULL and it shouldn't be done after calling childsa_free. ok tobhe@
2022-11-13Make sure csa->csa_bundled is NULL after freeing to prevent aMoritz Buhl
possible use after free. ok tobhe@
2022-10-10Move enabling the policy refcounting from policy_ref() to config_free_policy().Tobias Heider
In config_free_policy() the refcounting is unchanged and each SA linked to the policy will trigger a call to policy_ref() and increase the references as before the change. This allows unconditional calls to policy_ref() and policy_unref() and the callers no longer have to check if IKED_POLICY_REFCNT is set. From and ok markus@
2022-09-19Add iked connection statistics for successful and failed connections, commonTobias Heider
error types and other events that help analyze errors in larger setups. The counters can be printed with 'ikectl show stats'. ok bluhm@ patrick@ from and ok markus@
2022-07-08Support sending certificate chains with intermediate CAs in multiple CERTTobias Heider
payloads. Local certificate chains as required with LetsEncrypt certs will work between iked and other IKEv2 implementations, iked to iked connections won't work yet because of missing support to receive multiple CERT payloads. from Katsuhiro Ueno tested by and ok sthen@
2022-05-08Move ikev2_reset_alive_timer() to a place where it makes more sense. The ideaTobias Heider
is to renew the timer every time sc_alive_timeout is reset after loading a new config. ok patrick@
2021-11-25Silence unitialized variable warnings.Tobias Heider
2021-11-24Pass env to pfkey API. Consistently call pfkey file descriptor fd.Tobias Heider
ok bluhm@
2021-10-12Make sure all copies of MSCHAPv2 passphrase are zeroed after use.Tobias Heider
ok patrick@
2021-09-18freezero() instead of free(), because the object may contain a passwordTheo de Raadt
ok tobhe
2021-09-01Add client side support for DNS configuration. Use RTM_PROPOSAL_STATICTobias Heider
route messages to propose the name server to resolvd(8). For now, iked will only propose a single name server from the first established connection. Automatic name server configuration is enabled by default for policies using the 'iface' option. discussed with deraadt@ ok for the DNS parts florian@ ok for the rest patrick@
2021-05-13Refactor iked process shutdown and cleanup. Remember configuredtobhe
addresses and routes in iked_vroute_sc to not depend on ikev2 process for cleanup. This makes sure that all flows, routes and addresses are deleted no matter which process is killed first. ok patrick@
2021-02-22Don't pass 'id' as argument to make function signature match similartobhe
functions. config_setpfkey() is always called with id PROC_IKEV2.
2021-02-13Add dynamic address configuration for roadwarrior clients.tobhe
The new 'iface' config option can be used to specify an interface for the virtual addresses received from the peer. Routes are automatically added based on the configured flows. Input from sthen@ and claudio@ ok patrick@
2021-02-08Clean up kernel IPsec flows and security associations on shutdown.tobhe
Discussed with sthen@ ok patrick@
2021-01-21Add support for INVALID_KE_PAYLOAD in CREATE_CHILD_SAtobhe
exchange. In the case of an invalid KE error, retry CREATE_CHILD_SA exchange with different group instead of restarting the full IKE handshake. ok markus@
2020-11-29Add 'set stickyaddress' option. If this option is enabled, iked will trytobhe
to assign the same 'config address' when an IKESA is negotiated with the DSTID of an existing IKESA. The original IKESA will be closed and the address will be transferred to the new IKESA. ok patrick@
2020-11-25Fix proposal error handling. If a proposal contains an unknown transformtobhe
type or id, ignore the proposal instead of failing the exchange. ok patrick@
2020-10-29Add initial support to request IP addresses as IKEv2 initiator.tobhe
At the moment the address is only negotiated and printed to the log. If 'request addr 0.0.0.0' is configured, any address will be accepted. ok patrick@
2020-10-21Remove SAs from ike_dstid_sas on 'ikectl reset sa' to prevent use after free.tobhe
Found by csszep <csszep (at) gmail (dot) com> ok patrick@
2020-10-09More unused headers.tobhe
2020-10-09Remove unused "wait.h" includes.tobhe
2020-09-30Don't leak sa->sa_peerauth.id_buf.tobhe
ok patrick@
2020-09-25Simplify RB_TREE cleanup loops.tobhe
ok markus@
2020-09-23Add new 'set cert_partial_chain' config option to allow verification oftobhe
partial certificate chains if a trusted intermediate CA is found in /etc/iked/ca/. ok patrick@
2020-08-26Allow disabling DPD liveness checks by setting dpd_check_interval to 0.tobhe
ok patrick@
2020-08-25Add dpd_check_interval configuration option. If for any IKE SA no IPsectobhe
or IKE message has been received within the specified time interval, iked will start sending DPD messages. ok patrick@
2020-08-24Reduce the amount of boilerplate code and imsgs for config options bytobhe
grouping fixed-size values in 'struct iked_static' which is sent in a single message. ok patrick@
2020-08-23Add a new configuration option to limit the number of connections fortobhe
each peer (identified by their 'dstid'). When 'set enforcesingleikesa' is enabled, each peer can only have one active IKE SA at a time. On successful authentication of a new connection, the old IKE SA is automatically deleted. ok patrick@
2020-08-18Add optional time-stamp validaten for ocsp. The new optional 'tolerate'tobhe
parameter specifies how many seconds leeway are allowed in the check. The optional maxage parameter indicates the allowed maximum age of the `thisUpdate' OCSP attribute value. ok patrick@
2020-08-16Clean up unused parameters.tobhe
2020-08-14Clean up unused variables.tobhe
2020-07-23Fix ibuf leak in sa_localauth when SA is freed.tobhe
ok patrick@
2020-04-13Try to send a DELETE message if the SA is reset with 'ikectl reset id'.tobhe
This way the peer can delete its SAs and eventually reestablish the connection without having to wait for a timeout. ok markus@
2020-04-09Simplify socket creation logic. Normally iked needs two sockets, onetobhe
for normal operation (UDP port 500) and one for NAT traversal (UDP 4500). There are several command line options resulting in only one of the sockets being created (-T, -t and -p). Add a new 'enum natt_mode' to make the logic for those somewhat less complicated as well as some comments where it makes sense. From Wataru Ashihara <wataash (at) wataash (dot) com> ok patrick@
2020-03-24Fix user database corruption from 'ikectl reload'. Copy only the new passwordtobhe
instead of the full iked_user struct to preserve the RB_TREE pointers. From Bernardo Cunha Vieira <bernardo (dot) vieira (at) almg (dot) gov (dot) br> ok patrick@
2020-03-09Use TAILQ_FOREACH_SAFE instead of hand rolled loops.tobhe
From Wataru <wataash at wataash dot com> ok patrick@
2020-01-16Add '-p' command line option which allows to configuretobhe
the UDP encapsulation port, similar to isakmpd's '-N' flag. Being able to change the UDP encapsulation port is useful in cases where ESP and UDP ports 500 and 4500 are blocked or rate limited. ok sthen@
2020-01-07Link ESP-SA and IPcomp-SA using GRPSPIS instead of using a self-builttobhe
solution for multi-SA flows. As a result we only need a single outgoing IPCOMP flow and can get rid of the two extra transport mode flows for ESP. ok bluhm@
2019-12-03Correctly represent flows as traffic selectors as described in RFC 7296. Thistobhe
allows us to deduplicate the network ranges sent in the TS payload and saves some bytes on the wire. ok patrick@
2019-05-11Add support for IKEv2 Message Fragmentation as defined in RFC 7383.Patrick Wildt
ok sthen@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 23:53:57 +0000