| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2021-12-09 | Properly enable NAT-T without udpencap if mobike was negotiated without NAT. | Tobias Heider | |
| Fixes a bug where iked sent zero-prefixed NAT-T messages on port 500 causing parsing errors. ok markus@ patrick@ | |||
| 2021-12-09 | Move switch to NAT-T port and udpencap activation to ikev2_enable_natt(). | Tobias Heider | |
| ok patrick@ | |||
| 2021-12-06 | Logging received addresses and DNS configuration only makes sense for | Tobias Heider | |
| the initiator. ok patrick@ | |||
| 2021-12-04 | Send out dstid as initiator if configured. This makes it easier for | Tobias Heider | |
| the responder to match the correct policy if multiple are available. ok patrick@ | |||
| 2021-12-01 | whitespace cleanup during review read | Theo de Raadt | |
| 2021-11-30 | whitespace | Tobias Heider | |
| 2021-11-29 | sys/param.h was included for MAX(), MIN() and roundup(). make local | Theo de Raadt | |
| copies of MAXIMUM() and MINIMUM() like we have done in 50+ other places, and also include a roundup() ok jsg | |||
| 2021-11-27 | Rename msg_id to msg_peerid now that we also have msg_localid. | Tobias Heider | |
| ok patrick@ | |||
| 2021-11-26 | Fix ikev2_child_sa_rekey() warnings. The SPI can't be printed without a | Tobias Heider | |
| parent SA. | |||
| 2021-11-24 | Pass env to pfkey API. Consistently call pfkey file descriptor fd. | Tobias Heider | |
| ok bluhm@ | |||
| 2021-11-23 | Add logging for rekey failures. | Tobias Heider | |
| ok patrick@ | |||
| 2021-11-22 | MOBIKE is RFC 4555. | Tobias Heider | |
| 2021-11-16 | Zero all copies of pre-shared key. | Tobias Heider | |
| ok markus@ | |||
| 2021-11-15 | style | Tobias Heider | |
| 2021-11-10 | Look for INVALID_KE group from IKE_SA_INIT in IKE transforms, | Tobias Heider | |
| not ESP transforms. Fixes broken key exchange negotiation with matching proposals. ok patrick@ markus@ | |||
| 2021-10-12 | Change responder to prefer DH group from KE payload. | Tobias Heider | |
| Without this change the responder would always prefer the first DH group configured in its policy. This would lead to invalid KE messages that cause an additional exchange which old implementations do not support correctly. Now we ignore the order of DH groups in the policy and prefer the group from the policy that matches the KE payload. from markus@ ok patrick@ | |||
| 2021-10-12 | Make sure all copies of MSCHAPv2 passphrase are zeroed after use. | Tobias Heider | |
| ok patrick@ | |||
| 2021-09-07 | Fix leak of msg_cert.id_buf. ikev2_msg_cleanup() frees id_buf if we | Tobias Heider | |
| don't delete the pointer. ok markus@ | |||
| 2021-09-01 | Add client side support for DNS configuration. Use RTM_PROPOSAL_STATIC | Tobias Heider | |
| route messages to propose the name server to resolvd(8). For now, iked will only propose a single name server from the first established connection. Automatic name server configuration is enabled by default for policies using the 'iface' option. discussed with deraadt@ ok for the DNS parts florian@ ok for the rest patrick@ | |||
| 2021-06-29 | Send AUTHENTICATION_FAILED in case of unexpected auth method or auth | tobhe | |
| data not being accessible. From Claudia Priesterjahn @ achelos ok patrick@ | |||
| 2021-06-17 | Skip flows in ikev2_cp_addr() if they don't contain a dynamic (0.0.0.0) | tobhe | |
| address before checking sa_addrpool. Fixes a bug where no flows are added if a single address instead of a pool is configured in config address. Reported by Sebastien Leclerc ok patrick@ | |||
| 2021-06-11 | Revert previous change in ikev2_cp_fixaddr(). | tobhe | |
| Fixes a regression found by landry@. ok patrick@ | |||
| 2021-05-31 | Don't fail hard in ikev2_cp_fixaddr() if no address pool is found. | tobhe | |
| Fixes a bug where no flows are loaded when a single config address without pool is configured. ok patrick@ | |||
| 2021-05-31 | Prevent address underflow with /32 config address prefix. | tobhe | |
| Only skip .0 address if the pool is big enough. ok patrick@ | |||
| 2021-05-13 | Refactor iked process shutdown and cleanup. Remember configured | tobhe | |
| addresses and routes in iked_vroute_sc to not depend on ikev2 process for cleanup. This makes sure that all flows, routes and addresses are deleted no matter which process is killed first. ok patrick@ | |||
| 2021-03-23 | Don't send DELETE notify if IKE SA is replaced because of | tobhe | |
| 'enforcesingleikesa'. Fixes an interop problem with strongswan if make-before-break is enabled. ok patrick@ | |||
| 2021-03-15 | Ignore msg_ke in CREATE_CHILD_SA if DH negotiation results in group | tobhe | |
| 'none' (disabling PFS). Fixes a bug when the initiator sends a KE payload but the negotiation results in DH group "none". For other DH group mismatches we send an INVALID_KE notify, for 'none' we can just ignore the KE payload. ok patrick@ | |||
| 2021-03-14 | Log errors with log level info and SPI. | tobhe | |
| 2021-03-09 | Also log transforms on IKE SA rekey. | tobhe | |
| 2021-03-07 | Log ESN for child SAs if enabled. | tobhe | |
| 2021-03-06 | whitespace | tobhe | |
| 2021-03-05 | Print PFS group for rekeyed Child SAs. | tobhe | |
| ok patrick@ | |||
| 2021-03-05 | Log transforms of established IKE and Child SAs. | tobhe | |
| ok patrick@ | |||
| 2021-03-04 | Derive config netmask from address pool if not explicitly configured. | tobhe | |
| ok markus@ | |||
| 2021-02-20 | Fail on invalid address family. | tobhe | |
| 2021-02-18 | Save one allocation by passing msg_nonce ownership instead of using | tobhe | |
| ibuf_dup(). ok patrick@ | |||
| 2021-02-18 | Pass ownership instead of duplicating ibuf msg_ke. | tobhe | |
| ok patrick@ | |||
| 2021-02-13 | Add dynamic address configuration for roadwarrior clients. | tobhe | |
| The new 'iface' config option can be used to specify an interface for the virtual addresses received from the peer. Routes are automatically added based on the configured flows. Input from sthen@ and claudio@ ok patrick@ | |||
| 2021-02-11 | Explicitly unset IKED_REQ_CERTVALID before sending cert to ca process. | tobhe | |
| ok markus@ | |||
| 2021-02-10 | Delay deletion of IKE SAs on rekey when stickyaddress is enabled to make | tobhe | |
| sure peers can keep their previously assigned addresses. ok patrick@ | |||
| 2021-02-09 | Add optional 'group none' transform for child SAs and fix handling of | tobhe | |
| 'group none'. We currently send no transform of type DH by default, which should be equivalent to explicitly sending a single DH transform of type 'none'. However, the proposal matching logic had a bug where these two would not match, effectively breaking the ability to negotiate optional PFS. This commit fixes the bug but continues to send no DH proposal by default to remain backwards compatible with older versions. ok patrick@ | |||
| 2021-02-04 | Rename 'struct group' to 'struct dh_group' for more clarity and | tobhe | |
| to avoid name clashes. ok patrick@ | |||
| 2021-02-04 | Upgrade to OpenSSL 1.1 compatible crypto API. Add additional | tobhe | |
| checks where needed. ok markus@ patrick@ | |||
| 2021-02-01 | Take flows into consideration for policy lookup as initiator. | tobhe | |
| Fixes a bug where policies that only differ in their flow configuration lead to a handshake error. Found by claudio@ ok patrick@ | |||
| 2021-01-31 | Ignore addresses that are not 0/32 (dynamic) in ikev2_cp_fixaddr() | tobhe | |
| instead of throwing an error. Fixes a bug where flows without 'dynamic' were skipped when 'config/request address' is used. ok patrick@ | |||
| 2021-01-31 | Don't leak flows if ikev2_cp_fixflow() fails. | tobhe | |
| ok patrick@ | |||
| 2021-01-23 | Fix typos. | tobhe | |
| From Ryan Kavanagh ok patrick@ | |||
| 2021-01-21 | Handle NO_PROPOSAL_CHOSEN for CREATE_CHILD_SA. | tobhe | |
| ok markus@ | |||
| 2021-01-21 | Add support for INVALID_KE_PAYLOAD in CREATE_CHILD_SA | tobhe | |
| exchange. In the case of an invalid KE error, retry CREATE_CHILD_SA exchange with different group instead of restarting the full IKE handshake. ok markus@ | |||
| 2021-01-20 | Make sure to enforce matching dstid as initiator. Use policy lookup | tobhe | |
| to make sure the negotiated SA matches the selected policy. ok patrick@ | |||
 |
index : src | |
| OpenBSD base system |
| summaryrefslogtreecommitdiff |