summaryrefslogtreecommitdiff
path: root/sbin/iked/ikev2_pld.c
AgeCommit message (Collapse)Author
2015-10-15Remove some unnecessary NULL-checks before free(). Change two bzero()mmcc
calls on pf data to explicit_bzero(). ok mikeb@
2015-10-01Don't reject an "empty" CERTREQ (one with no CA hashes), instead treat it asStuart Henderson
if no CERTREQ were received. In conjunction with the previous iOS9 interop fix, this may fix an interop problem seen by Denis Lapshin with BlackBerry OS 10.3.1 and one of a number with firebrick.co.uk's IKEv2 implementation diagnosed by their developer Cliff Hones. ok reyk@
2015-10-01Fix interoperability with Apple iOS9: If we don't get a (valid)Reyk Floeter
CERTREQ but a CERT, respond with a local CERT that was selected based on our own policy instead of leaving it out. This seems to be valid with the RFC that makes the CERTREQ optional and allows to ignore it or to apply an own policy. OK mikeb@ sthen@
2015-08-21Switch iked to C99-style fixed-width integer types.Reyk Floeter
OK mikeb@
2015-08-19spacing (no binary change, verified with checksums)Reyk Floeter
2015-03-26initial support for RFC 7427 signatures, so we are no longerMarkus Friedl
restricted to SHA1 for RSA signatures. ok mikeb@
2015-02-06unneeded getopt.hTheo de Raadt
2015-01-19Remove unnecessary <netinet/ip_ipsp.h> includesMike Belopuhov
2015-01-16Replace <sys/param.h> with <limits.h> and other less dirty headers whereTheo de Raadt
possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
2014-11-07Run eap_parse on the actual message and only when the length is rightMike Belopuhov
2014-05-06initiate ike sa rekeying (ikesalifetime keyword), re-queue pfkeyMarkus Friedl
events while we are busy initiating child-SAs; ok mikeb@
2014-05-06don't sa_free() in the receive path (prevents use-after-free); ok mikeb@Markus Friedl
2014-05-06make sure some notify payloads are encrypted; ok mikeb@Markus Friedl
2014-05-06initial support for PFS; ok reyk@Markus Friedl
2014-05-05validate the attribute length, too; from hshoexer; ok mikebMarkus Friedl
2014-04-28spacingReyk Floeter
2014-04-10Add validation routines to ikev2_pld.c: For each payload type overallReyk Floeter
header structure is checked for sanity before copying the header. Always pass down the number of remaining bytes in the payload or substructure so we can always ensure to not go beyond actual data. Also remove the quick parsing step as it does not provide a real benefit anymore. From Hans-Joerg Hoexer ok mikeb@ markus@
2014-02-17Fix compiler warnings in the format strings: use %zd for ssize_t andReyk Floeter
%zu for size_t. From Andre de Oliveira With input and OK from blambert@ markus@
2014-02-14initial support for IPCompMarkus Friedl
still experimental and rekeying needs some work; ok mikeb@
2014-02-12make sure to set the msg_responded flag on the original message; ok mikeb@Markus Friedl
2014-01-24use a bit saner timer apiMike Belopuhov
2014-01-22implement DPD similar to isakmpd, but only send DPD-messages 'on-demand'Markus Friedl
(less aggressive, only if the ESP-SAs are actually used); feedback & ok mikeb@
2013-12-03never cast to sockaddr_storage, always cast to the abstract 'class' sockaddrMarkus Friedl
this fixes an out-of-bounds-memcpy in pfkey_process(); ok mikeb@
2013-11-28support raw pubkey authentication w/o x509 certificates;Markus Friedl
mostly by Michael Cardell Widerkrantz, reyk@ and mikeb@; ok mike@
2013-03-21remove excessive includesTheo de Raadt
2013-01-08Remove private CVS tag from an obsolete repository and bump copyrightReyk Floeter
to 2013 while I'm here... this is my way of saying "happy new year!".
2012-12-15Don't dereference NULL pointers (and some cleanup here).Reyk Floeter
2012-10-22Fix NAT-T support in iked, both on the initiator and the responderReyk Floeter
side. Also add a new command line option -t to optionally enforce NAT-T with UDP encapsulation on port 4500. Tested by mikeb@ and me ok mikeb@
2012-09-18update email addresses to match reality.Reyk Floeter
sure jsg@ mikeb@
2012-06-22decouple timer initialization from timer_registerMike Belopuhov
2012-05-30more timer changesMike Belopuhov
2012-05-29improve timer framework; will be needed soonMike Belopuhov
2012-05-07Sync up several defines with RFC 5996. IANA has changed the existingMike Belopuhov
IKEv2 Payload Type "Encrypted" (E) to "Encrypted and Authenticated" (SK).
2012-03-24fix some leaksJonathan Gray
ok mikeb@
2011-01-26get rid of acquire flows completely, as they tend to pass trafficMike Belopuhov
when there's no sa established (as pointed out by reyk). instead use require mode feature to send acquires from the kernel. this allows us to get rid of the code that changes flow mode to acquire and keep all installed flows in the tree and save up on some code that deals with renegotiation. also several entities were renamed (iked_acqflows -> iked_activeflows, iked_ipsecsas -> iked_activesas, ikev2_acquire -> ikev2_acquire_sa). ok reyk
2011-01-17Add initial acquire mode support and use it whenever Windows peers decideMike Belopuhov
to drop Child SA based on the inactivity timer. In this case we instruct the kernel to send us an acquire message upon receiving a packet for those hosts and initiate a Child SA creation exchange ourselves. ok reyk
2011-01-12decouple flow deletion from the ikev2_childsa_delete; ok reykMike Belopuhov
2010-12-22move and rename util.c:print_id() to ikev2.c:ikev2_print_id() becauseReyk Floeter
it is too specific to be in util.c. This will allow to link util.c into ikectl later without all the other dependencies of pritn_id().
2010-12-22child sa rekeying revamp plus numerous bugfixes;Mike Belopuhov
with suggestions and OK from reyk
2010-09-30check that there are transforms in the proposal before tryingMike Belopuhov
to actually parse it. ok reyk
2010-09-22support INVALID_KE_PAYLOAD notification sent by the responder in caseMike Belopuhov
the initiator chose wrong D-H group. in this case we throw away our SA and start over with a proper group. makes iked work as an initiator with strongswan/charon without any specific "ikesa" (phase 1) configuration. ok reyk
2010-07-28Change back to the pre rev 1.11 behaviour of not treating unexpectedJonathan Gray
id payloads as errors. Lets interop with strongSwan which sends both IDi and IDr work again.
2010-07-03Better non-debug logging messages when a session is established/closed.Reyk Floeter
2010-06-27When a peer requests a certificate from the local gateway, we firstReyk Floeter
lookup a cert from /etc/iked/certs/ that is signed by a requested CA. As a second step we also compare the subjectAltName of any found certificate now to match the local srcid; this allows to have multiple certs for the same CA but different srcids in the certs/ directory but enforces that the subjectAltName has to be set correctly. requested by jsg@
2010-06-27Instead of modifying and fiddling with the IKE SA in the payloadReyk Floeter
parsing routines directly, first parse the message and save the parsed elements in the temporary message struct before validating the information and taking any other actions on the actual SA. This needs more testing, but is the cleaner and better approach.
2010-06-26revert the files that have been accidentally committed with myReyk Floeter
previous parse.y change.
2010-06-26mixing any (AF_UNSPEC) with AF_INET/INET6 is not an address family mismatchReyk Floeter
2010-06-26Include the Id type in the generated SA tag that is passed to theReyk Floeter
kernel, just like isakmpd does it. In difference to isakmpd, the Id type is printed in capital letters, eg. FQDN/foo.example.com, because it is using the existing print_map() API. For consistency, rename a few Id types in grammar and code from the RFC-names to the OpenBSD-style names; including RFC822_ADDR to UFQDN, IPV4_ADDR to just IPV4, DER_ASN1_DN to ASN1_DN etc.
2010-06-14Initiator mode with certificates; needs more work but works.Reyk Floeter
2010-06-14Initial support for initiator mode which allows to run iked as aReyk Floeter
"client" or to configure iked to iked (OpenBSD to OpenBSD) IKEv2 VPNs. It currently only supports psk (pre-shared keys) and no certificates, doesn't do any rekeying or SA timeouts, and needs more cleanup. So it is not quite production ready yet - but ready for simple tests...
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-20 15:11:36 +0000