summaryrefslogtreecommitdiff
path: root/sbin/iked/parse.y
AgeCommit message (Collapse)Author
2021-09-18upon length check or other failure, explicit_bzero an object, because it mayTheo de Raadt
contain a partially copied password ok tobhe
2021-05-28Add experimental post-quantum hybrid key exchange methodtobhe
based on Streamlined NTRU Prime (coupled with X25519). The sntrup761 implementation is imported from OpenSSH. It is public domain code originally distributed as part of the SUPERCOP cryptography benchmark suite (https://bench.cr.yp.to/supercop.html). The method is not part of the default proposal, but can be enabled with 'ikesa group sntrup761x25519'. ok markus@ patrick@
2021-03-16Add 'grp31' alias for curve25519 as documented in iked.conf(5).tobhe
2021-03-05Move policy printing code from parse.y to new print.ctobhe
ok patrick@
2021-02-13Add dynamic address configuration for roadwarrior clients.tobhe
The new 'iface' config option can be used to specify an interface for the virtual addresses received from the peer. Routes are automatically added based on the configured flows. Input from sthen@ and claudio@ ok patrick@
2021-02-09Add optional 'group none' transform for child SAs and fix handling oftobhe
'group none'. We currently send no transform of type DH by default, which should be equivalent to explicitly sending a single DH transform of type 'none'. However, the proposal matching logic had a bug where these two would not match, effectively breaking the ability to negotiate optional PFS. This commit fixes the bug but continues to send no DH proposal by default to remain backwards compatible with older versions. ok patrick@
2021-02-07Fix address leaks in expand_flows().tobhe
ok patrick@
2021-02-01Whitespacetobhe
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-27Fix "any" and "dynamic" keywords for flows and add proper IPv6 support.tobhe
For traffic selectors with a keyword on either 'from' or 'to' side, install flow with address family of the opposite side. If both source and destination address are keywords, install flows for both address families. The 'dynamic' keyword is special as it will only install flows for the address family of the dynamically assigned address (specified with the 'config address' option). ok patrick@
2020-12-20Don't leak ipsec_hosts when building hosts_list.tobhe
ok patrick@
2020-12-15Fix leak of REQUEST string.tobhe
2020-12-13Make sure flow src and dst addresses have the same address family.tobhe
ok patrick@
2020-12-10Print valid ikesa/childsa configuration at startup. Comma seperatedtobhe
transforms are not supported. ok patrick@
2020-11-29Add 'set stickyaddress' option. If this option is enabled, iked will trytobhe
to assign the same 'config address' when an IKESA is negotiated with the DSTID of an existing IKESA. The original IKESA will be closed and the address will be transferred to the new IKESA. ok patrick@
2020-11-03Add 'any' keyword for request to allow 'request address any'.tobhe
2020-11-01Add 'dynamic' keyword to configure flows to dynamically assigned addresses.tobhe
The keyword is replaced at runtime with the address assigned from the pool in 'config address'. ok patrick@
2020-10-29Add initial support to request IP addresses as IKEv2 initiator.tobhe
At the moment the address is only negotiated and printed to the log. If 'request addr 0.0.0.0' is configured, any address will be accepted. ok patrick@
2020-09-23Add new 'set cert_partial_chain' config option to allow verification oftobhe
partial certificate chains if a trusted intermediate CA is found in /etc/iked/ca/. ok patrick@
2020-09-19Add SHA2_384 and SHA2_512 to default proposals.tobhe
ok patrick@
2020-09-18Fix memory leak in 'n->name'.tobhe
2020-09-16Fix EAP authentication if the initiator sends no certificatetobhe
request. The locally configured request is used as fallback to find a certificate or key to send. The local auth method for MSCHAP-V2 should be IKEV2_AUTH_SIG_ANY, which defaults to X509 certificates, instead of raw rsa keys. Tested with Strongswan, iPhone and Windows Found by and ok sthen@ ok patrick@
2020-09-05Initialize flow_dir and flow_saproto so policy_test() can find the policytobhe
on acquire.
2020-08-25Fix undefined symbol.tobhe
2020-08-25Add dpd_check_interval configuration option. If for any IKE SA no IPsectobhe
or IKE message has been received within the specified time interval, iked will start sending DPD messages. ok patrick@
2020-08-23Add a new configuration option to limit the number of connections fortobhe
each peer (identified by their 'dstid'). When 'set enforcesingleikesa' is enabled, each peer can only have one active IKE SA at a time. On successful authentication of a new connection, the old IKE SA is automatically deleted. ok patrick@
2020-08-18Add optional time-stamp validaten for ocsp. The new optional 'tolerate'tobhe
parameter specifies how many seconds leeway are allowed in the check. The optional maxage parameter indicates the allowed maximum age of the `thisUpdate' OCSP attribute value. ok patrick@
2020-08-14Delete unused variable 'idtype'.tobhe
2020-07-20Fix dst/src port configuration bug with multiple flows.tobhe
ok patrick@
2020-07-20iked: fix typo in fatalxStuart Henderson
2020-06-25Rework 'ikeauth' configuration option. The key and cert checks in the configtobhe
parser aren't needed as they are checked at runtime during the handshake. Moreover, these checks during startup of the daemon never worked properly when dstid was not explicitly configured. The dstid depends on the ID message payload which is only known after the initial handshake. ok patrick@
2020-06-05Add default proposals for AES-GCM ciphers in IKE and ESP.tobhe
ok patrick@
2020-05-26Add AES-GCM mode ciphers (IANA IDs 19 and 20) for IKEv2.tobhe
They can be configured with the new ikesa enc options aes-128-gcm, aes-256-gcm, aes-128-gcm-12 and aes-256-gcm-12. Tested with Strongswan by Stephan Mendling and myself Tested with Juniper SRX by remi@ ok sthen@, patrick@
2020-04-30Add ECDH groups and higher order MODP DH groups to default proposal.tobhe
ok sthen@, patrick@
2020-04-29Remove trailing tabtobhe
2020-04-29Missing whitespace.tobhe
2020-04-28Remove support for insecure EC2N groups. Clarify which Diffie-Hellmantobhe
groups are not recommended to use and are only supported for backwards compatibility. Feedback from sthen@ ok kn@
2020-04-26Only print valid rdomains. '-1' is used as default value and shouldtobhe
not be printed.
2020-04-23Add support for switching rdomain on IPsec encryption/decryption.tobhe
It can be configured per policy with the new 'rdomain' option (see iked.conf(5)). Only the unencrypted (inner) rdomain has to be configured, the encrypted rdomain is always the one the responsible iked instance is running in. The configured rdomain must exist before iked activates the IPsec SAs, otherwise pfkey will return an error. ok markus@, patrick@
2020-04-14Print 'ipcomp' in print_policy() if configured.tobhe
2020-04-12No need to call lc_idtype(). idstr does not contain a leading typetobhe
specifier (e.g. 'FQDN/').
2020-04-10Only make the type part of the idstring lowercase when looking for certs intobhe
'/etc/iked', otherwise certs with SubjAltNames containing uppercase letters are not found. ok markus@
2020-03-28Plug some memory leaks.tobhe
2020-02-21Add transport mode for child SAs. This is useful for GRE over IPsec andtobhe
similar settings to prevent double encapsulation. ok kn@
2019-12-03Correctly represent flows as traffic selectors as described in RFC 7296. Thistobhe
allows us to deduplicate the network ranges sent in the TS payload and saves some bytes on the wire. ok patrick@
2019-11-28Merge host_v{4,6}() into host_ip(), simplify host()kn
Zap lots of duplicate code and unify address family specific code where possible. There's probably more to improve, but this already cuts a lot. This is the minimal version without any cosmetic fixes or logical relocations to either improve the code or sync it with pfctl, bgpd, etc. OK tobhe
2019-11-28Introduce copy_sockaddrtoipa() and set_ipmask() bits from pfctlkn
The new wrapper will be used in the upcoming diff, set_ipmask() will be called with -1. Both is in analogy to pfctl, bgpd and others where IP/host parsing has been made more AF agnostic already. copy_sockaddrtoipa() is not called copy_satoipa() to avoid confusion with IPSec terminology (SA) as suggested by tobhe. No functional change OK tobhe
2019-11-12Add configuration options to explicitly specify ESN support for child SAs.tobhe
The default behaviour remains unchanged. ok mikeb@ bluhm@
2019-09-26Fix leaks by cleaning up after configuration parser.tobhe
ok bluhm@
2019-08-26Fix file descriptor leak in config parser. Inspired by bgpd parse.y.tobhe
ok patrick@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-14 04:57:16 +0000