summaryrefslogtreecommitdiff
path: root/sbin/iked
AgeCommit message (Collapse)Author
2017-02-28Depending on the addresses, ipsecctl(8) automatically groups saAlexander Bluhm
bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@
2017-02-24In a scenario where a config reload happens during an IKE_AUTH exchange,Patrick Wildt
and we move an SA from one to another policy, we need to make sure to do refcounting if the policies involved are already in the garbage collect phase. ok markus@ mikeb@
2017-02-03Stop assuming that in_{addr,port}_t are typedefed in <sys/types.h> andPhilip Guenther
instead pull in <netinet/in.h> or <arpa/inet.h> when those are needed. ok florian@ beck@ millert@
2017-01-20Add a warning when the address pool is exhaustedMike Belopuhov
From and OK markus@, OK reyk
2017-01-20Constify the data argument for ibuf_newMike Belopuhov
From and OK markus@, OK reyk
2017-01-20Reset various pointers in ikev2_msg_cleanupMike Belopuhov
From and OK markus@, OK reyk
2017-01-20Make sure to free reference to the public key after decodingMike Belopuhov
From and OK markus@, OK reyk
2017-01-20Closed SAs should never be treated as validMike Belopuhov
From and OK markus@, OK reyk
2017-01-20Check bounds of the flows array when configuring traffic selectorsMike Belopuhov
From and OK markus@, OK reyk
2017-01-20Verify the certificate imsg payload sizeMike Belopuhov
From and OK markus@, OK reyk
2017-01-20Include only found SPIs into the PAYLOAD_DELETE messageMike Belopuhov
From and OK markus@, OK reyk
2017-01-20Minor formatting fixMike Belopuhov
From and OK markus@, OK reyk
2017-01-20New RFC7383 defineMike Belopuhov
From and OK markus@, OK reyk
2017-01-17Nuke some whitespace that keeps poking me in the eye as I try toKenneth R Westerback
steal code.
2017-01-09Stop accessing verbose and debug variables from log.c directly.Reyk Floeter
This replaces log_verbose() and "extern int verbose" with the two functions log_setverbose() and log_getverbose(). Pointed out by benno@ OK krw@ eric@ gilles@ (OK gilles@ for the snmpd bits as well)
2017-01-09Replace hand-rolled for(;;) traversal of ctl_conns TAILQ withKenneth R Westerback
TAILQ_FOREACH(). No intentional functional change. ok reyk@
2017-01-08Sync log.c with the latest version from vmd/log.c that preserves errnoReyk Floeter
so it is safe calling log_* after an error without loosing the it.
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2017-01-04Remove modular exponential groups specified in RFC5114Mike Belopuhov
Brought up by doug@, ok reyk, djm, doug
2017-01-03Fix pledge of the ca process by calling the right function on startup.Reyk Floeter
As a related change, load the local.pub and local.key keys after privsep and reload them on SIGHUP/reload. OK mikeb@
2016-11-28ikelifetime time spec is the same the one for lifetimeMike Belopuhov
2016-10-12copy updated log.c from vmd: for correctness, save errno when doingReyk Floeter
additional actions before printing it. OK rzalamena@
2016-09-26Pass the flags argument of recvfromto down to the underlying recvmsgJeremie Courreges-Anglas
Doesn't matter in iked as recvfromto is only called with flags = 0, but this code tends to be copied. ok sthen@ florian@
2016-09-13Disable the timer event before attempting to change itMike Belopuhov
Report and fix by Nikolay Edigaryev <edigaryev at gmail ! com>, thanks! OK reyk@
2016-09-04Forward IMSG_CTL_VERBOSE via the parent; this fixes a crash when doingReyk Floeter
"ikectl log verbose" and keeps the control process separated from the cert process. Thanks for the bug report to Wouter Clarie OK vgross@
2016-09-04Now that we have IP_SENDSRCADDR, add sendtofrom().Vincent Gross
Ok jca@ and reyk@
2016-09-03Add the missing bits to have NAT on enc(4) support in iked.Vincent Gross
Ok mikeb@
2016-08-06Unbreak PSK authentication, broken by previous.Pascal Stumpf
ok reyk@ florian@
2016-07-20When parsing the configuration. initialize the auth structureReyk Floeter
correctly, as parse.y's $$ is not zero-initialized. Found by Rene Ammerlaan OK markus@ florian@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".Sebastian Benoit
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2016-06-02Use the last 32-bits of the IPv6 address to dynamically assignPatrick Wildt
addresses from the pool, instead of the fourth byte, which usually represents network bits. ok markus@ mikeb@
2016-06-01Implement a second address pool specifically for IPv6, so thatPatrick Wildt
clients can be given an IPv4 and IPv6 address at the same time, thus enabling dual stack usage. ok markus@ mikeb@
2016-06-01ikev2_cp_fixaddr() is called to replace unspecified (e.g. 0.0.0.0)Patrick Wildt
addresses by specified (e.g. 192.0.2.1) ones. The function should return if the address is already set. The check was wrong for the IPv6 case, as it returned if it's not set. This caused the address to never be fixed. ok markus@ mikeb@
2016-03-07http -> https for IETF/IANA URLs in commentsmmcc
2016-01-27fyx typo. s,dynanic,dynamic,Gleydson Soares
OK reyk
2015-12-10comment typommcc
2015-12-09Remove plain DES encryption from IPsec.Christian Weisgerber
DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
2015-12-07Add imsg "peerid" to debug messages (only within -DDEBUG).Reyk Floeter
2015-12-07Sync proc.c, use shorter proc_compose[v]()Reyk Floeter
2015-12-07sync with vmdReyk Floeter
2015-12-05EAGAIN handling for imsg_read. OK henning@ benno@Claudio Jeker
2015-12-02remove unimplemented PF_KEY algorithms; ok sthen@ mpi@ mikeb@Christian Weisgerber
2015-11-23Replace socket_set_blockmode() and fcntl(fd, F_SETFL, O_NONBLOCK) callsReyk Floeter
with the SOCK_NONBLOCK flag to socket() and accept4(). OK claudio@ jung@
2015-11-22Update log.c: change fatal() and fatalx() into variadic functions,Reyk Floeter
include the process name, and replace all calls of fatal*(NULL) with fatal(__func__) for better debugging. OK benno@
2015-11-21Once again, fix the license text. After many years, we just cannotReyk Floeter
get rid of the "LOSS OF MIND" joke. Haha. We keep on removing it and it shows up again because it accidentally gets synced from somewhere else. bgpd and ospfd don't have it anymore, but their offsprings still carry it. If you see it, remove it, and, in the OpenBSD ISC case, use the original text from /usr/share/misc/license.template. All authors agree.
2015-11-21Move local logging functions to util.c (which is shared with ikectl),Reyk Floeter
sync log.c with relayd and httpd - all three daemons are using a copy of the same file now. Nevertheless, adding "extern int debug/verbose" in util.c is not super nice but helps for now. No functional change.
2015-11-19Simplify all instances of get_string() and get_data() using malloc() andmmcc
strndup(). ok millert@
2015-11-18pledge exposed a simple bug: the unprivileged child tried to print theReyk Floeter
policy after receiving it from the parent. print_policy -> print_proto -> getprotobynumber -> pledge abort because it tried to access /etc/protocols without rpath. It was just a debugging message that can be moved to the parent (printing the policy on the sender side and not the receiver side). The parent has rpath and dns. Issue found by sthen@ with "proto etherip" OK sthen@ benno@
2015-11-04Support Chacha20-Poly1305 for Child SAs; ok reykMike Belopuhov
2015-11-01replace "can not" with "cannot";Jason McIntyre
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 02:44:03 +0000