summaryrefslogtreecommitdiff
path: root/sbin/iked
AgeCommit message (Collapse)Author
2021-04-03Add size check for sockaddr mask.tobhe
2021-03-25Sync correct ROUNDUP() from net/route.ctobhe
2021-03-23Don't send DELETE notify if IKE SA is replaced because oftobhe
'enforcesingleikesa'. Fixes an interop problem with strongswan if make-before-break is enabled. ok patrick@
2021-03-21The tag comes after iface in iked.conf(5).tobhe
2021-03-16Add 'grp31' alias for curve25519 as documented in iked.conf(5).tobhe
2021-03-15We makes sure that a dh group is required if the local proposaltobhe
contains an explicit group transform. Override requiredh if one of the local options is 'none' so that a proposal with no DH group and on with explicit group 'none' result in a match. ok patrick@
2021-03-15Ignore msg_ke in CREATE_CHILD_SA if DH negotiation results in grouptobhe
'none' (disabling PFS). Fixes a bug when the initiator sends a KE payload but the negotiation results in DH group "none". For other DH group mismatches we send an INVALID_KE notify, for 'none' we can just ignore the KE payload. ok patrick@
2021-03-14Log errors with log level info and SPI.tobhe
2021-03-09Also log transforms on IKE SA rekey.tobhe
2021-03-07Log ESN for child SAs if enabled.tobhe
2021-03-06whitespacetobhe
2021-03-05Print PFS group for rekeyed Child SAs.tobhe
ok patrick@
2021-03-05Log transforms of established IKE and Child SAs.tobhe
ok patrick@
2021-03-05Move policy printing code from parse.y to new print.ctobhe
ok patrick@
2021-03-04Remove -g from CFLAGS. This was accidentally added with the last commit.tobhe
2021-03-04Derive config netmask from address pool if not explicitly configured.tobhe
ok markus@
2021-03-03Free sc_vroute on shutdown.tobhe
2021-03-02Increase the size of iov in pfkey_sa() to be large enough for allJonathan Gray
possible options. ok tobhe@
2021-03-01Make sure sa_policy is not NULL in sa_configure_iface(). This can happentobhe
if the SA is deleted because of a failed policy lookup.
2021-02-28Rename addr to gateway.tobhe
2021-02-27Set RTF_GATEWAY for host route based on RTM_GET response.tobhe
2021-02-26Set RTF_GATEWAY for flow routes, not for host route.tobhe
2021-02-26Fix and improve handling of address families in vroute_getcloneroute().tobhe
ok patrick@
2021-02-25Constify cipher API.tobhe
ok markus@
2021-02-24Use ASN1_STRING_get0_data() instead of the deprecated ASN1_STRING_data().tobhe
From Moritz Schmitt ok patrick@
2021-02-22Don't pass 'id' as argument to make function signature match similartobhe
functions. config_setpfkey() is always called with id PROC_IKEV2.
2021-02-21Don't explicitly send address family in IMSG_VROUTE_ADD. The receivingtobhe
process parses af from the sockaddrs. ok patrick@
2021-02-20Fail on invalid address family.tobhe
2021-02-19Fail on duplicate nonce payload.tobhe
ok patrick@
2021-02-18Save one allocation by passing msg_nonce ownership instead of usingtobhe
ibuf_dup(). ok patrick@
2021-02-18Remove redundant ibuf_release. msg_ke is always NULL because of thetobhe
duplicate check above.
2021-02-18Pass ownership instead of duplicating ibuf msg_ke.tobhe
ok patrick@
2021-02-16Fail on duplicate KE payload.tobhe
ok patrick@
2021-02-13Add dynamic address configuration for roadwarrior clients.tobhe
The new 'iface' config option can be used to specify an interface for the virtual addresses received from the peer. Routes are automatically added based on the configured flows. Input from sthen@ and claudio@ ok patrick@
2021-02-12Fix local and peer addresses in policy lookup for dangling SAstobhe
after ikectl reload. ok patrick@
2021-02-11Explicitly unset IKED_REQ_CERTVALID before sending cert to ca process.tobhe
ok markus@
2021-02-10Delay deletion of IKE SAs on rekey when stickyaddress is enabled to maketobhe
sure peers can keep their previously assigned addresses. ok patrick@
2021-02-09Add optional 'group none' transform for child SAs and fix handling oftobhe
'group none'. We currently send no transform of type DH by default, which should be equivalent to explicitly sending a single DH transform of type 'none'. However, the proposal matching logic had a bug where these two would not match, effectively breaking the ability to negotiate optional PFS. This commit fixes the bug but continues to send no DH proposal by default to remain backwards compatible with older versions. ok patrick@
2021-02-08Clean up kernel IPsec flows and security associations on shutdown.tobhe
Discussed with sthen@ ok patrick@
2021-02-07Free X509_STOREs in ca_shutdown().tobhe
2021-02-07Fix address leaks in expand_flows().tobhe
ok patrick@
2021-02-04Rename 'struct group' to 'struct dh_group' for more clarity andtobhe
to avoid name clashes. ok patrick@
2021-02-04EC_POINT_get_affine_coordinates_GFp() and EC_POINT_get_affine_coordinates_GF2m()tobhe
do the same thing. Remove redundant check and always use the _GFp() variant. discussed with tb@ ok patrick@
2021-02-04Upgrade to OpenSSL 1.1 compatible crypto API. Add additionaltobhe
checks where needed. ok markus@ patrick@
2021-02-01Take flows into consideration for policy lookup as initiator.tobhe
Fixes a bug where policies that only differ in their flow configuration lead to a handshake error. Found by claudio@ ok patrick@
2021-02-01Whitespacetobhe
2021-01-31Ignore addresses that are not 0/32 (dynamic) in ikev2_cp_fixaddr()tobhe
instead of throwing an error. Fixes a bug where flows without 'dynamic' were skipped when 'config/request address' is used. ok patrick@
2021-01-31Don't leak flows if ikev2_cp_fixflow() fails.tobhe
ok patrick@
2021-01-29Add proper padding for pfkey messages. Use ROUNDUP() for auth andtobhe
enc keys. ok patrick@
2021-01-28Extern privsep_process. Fixes compilation with -fno-common.mortimer
ok deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 00:09:08 +0000