summaryrefslogtreecommitdiff
path: root/sbin/iked
AgeCommit message (Collapse)Author
2021-11-25Remove unused variable fd.Tobias Heider
2021-11-25Silence unitialized variable warnings.Tobias Heider
2021-11-24Unregister event on pfkey socket during pfkey_reply(). Using eventsTobias Heider
and poll() at the same time may lead to a race that locks up the process in recv(). ok bluhm@
2021-11-24Pass env to pfkey API. Consistently call pfkey file descriptor fd.Tobias Heider
ok bluhm@
2021-11-23Add logging for rekey failures.Tobias Heider
ok patrick@
2021-11-22MOBIKE is RFC 4555.Tobias Heider
2021-11-21Add 'ikectl show certinfo' to show trusted CAs and certificates.Tobias Heider
This helps debug authentication issues with x509 certificates. ok markus@
2021-11-20Fix some strdup() leaks in ocsp config option.Tobias Heider
ok markus@
2021-11-19Check stdrup() return value.Tobias Heider
2021-11-18iked: replace a conditional EVP_CIPHER_CTX_cleanup() + free() stanzaTheo Buehler
with an unconditional EVP_CIPHER_CTX_free(). ok tobhe
2021-11-18Check if encoding works in dsa_init(). This avoids calling fatal()Tobias Heider
in dsa_length() or dsa_prefix() when the selected encoding is invalid. ok markus@
2021-11-16Zero all copies of pre-shared key.Tobias Heider
ok markus@
2021-11-15styleTobias Heider
2021-11-13The key/nonce disclaimers were copied from ipsec.conf.5 but aren't relevantTobias Heider
to iked. Encryption keys and nonces are generated by the handshake and don't have to be supplied in the config.
2021-11-12Refactor order of checks when handling IKEv2 message fragments.Tobias Heider
Only modify SA after sucessful ikev2_msg_decrypt(). ok patrick@
2021-11-10Look for INVALID_KE group from IKE_SA_INIT in IKE transforms,Tobias Heider
not ESP transforms. Fixes broken key exchange negotiation with matching proposals. ok patrick@ markus@
2021-11-09Use more sensible transforms in example config.Tobias Heider
2021-11-05Clarify iface option.Tobias Heider
2021-11-04Clarify "aes" will accept keys which length is in 128:256 bits. AlsoYASUOKA Masahiko
correct "cast" in ipsec.conf.5 to "cast128", add missing "chacha20-poly1305", and sync iked.conf.5 and ipsec.conf.5 some places. ok jmc sthen
2021-10-26Make proto config option accept a list to allow specifying multipleTobias Heider
protocols for a single policy, e.g. "proto { ipencap, ipv6 }". feedback and ok benno@ ok patrick@
2021-10-15Don't declare variables as "unsigned char *" that are passed toChristian Weisgerber
functions that take "char *" arguments. Where such chars are assigned to int or passed to ctype functions, explicitly cast them to unsigned char. For OpenBSD's clang, -Wpointer-sign has been disabled by default, but when the parse.y code was built elsewhere, the compiler would complain. With help from millert@ ok benno@ deraadt@
2021-10-12Change responder to prefer DH group from KE payload.Tobias Heider
Without this change the responder would always prefer the first DH group configured in its policy. This would lead to invalid KE messages that cause an additional exchange which old implementations do not support correctly. Now we ignore the order of DH groups in the policy and prefer the group from the policy that matches the KE payload. from markus@ ok patrick@
2021-10-12Make sure all copies of MSCHAPv2 passphrase are zeroed after use.Tobias Heider
ok patrick@
2021-09-18upon length check or other failure, explicit_bzero an object, because it mayTheo de Raadt
contain a partially copied password ok tobhe
2021-09-18freezero() instead of free(), because the object may contain a passwordTheo de Raadt
ok tobhe
2021-09-07Fix leak of msg_cert.id_buf. ikev2_msg_cleanup() frees id_buf if weTobias Heider
don't delete the pointer. ok markus@
2021-09-07Fix leak of m if message initialization fails.Tobias Heider
ok markus@
2021-09-06Fix leaks in vroute addr and route caches.Tobias Heider
ok patrick@
2021-09-02styleTobias Heider
2021-09-01Add client side support for DNS configuration. Use RTM_PROPOSAL_STATICTobias Heider
route messages to propose the name server to resolvd(8). For now, iked will only propose a single name server from the first established connection. Automatic name server configuration is enabled by default for policies using the 'iface' option. discussed with deraadt@ ok for the DNS parts florian@ ok for the rest patrick@
2021-08-03Increase default data bytes limit for Child SAs to 4 GB.tobhe
Lower limits lead to excessive rekeying and lost data in high performance setups without much benefit. Brought up by mvs@ ok patrick@ sthen@
2021-06-29Send AUTHENTICATION_FAILED in case of unexpected auth method or authtobhe
data not being accessible. From Claudia Priesterjahn @ achelos ok patrick@
2021-06-23Use print_host() to log destination, netmask and gateway. Add prettytobhe
printing for route flags. ok markus@
2021-06-23Factor out vroute_addr().tobhe
ok markus@
2021-06-17Skip flows in ikev2_cp_addr() if they don't contain a dynamic (0.0.0.0)tobhe
address before checking sa_addrpool. Fixes a bug where no flows are added if a single address instead of a pool is configured in config address. Reported by Sebastien Leclerc ok patrick@
2021-06-11Revert previous change in ikev2_cp_fixaddr().tobhe
Fixes a regression found by landry@. ok patrick@
2021-06-01Remember flow routes in addition to host routes and deletetobhe
them explicitly on shutdown. Store netmask in route queue to fix cleanup of 0/1 routes. Sending delete messages without mask doesn't work reliably. ok patrick@
2021-05-31Don't fail hard in ikev2_cp_fixaddr() if no address pool is found.tobhe
Fixes a bug where no flows are loaded when a single config address without pool is configured. ok patrick@
2021-05-31Prevent address underflow with /32 config address prefix.tobhe
Only skip .0 address if the pool is big enough. ok patrick@
2021-05-28Add experimental post-quantum hybrid key exchange methodtobhe
based on Streamlined NTRU Prime (coupled with X25519). The sntrup761 implementation is imported from OpenSSH. It is public domain code originally distributed as part of the SUPERCOP cryptography benchmark suite (https://bench.cr.yp.to/supercop.html). The method is not part of the default proposal, but can be enabled with 'ikesa group sntrup761x25519'. ok markus@ patrick@
2021-05-17Avoid calling ibuf_add() with NULL and zero length.tobhe
ok patrick@
2021-05-13Refactor iked process shutdown and cleanup. Remember configuredtobhe
addresses and routes in iked_vroute_sc to not depend on ikev2 process for cleanup. This makes sure that all flows, routes and addresses are deleted no matter which process is killed first. ok patrick@
2021-05-13Use field independent version of {get,set}_affine_coordinates.Theo Buehler
ok tobhe
2021-04-20Move TAILQ initialization to files where they are used.dv
These priv-sep daemons all follow a similar design and use TAILQs for tracking control process connections. In most cases, the TAILQs are initialized separate from where they are used. Since the scope of use is generally confined to a specific control process file, this commit also removes any extern definitions and exposing the TAILQ structures to other compilation units. ok bluhm@, tb@
2021-04-11Document 'request' option to request additional configuration payloads.tobhe
ok patrick@
2021-04-09Only modify routes if SA has a valid address lease. On IKE SA rekeytobhe
sa_cp_addr and sa_cp_addr6 are moved to the new SA before the old SA is deleted. Fixes a bug where host routes were deleted on IKE SA rekey. ok patrick@
2021-04-03Add size check for sockaddr mask.tobhe
2021-03-25Sync correct ROUNDUP() from net/route.ctobhe
2021-03-23Don't send DELETE notify if IKE SA is replaced because oftobhe
'enforcesingleikesa'. Fixes an interop problem with strongswan if make-before-break is enabled. ok patrick@
2021-03-21The tag comes after iface in iked.conf(5).tobhe
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-01 21:03:21 +0000