summaryrefslogtreecommitdiff
path: root/sbin/iked
AgeCommit message (Collapse)Author
2014-05-09get rid of redundant {csa,flow}_{src,dst}id pointers, so we don't needMarkus Friedl
to update it on rekey (fixes use-after-free); ok mikeb@
2014-05-09replace iked_transform pointer with xform id, since target of pointerMarkus Friedl
might be freed (e.g. on ike sa rekey); ok mikeb@
2014-05-08match iked proc.c infrastructure with proc.cBret Lambert
ok reyk@
2014-05-07try postponed requests first, so we do in-order processing; ok mikeb@Markus Friedl
2014-05-07print msgid for debugging; ok reyk & mikebMarkus Friedl
2014-05-07make authentication work with X509 certificates that don't have aMarkus Friedl
subject-altname, i.e. support IKEV2_ID_ASN1_DN correctly; feedback & ok mikeb@
2014-05-07factor out ikev2_ike_auth() (state machine; used multiple times via callbacks)Markus Friedl
from ikev2_ike_auth_recv() code (message parsing; used once); ok mikeb@
2014-05-06change the create-child-sa responder code, so it does not store anyMarkus Friedl
state in the ikesa structure. this way we can initiate a create-child-sa and process requests for the peer at the same time. ok mikeb@
2014-05-06zap stray word; ok markusJason McIntyre
2014-05-06Explicitly zero out the ibufs before releasing the memory to make sureReyk Floeter
that included crypto parameters are cleaned. ok mikeb@ markus@
2014-05-06initiate ike sa rekeying (ikesalifetime keyword), re-queue pfkeyMarkus Friedl
events while we are busy initiating child-SAs; ok mikeb@
2014-05-06cleanup IKE-SA tree handling (fixes repeated-insert & double-remove)Markus Friedl
sa_new() always re-inserts an SA into the SA tree. in case of a key collision it would try to free the new SA. While doing that it would accidentially free the existing SA, since config_free_sa() does RB_REMOVE() uncoditionally. This change fixes this by: a) moving the responsibility for RB_REMOVE() to CALLER of config_free_sa() and b) by calling config_free_sa() instead of sa_free() from sa_new() It also changes to code to NEVER re-add an SA to the tree. So RB_INSERT() is ONLY called once per SA. The code also makes sure that there is always a KEY defined for this tree (ispi). ok mikeb@
2014-05-06don't sa_free() in the receive path (prevents use-after-free); ok mikeb@Markus Friedl
2014-05-06send the delete with the locally allocated SPI in ikev2_init_create_child_sa()Markus Friedl
2014-05-06make sure some notify payloads are encrypted; ok mikeb@Markus Friedl
2014-05-06initial support for PFS; ok reyk@Markus Friedl
2014-05-06retire IKED_REQ_DELETE and fix delete parsing; ok reyk@Markus Friedl
2014-05-06no need to include rand.h now the RAND_seed() calls are gone.Jonathan Gray
ok reyk@
2014-05-05ca_x509_serialize: don't leak the bio buffer; ok reyk@Markus Friedl
2014-05-05make the ca_pubkey_serialize() code similar to the private key code, andMarkus Friedl
fixes a leak of the rsa object in the error case. from hshoexer@; ok reyk@
2014-05-05pfkey is unreliable, so add a select-timeout before MSG_PEEK;Markus Friedl
similar code is in isakmpd; ok reyk@
2014-05-05the caller of ikev2_msg_retransmit_response already frees the sa; ok mikebMarkus Friedl
2014-05-05don't leak on pid mismatch; ok mikebMarkus Friedl
2014-05-05validate the attribute length, too; from hshoexer; ok mikebMarkus Friedl
2014-05-05change surprisingly consistent mispelling of length ("lenght")Bret Lambert
no change in md5 of resulting object file ok markus@, reyk@
2014-05-04With the recent change by deraadt@ to introduce kern.nosuidcoredump=3,Reyk Floeter
we don't need the horrible debug hack anymore that disabled privdrop and chroot to get core dumps of privsep processes. No functional change for the normal binary, only if it is compiled with the non-default -DDEBUG option.
2014-04-29make sure the state machine only advances if the AUTH payload hasMarkus Friedl
been verified; with & ok mikeb@
2014-04-28macro fixes for previous; ok reykJason McIntyre
2014-04-28spacingReyk Floeter
2014-04-28spacingReyk Floeter
2014-04-28bump copyrightReyk Floeter
2014-04-28Add missing documentation for ipcomp(4) support and the configurationReyk Floeter
payloads. ok sthen@ krw@
2014-04-28It's about time to remove the infamous CAVEATS section in iked(8).Reyk Floeter
Software is never "finished" but the implementation has matured enough to drop the disclaimer about using it in production networks. Thanks to markus@, mikeb@ and Hans-Joerg Hoexer for their significant and ongoing work on improving iked(8). Removal prompted by sthen@ and many others.
2014-04-25don't access a pointer till after the null checkJonathan Gray
ok mikeb@
2014-04-22Update iked to use the same proc.c that relayd uses.Reyk Floeter
Less differences, less code to audit. ok mikeb@
2014-04-18round up some enemy sympathizers found calling RAND_seed().Ted Unangst
ok beck reyk
2014-04-16More des_foo -> DES_fooMiod Vallat
2014-04-14Fix the following idiom in the following way:Bret Lambert
arc4random_buf(seed, sizeof(seed)); RAND_seed(seed, sizeof(seed)); + explicit_bzero(seed, sizeof(seed)); ok reyk@
2014-04-10Add validation routines to ikev2_pld.c: For each payload type overallReyk Floeter
header structure is checked for sanity before copying the header. Always pass down the number of remaining bytes in the payload or substructure so we can always ensure to not go beyond actual data. Also remove the quick parsing step as it does not provide a real benefit anymore. From Hans-Joerg Hoexer ok mikeb@ markus@
2014-03-12don't leak an ibuf for each expired SA; ok mikeb@Markus Friedl
2014-03-12unbreak config-address w/o pool; ok mikeb@Markus Friedl
2014-02-26don't policy_ref an activate policy (policy_ref/unref are assymetrical),Markus Friedl
otherwise the policy list might get corrupted; from haesbaert
2014-02-21support rekeying for IPCOMP; ok mikeb@Markus Friedl
2014-02-18check the error from ikev2_cp_setaddrMarkus Friedl
2014-02-17interpret 'config address net/prefix' as a pool of addresses andMarkus Friedl
randomly choose the address for CFG_REQUEST. this address will be used to replace 0.0.0.0/32 in the specified flow. e.g. > ikev2 passive esp from 192.168.1.0/24 to 0.0.0.0 \ > config address 192.168.10.200/24 will assign an address between 192.168.10.200 and 192.168.10.254 and replace 0.0.0.0 with this address. ok mikeb@ on older version of this diff.
2014-02-17basic OCSP support. enable with 'set ocsp "http://10.0.0.10:8888/"'Markus Friedl
ok mikeb@
2014-02-17Fix compiler warnings in the format strings: use %zd for ssize_t andReyk Floeter
%zu for size_t. From Andre de Oliveira With input and OK from blambert@ markus@
2014-02-14remove unused function that distracts from cleaning up the imsg_flush() messSebastian Benoit
ok krw, florian, henning
2014-02-14initial support for IPCompMarkus Friedl
still experimental and rekeying needs some work; ok mikeb@
2014-02-12make sure to set the msg_responded flag on the original message; ok mikeb@Markus Friedl
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 17:28:16 +0000