summaryrefslogtreecommitdiff
path: root/sbin/ipsecctl/parse.y
AgeCommit message (Collapse)Author
2009-08-04Specify an ID-type of IPV4_ADDR or IPV6_ADDR if the srcid or dstid isJoel Sing
given as an IPv4 or IPv6 address, rather than treating the IP address as a FQDN. ok hshoexer@ markus@ todd@
2009-03-31Fixed memory leaks which would occur if the second of two memoryTobias Stoeckmann
allocations fails. looks right deraadt, krw ok henning
2009-01-30If the "peer" address is not specified or derived from "to" forAlexander Bluhm
"ike" rules in ipsec.conf, the default peer is used. In theory ipsecctl -f ipsec.conf can configure the default peer for each "ike" entry. As isakmpd only supports one default peer, the last "ike" rule that uses a default peer wins. This configuration is then significant for all "ike" rules that use the default peer. Now a warning is printed if a later rule in ipsec.conf changes the configuration of the original default peer. This should be an error but that would break existing user configs. So only a warning is printed. ok hshoexer@, todd@
2009-01-29After checking that peer == NULL do not assign peer = NULL a fewAlexander Bluhm
lines later. No functional change. ok grunk@, hshoexer@
2009-01-28Allow to specify ike and flow explicitly without peer. The anyAlexander Bluhm
keyword as argument for the peer parameter will do that. An ike without peer creates the peer-default config. A flow without peer acquires a host-to-host SA. tested by grunk@, todd@, ok grunk@, hshoexer@, todd@
2009-01-20Add support to isakmpd(8) and ipsecctl(8) to install SA's with aMarco Pfatschbacher
different source network than we have negotiated with a peer. This enables us to do nat/binat on the enc(4) interface. Very useful to work around rfc 1918 collisions. Manpage and testing by Mitja Muzenic. Thanks! OK hshoexer@, markus@. "I like it" todd@
2008-11-14When parsing v4 addresses mark them as network addressesHans-Joerg Hoexer
(IPV4_ADDR_SUBNET) when they contain a '/'. This allows to choose between IPV4_ADDR and IPV4_ADDR_SUBNET by adding "/32", ie. "a.b.c.d" vs. "a.b.c.d/32". This helps to interop with other IKE implementations. From Mitja Muzenic <mitja at muzenic dot net>, thanks! Idea supported by markus@ and jdixon@.
2008-10-17findeol() fix from pfctlHenning Brauer
2008-07-01If a rules contains a hostname instead of an address, use the listAlexander Bluhm
of all possible addresses from DNS and not only the first one. So during expansion, the right address family can be chosen and regression test ike56 passes again. There localhost resolves to 127.0.0.1 and ::1. ok hshoexer
2008-07-01If multiple to addresses but no peer are given in an ike or flowAlexander Bluhm
rule, the current to address is taken as peer during expansion. This makes the broken regress test ikefail7 obsolete as address family mismatch cannot happen anymore. ok hshoexer
2008-06-14Move ike and flow peer selection to common function.Alexander Bluhm
No functional change yet. ok hshoexer
2008-06-11trivial code simplificationAlexander Bluhm
tested and ok hshoexer, grunk
2008-04-11add support for the "include" directive using code from pfctl/parse.y.Reyk Floeter
pointed out by Prabhu Gurumurthy ok deraadt@
2008-02-22Support for specifying aes-{128,192,256}. Originial idea by PrabhuHans-Joerg Hoexer
Gurumurthy, tweaks and commit-ready diff by Mitja Muzenic! Thanks guys! ok todd@
2007-11-12Remove space/tab compression function from lgetc() and replaceMarco Pfatschbacher
it with a simple filter in the yylex() loop. The compression in lgetc() didn't happen for quoted strings, thus creating a regression when tabs were used in variables. Some testing by todd@ and pyr@ OK deraadt@
2007-10-22sync with daemon parser code.Pierre-Yves Ritschard
ok deraadt@
2007-10-16Allow '=' to end a number in all lexers.Marco Pfatschbacher
Requested and OK deraadt@
2007-10-16in the lex... even inside quotes, a \ followed by space or tab shouldTheo de Raadt
expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). pointed out by mpf, discussed with pyr
2007-10-13in all these programs using the same pfctl-derived parse.y, re-unify theTheo de Raadt
yylex implementation and the code which interacts with yylex. this also brings the future potential for include support to all of the parsers. in the future please do not silly modifications to one of these files without checking if you are de-unifying the code. checked by developers in all these areas.
2007-10-11next step in the yylex unification: handle quoted strings in a nicer fashionTheo de Raadt
as found in hoststated, and make all the code diff as clean as possible. a few issues remain mostly surrounding include support, which will likely be added to more of the grammers soon. ok norby pyr, others
2007-09-12Here too: Add support to the lex for parsing number out of the stream.Hans-Joerg Hoexer
handle this in the parser. better range checks. with and ok deraadt@
2007-08-10duplicate strdup; ok hshoexerMarkus Friedl
2007-07-03allow proto esp/ah in flow specification (especially useful for bypass flows)Markus Friedl
ok hshoexer, mpf
2007-05-10Do not crash when lists include the "any" keyword. Reported byHans-Joerg Hoexer
<ralf.horstmann at gmx.net>, thanks! Slightly different fix. Also add a regression test. ok mpf@
2007-03-16move autodetection of the ID type to the parser. this way theMarkus Friedl
static flows have the correct ID, too. ok hshoexer, reyk
2007-02-26Really, we don't need two grp18's ;-)Todd T. Fries
ok hshoexer@ and markus@
2007-02-19Bits for ESP+NULL encryption. This is useful, when AH can not beHans-Joerg Hoexer
used (when being behind NAT). With Martin Hedenfalk <martin.hedenfalk at gmail.com>, thanks! ok markus@
2007-02-19undo previous commit and keep the original behaviour of the parser.Hans-Joerg Hoexer
asked for by deraadt@
2007-02-16Do not accept '\n' in quoted strings. Addresses issues noticed byHans-Joerg Hoexer
Prabhu Gurumurthy <pgurumu () gmail ! com> (http://marc.theaimsgroup.com/?l=openbsd-misc&m=116060233106902&w=2), thanks! ok markus@ cloder@ (uhm, quite some time ago)
2007-01-10allow rule if there is at least _one_ matching address family combination.Markus Friedl
this allows 'flow from lo0 to 127.0.0.1' if lo0 has an ipv6 address. ok itojun@, hshoexer@
2007-01-04don't pass -1 as a netmask; report vicviq at gmail.comMarkus Friedl
2007-01-02better support for IPv6 hostname/numeric representation.Jun-ichiro itojun Hagino
hostname/prefixlen works only for IPv4-only hostname. markus ok (regress tested)
2006-11-24add support to tag ipsec traffic belonging to specific IKE-initiatedReyk Floeter
phase 2 traffic. this allows policy-based filtering of encrypted and unencrypted ipsec traffic with pf(4). see ipsec.conf(5) and isakmpd.conf(5) for details and examples. this is work in progress and still needs some testing and feedback, but it is safe to put it in now. ok hshoexer@
2006-11-13Handle rules with addresses from mismatched address families correctly.Ryan Thomas McBride
ok msf@
2006-11-10check both rule sourace and destination when grouping sa'sMathieu Sauve-Frankel
fixes PR5262 ok hshoexer@
2006-11-10Do not count sa, ike and tcpmd5 rules twice. Fixes PR 5263.Hans-Joerg Hoexer
2006-11-01Add support for aggressive mode (from the k2k6 IPsec hackathon).Ryan Thomas McBride
ok hshoexer
2006-09-22typo in err(); from bret.lambert@gmail.com, thanks!Hans-Joerg Hoexer
2006-06-18add group "none"; when choosen, pfs will be disabled.Hans-Joerg Hoexer
ok david msf
2006-06-16report the correct line number on an error. Noticed by david@Hans-Joerg Hoexer
2006-06-11As naddy@ pointed out RFC 3686 discourages use of AESCTR for staticHans-Joerg Hoexer
keying. markus@ seconds this, so use AES CBC as default. ok naddy@
2006-06-10Better error message when a key file can not be opened or the provided key isHans-Joerg Hoexer
not of correct size. Suggested by david@
2006-06-10knf & careful data freeing, regression tested by toddTheo de Raadt
2006-06-08fix some indentation, noticed by david@Hans-Joerg Hoexer
2006-06-08Add a transport mode specifier to ike rules. Tunnel mode remains the default.Christian Weisgerber
"looks right" hshoexer@
2006-06-08turns out this really doesn't break what is in the tree; ok hshoexer@Todd T. Fries
2006-06-07make sure, we initialize unspecified keys and spis. Noticed byHans-Joerg Hoexer
naddy@, ok naddy@.
2006-06-07Do not yet expand the "any" keyword to v6 addresses. ok todd@Hans-Joerg Hoexer
2006-06-07remove unused prototype, ok todd@Hans-Joerg Hoexer
2006-06-02support tcp/udp port modifiers in ike rulesChristian Weisgerber
"put it in if it doesn't break regress" hshoexer@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-20 06:40:14 +0000