summaryrefslogtreecommitdiff
path: root/sbin/ipsecctl
AgeCommit message (Collapse)Author
2017-11-23in isakmpd(8), provide a hint: from scott chelohaJason McIntyre
also some minor tweaks while here...
2017-11-20Support collapsing flow outputs.Martin Pieuchot
Makes it easier to check live status of complex setups. ok hshoexer@
2017-10-27Support DH groups 19 to 21 and 25 to 30, just like iked(8) does.Martin Pieuchot
ok visa@, markus@
2017-04-19Rename all SA groups to bundles consistently. The first kernelAlexander Bluhm
commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@
2017-04-18use freezero()Theo de Raadt
2017-04-14Up to now ipsecctl(8) grouped SAs with identical src and dst to theAlexander Bluhm
flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@
2017-04-10Found another len += snprintf...Theo de Raadt
ok mikeb
2017-03-02Now that the kernel provides information about IPsec SA bundles,Alexander Bluhm
print them by default. OK hshoexer@
2017-02-28Depending on the addresses, ipsecctl(8) automatically groups saAlexander Bluhm
bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".Sebastian Benoit
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2015-12-10Remove NULL-checks before free(). ok tb@mmcc
2015-12-09Remove plain DES encryption from IPsec.Christian Weisgerber
DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
2015-12-02remove unimplemented PF_KEY algorithms; ok sthen@ mpi@ mikeb@Christian Weisgerber
2015-11-04Decode Chacha20-Poly1305 when dumping SAs; ok reyk, naddyMike Belopuhov
2015-11-01replace "can not" with "cannot";Jason McIntyre
2015-10-18Use explicit_bzero() when the memory is freed directly afterward.mmcc
ok deraadt@
2015-06-03Do not assume that asprintf() clears the pointer on failure, whichTodd C. Miller
is non-portable. Also add missing asprintf() return value checks. OK deraadt@ guenther@ doug@
2015-05-25bump up the default Diffie-Hellman group to modp3072; ok mikeb@ djm@Christian Weisgerber
2015-04-17Remove unsupported SADB_X_IDENTTYPE_CONNECTION; OK markus, hshoexerMike Belopuhov
2015-04-14Remove support for storing credentials and auth information in the kernel.Mike Belopuhov
This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
2015-02-28Reduce usage of predefined strings in manpages.Anthony J. Bentley
Predefined strings are not very portable across troff implementations, and they make the source much harder to read. Usually the intended character can be written directly. No output changes, except for two instances where the incorrect escape was used in the first place. tweaks + ok schwarze@
2015-01-16Replace <sys/param.h> with <limits.h> and other less dirty headers whereTheo de Raadt
possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
2015-01-10tell the truth about DES.Igor Sobrado
joint work with djm@ and jsing@, who suggested stronger words warning people away from single-DES. ok djm@
2015-01-02PFS stands for Perfect Forward Secrecy.Igor Sobrado
ok reyk@
2014-12-28Unbreak the tree. Looks like tedu did not tedu enough when killing KPDKClaudio Jeker
support.
2014-11-20Yet more #include de-duplication.Kenneth R Westerback
ok deraadt@ tedu@
2014-11-20Don't allow embedded nul characters in strings.Jonathan Gray
Fixes a pfctl crash with an anchor name containing an embedded nul found with the afl fuzzer. pfctl parse.y patch from and ok deraadt@
2014-11-04Add gcc format attributes to ipsecctl's parse.y. Also, fix a few formatDoug Hogan
characters. ok sthen@ naddy@ markus@
2014-11-03simple conversion from select() to poll()Theo de Raadt
2014-03-19Unify ipsec.conf(5)'s copy of the text dealing with multiline comments,Stuart Henderson
this was missed when unifying text in the other parse.y parsers (see e.g. pf.conf.5 r1.495). Noticed in a misc@ post by zeloff at zeloff/org.
2014-01-22fix printing of IPcomp SAs; ok mikeb@ & todd@Markus Friedl
2014-01-22relax the cfg file secrecy check slightly to allow group readabilityHenning Brauer
default permissions and mtree NOT changed. prodded by benno, ok phessler benno jmatthew theo pelikan florian
2013-11-25use u_char for buffers in yylex, for ctype callsSebastian Benoit
found by millert@, ok deraadt@
2013-11-22Whole bunch of (unsigned char) casts carefully added for ctype calls.Theo de Raadt
Careful second audit by millert
2013-11-01altq -> new queue in examplesHenning Brauer
From: Arto Jonsson <ajonsson at kapsi.fi>
2013-08-25the comment that comma characters cannot be used in transformMike Belopuhov
names in ike_section_p2 applies to phase-1 transforms as well.
2013-06-29do not use Sx for sections outwith the page;Jason McIntyre
man4 still to go...
2012-09-18remove the SADB_X_SAFLAGS_{HALFIV,RANDOMPADDING,NOREPLAY} pfkey-API (not setMarkus Friedl
anywhere) as well as the matching TDBF_{HALFIV,RANDOMPADDING,NOREPLAY} code. ok mikeb@
2012-09-17unbreak the last commit by making sure that the transform nameMarkus Friedl
does not include a "," character. ok otto@
2012-09-15Encode the transform parameters in the transform name, too.Markus Friedl
Only using p1name or p2name as a transform identifier (as in rev 1.74) breaks setups that allow multiple transforms for a connection, e.g. in ike passive esp from any to 1.1.1.1 quick enc aes-128 ike passive esp from any to 1.1.1.1 quick enc aes-192 the aes-128 will be overwritten. ok and feedback mikeb@
2012-08-30Do not issue a spurious "force" when "group none" is specified.Christian Weisgerber
Tweaked from his fix and ok mikeb@
2012-08-12Explicitly state that only two unit specifiers are recognized instead ofLawrence Teo
"several." Note: if anyone adds support for more unit specifiers in the future, please change this back to "several" (instead of using an exact number) so that it matches the iked.conf(5) man page. :) While here, fix a typo in the quick mode section: "phase 1 lifetime" -> "phase 2 lifetime" ok mikeb sthen jmc haesbaert henning
2012-07-13small tweak;Jason McIntyre
2012-07-13Change the configuration format fed to the isakmpd FIFO to be ableMike Belopuhov
to specify extended options like SA Lifetime. All the hard work was done by lteo@, while naddy@ and me have made sure that defaults and AH still work; sthen and jmc have looked over the diffs as well.
2012-07-10Rename "life" to "lifetime" to match iked.Lawrence Teo
ok mikeb naddy sthen; procedures ok henning
2012-07-09Fix typo in warning message.Lawrence Teo
ok mikeb sthen haesbaert henning
2012-07-08Disallow manual security associations that use AES-CTR, AES-GCM,Christian Weisgerber
or AES-GMAC. These algorithms cannot be used safely with static keys and RFCs 3686, 4106, and 4543 expressly forbid such configurations. Also include a tweak (with jmc@) to the key size explanation, for completeness sake. ok mikeb@
2012-07-07copy&paste mistake in error messageChristian Weisgerber
2012-07-05don't output "esn" string in the rule section as we can't use theMike Belopuhov
keyword in the grammar to create a esn-enabled rule (no reason to do so for manual sa configuration). instead decode sa flags so that we can also watch changes happening in the realtime with the monitor mode. prompted and ok by naddy
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-29 09:21:53 +0000