summaryrefslogtreecommitdiff
path: root/sbin/ipsecctl
AgeCommit message (Collapse)Author
2012-09-18remove the SADB_X_SAFLAGS_{HALFIV,RANDOMPADDING,NOREPLAY} pfkey-API (not setMarkus Friedl
anywhere) as well as the matching TDBF_{HALFIV,RANDOMPADDING,NOREPLAY} code. ok mikeb@
2012-09-17unbreak the last commit by making sure that the transform nameMarkus Friedl
does not include a "," character. ok otto@
2012-09-15Encode the transform parameters in the transform name, too.Markus Friedl
Only using p1name or p2name as a transform identifier (as in rev 1.74) breaks setups that allow multiple transforms for a connection, e.g. in ike passive esp from any to 1.1.1.1 quick enc aes-128 ike passive esp from any to 1.1.1.1 quick enc aes-192 the aes-128 will be overwritten. ok and feedback mikeb@
2012-08-30Do not issue a spurious "force" when "group none" is specified.Christian Weisgerber
Tweaked from his fix and ok mikeb@
2012-08-12Explicitly state that only two unit specifiers are recognized instead ofLawrence Teo
"several." Note: if anyone adds support for more unit specifiers in the future, please change this back to "several" (instead of using an exact number) so that it matches the iked.conf(5) man page. :) While here, fix a typo in the quick mode section: "phase 1 lifetime" -> "phase 2 lifetime" ok mikeb sthen jmc haesbaert henning
2012-07-13small tweak;Jason McIntyre
2012-07-13Change the configuration format fed to the isakmpd FIFO to be ableMike Belopuhov
to specify extended options like SA Lifetime. All the hard work was done by lteo@, while naddy@ and me have made sure that defaults and AH still work; sthen and jmc have looked over the diffs as well.
2012-07-10Rename "life" to "lifetime" to match iked.Lawrence Teo
ok mikeb naddy sthen; procedures ok henning
2012-07-09Fix typo in warning message.Lawrence Teo
ok mikeb sthen haesbaert henning
2012-07-08Disallow manual security associations that use AES-CTR, AES-GCM,Christian Weisgerber
or AES-GMAC. These algorithms cannot be used safely with static keys and RFCs 3686, 4106, and 4543 expressly forbid such configurations. Also include a tweak (with jmc@) to the key size explanation, for completeness sake. ok mikeb@
2012-07-07copy&paste mistake in error messageChristian Weisgerber
2012-07-05don't output "esn" string in the rule section as we can't use theMike Belopuhov
keyword in the grammar to create a esn-enabled rule (no reason to do so for manual sa configuration). instead decode sa flags so that we can also watch changes happening in the realtime with the monitor mode. prompted and ok by naddy
2012-06-30enable use of AES-{192,256}-CTR, and explicitly of AES-128-CTR, for IPsec ESPChristian Weisgerber
ok mikeb@
2012-06-29Print esn flag when dumping SAs with ESN enabledMike Belopuhov
2012-04-24take a stab at documenting when arguments need quoted, and valid macroJason McIntyre
characters; prompted by a diff from robert peichaer org thanks gilles and henning for feedback ok deraadt zinke
2012-03-24fix some leaksJonathan Gray
ok miod@
2011-12-20unsigned long should use "%lu" format; from eric lax, thanksMike Belopuhov
2011-11-13provide a specific section reference; from Lawrence TeoJason McIntyre
2011-11-08- put -i in the right placeJason McIntyre
- prevent an erroneous space in the formatting of -D
2011-11-08mention default fifo path, sthen. previous manpage changes were ok jmc, plusHenning Brauer
reminder to adjust synopsis and usage (again...)
2011-11-08allow the path to isakmpd's fifo to be specified (aka changed) on theHenning Brauer
command line, ok mikeb sthen
2011-09-03make -column lists pretty again;Jason McIntyre
specifically, rewrite them to permit some markup in the column headers, and use "Ta" instead of literal tabs; mandoc does not currently match groff 100%, but a mandoc fix may be some time off, and we've gone enough releases with poorly formatting column lists. in some cases i have rewritten the lists as -tag, where -column made little sense.
2011-08-19as with other list types, column lists generally do not need a Pp/-compactJason McIntyre
construct; this also sidesteps what seems to be a problem with mandoc, in that "-column -compact" seems to mess up the formatting. thus these pages should now have their lists formatted nicely (i.e. correctly aligned and with indent applied); as a side note, the fact that headers are not properly marked up is another issue which will be addressed separately (a mandoc fix is needed, i think). i have fudged a few of these to mark up properly, since the workaround does make sense for some pages. as another side note, i haven;t fixed man7, as i need to prepare a separate diff for kristaps and ingo.
2011-07-07We can mention ipcomp, since it worksTheo de Raadt
2011-07-06For non-crypted flows (such as ipcomp and ipip), default theirTheo de Raadt
type (if not specified) to "use" instead of "require". (since they will not get a key...) ok mikeb claudio
2011-06-24wrap previous onto a second lineStuart Henderson
2011-06-24nat-to rules require a directionStuart Henderson
2011-04-13print flags in hex; from hshoexer@; ok mikeb@ mpf@Markus Friedl
2010-10-15fixup generation of suites string for isakmpd wrt "group none"Mike Belopuhov
bug noticed and fix tested by robert
2010-10-06Retire SkipjackMike Belopuhov
There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
2010-09-23change description for AES-GMAC a bit.Mike Belopuhov
prompted by reyk
2010-09-22Support AES-GCM-16 (as aes-gcm) and ENCR_NULL_AUTH_AES_GMACMike Belopuhov
(as aes-gmac) encryption transformations in the ipsec.conf(5). Available "enc" arguments denoting use of 1) AES-GCM-16: aes-128-gcm for 160 bit key (128+nonce) aes-192-gcm for 224 bit key (192+nonce) aes-256-gcm for 288 bit key (256+nonce) 2) ENCR_NULL_AUTH_AES_GMAC: aes-128-gmac for 160 bit key (128+nonce) aes-192-gmac for 224 bit key (192+nonce) aes-256-gmac for 288 bit key (256+nonce) Please note that aes-gmac family performs no encryption and provides no confidentiality and is intended for cases in which confidentiality is not desired (it can be thought of as AH with NAT-T support). Also, although this implementation supports manual keying, it's use is strictly discouraged as AES-GCM security depends on frequent re-keying. So it can be thought of as a debug facility only. Example configuration: ike esp from 172.23.61.36 to 172.23.61.156 \ quick enc aes-256-gcm \ psk humppa Thoroughly tested by me and naddy. Works fine with Linux. Requires updated pfkeyv2.h include file. OK naddy
2010-09-19more wacky macro fixing;Jason McIntyre
2010-08-03fix linecount bug with comments spanning multiple linesHenning Brauer
problem reported with the obvious fix for bgpd by Sebastian Benoit <benoit-lists at fb12.de>, also PR 6432 applied to all the others by yours truly. ok theo isn't it amazing how far this parser (and more) spread?
2010-07-01support dumping the new SADB_X_EXT_TAP extension.Reyk Floeter
2010-06-07fix a quoting wobble for the srcnat keyword; verified by reykJason McIntyre
2010-06-03update the manpages for isakmpd(8) and ipsec.conf(5) to point to iked(8)Reyk Floeter
for IKEv2 and to clarify that a) isakmpd is IKEv1/ISAKMP only and b) iked(8) is IKEv2 only. ISAKMP/IKEv1 support is currently not supported by iked(8) and not worked on, but maybe in the future - I want to get IKEv2 support first done right. So keep on using isakmpd(8) for IKEv1 for now... ok deraadt@
2010-05-10Various comment typos. 'wether' -> 'whether' (most popular), 'possiblity' ->Kenneth R Westerback
'possibility', 'optins' -> 'options', 'resposne' -> 'response', 'unecessary' -> 'unnecessary', 'desination' -> 'destination'. Collected from various misc@ and tech@ postings, many by Brad Tilley.
2010-01-02Various syntax errors in list headers, found by mandoc(1),Ingo Schwarze
also required to fix the mandoc build. "fine. even if mandoc goes nowhere, it has found some bugs ;)" jmc@ ok sobrado@
2009-11-13Don't use [] in function arguments when dealing with arraysJonathan Gray
we don't know the size of, otherwise gcc >= 4 will error. ok markus@ deraadt@
2009-10-21nat -> match...nat-to in example PF rule. ok mpf@Stuart Henderson
2009-10-04When IKE is operating in dynamic mode and no srcid is given, the hostnameJoel Sing
is used as the srcid, however the srcid type is not specified. Rectify this by explicitly setting the srcid type to FQDN after successfully retrieving the hostname. This worked prior to the addition of IPV4_ADDR/IPV6_ADDR support since get_id_type() returned ID_FQDN even when presented with a null pointer. Issue reported by Mikolaj Kucharski.
2009-08-04Specify an ID-type of IPV4_ADDR or IPV6_ADDR if the srcid or dstid isJoel Sing
given as an IPv4 or IPv6 address, rather than treating the IP address as a FQDN. ok hshoexer@ markus@ todd@
2009-03-31Fixed memory leaks which would occur if the second of two memoryTobias Stoeckmann
allocations fails. looks right deraadt, krw ok henning
2009-01-30If the "peer" address is not specified or derived from "to" forAlexander Bluhm
"ike" rules in ipsec.conf, the default peer is used. In theory ipsecctl -f ipsec.conf can configure the default peer for each "ike" entry. As isakmpd only supports one default peer, the last "ike" rule that uses a default peer wins. This configuration is then significant for all "ike" rules that use the default peer. Now a warning is printed if a later rule in ipsec.conf changes the configuration of the original default peer. This should be an error but that would break existing user configs. So only a warning is printed. ok hshoexer@, todd@
2009-01-29After checking that peer == NULL do not assign peer = NULL a fewAlexander Bluhm
lines later. No functional change. ok grunk@, hshoexer@
2009-01-29tweak previous;Jason McIntyre
2009-01-28Allow to specify ike and flow explicitly without peer. The anyAlexander Bluhm
keyword as argument for the peer parameter will do that. An ike without peer creates the peer-default config. A flow without peer acquires a host-to-host SA. tested by grunk@, todd@, ok grunk@, hshoexer@, todd@
2009-01-27A warning text in ipsecctl was used twice. Make the messages uniqueAlexander Bluhm
for easier debugging. ok grunk@, hshoexer@, todd@
2009-01-20Add support to isakmpd(8) and ipsecctl(8) to install SA's with aMarco Pfatschbacher
different source network than we have negotiated with a peer. This enables us to do nat/binat on the enc(4) interface. Very useful to work around rfc 1918 collisions. Manpage and testing by Mitja Muzenic. Thanks! OK hshoexer@, markus@. "I like it" todd@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 20:45:57 +0000