summaryrefslogtreecommitdiff
path: root/sbin/ipsecctl
AgeCommit message (Collapse)Author
2024-02-06Tweak previous. Passing "dns" to pledge(2) is suitable for the purpose.YASUOKA Masahiko
input deraadt, ok tobhe
2024-01-29Open /etc/{services,protocols} before pledge(2).YASUOKA Masahiko
ok tobhe
2023-10-10Print at most pkgsize - hdrsize bytes for pfkey tag and identity toTobias Heider
prevent out-of-bounds read in strlen(). ok tb@
2023-10-09Add pledge("stdio") before parsing pfkey messages. This applies toTobias Heider
ipsecctl -m and ipsecctl -s. Refactor ipsecctl_show_*() to setup all sysctls first before dropping privileges and finally parsing and printing IPsec SAs and flows. feedback and ok mbuhl@ ok deraadt@
2023-08-07add support route based ipsec vpn negotiation with sec(4) via isakmpd.David Gwynne
this adds "interface secX" to the grammar that you can use instead of specifying tunnel/transport modes and traffic selectors. if you have config like "ike interface sec0 local ... peer ...", ipsecctl will generate the right config for isakmpd to negotiate esp tunnels for all traffic between 0.0.0.0/0 and 0.0.0.0/0. however, this also specifies that they should be set up as interface SAs in the kernel for use with sec(4). this supports route-based instead of policy based ipsec encapsulation, and allows us to more easily operate with other vendors and products that also offer route-based vpns with opinions about the negotiated policy that doesnt fit with the SPD. support from many including markus@ tobhe@ claudio@ sthen@ patrick@ now is a good time deraadt@
2023-04-19remove duplicate includesJonathan Gray
2023-03-07Delete obsolete /* ARGSUSED1 */ lint comments.Philip Guenther
ok claudio@ cheloha@ krw@ deraadt@ miod@ millert@
2022-06-25Use in_addr for AF_INET.mbuhl
OK bluhm
2022-02-04Fix another instance of incorrect capitalization of ChaCha20.Theo Buehler
pointed out by jmc
2021-11-04Tweaks (improve previous commit)YASUOKA Masahiko
from jmc
2021-11-04Clarify "aes" will accept keys which length is in 128:256 bits. AlsoYASUOKA Masahiko
correct "cast" in ipsec.conf.5 to "cast128", add missing "chacha20-poly1305", and sync iked.conf.5 and ipsec.conf.5 some places. ok jmc sthen
2021-10-22After deleting hifn(4) the only provider for the LZS compressionAlexander Bluhm
algorithm is gone. Reomve all LZS references from the tree. The v42bis in isakmpd also looks unsupported. OK mvs@ patrick@ sthen@
2021-10-15Don't declare variables as "unsigned char *" that are passed toChristian Weisgerber
functions that take "char *" arguments. Where such chars are assigned to int or passed to ctype functions, explicitly cast them to unsigned char. For OpenBSD's clang, -Wpointer-sign has been disabled by default, but when the parse.y code was built elsewhere, the compiler would complain. With help from millert@ ok benno@ deraadt@
2021-07-14Export SA replay counters via pfkey and print with ipsecctl.tobhe
This is useful for debugging replay window issues with 64 bit sequence numbers in IPsec. ok bluhm@
2021-07-05Print SA MTU if included in pfkey message.tobhe
ok bluhm@ sthen@ mpi@
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-11-05Enable support for ASN1_DN ipsec identifiers.Peter Hessler
Tested with multiple Window 10 Pro (ver 2004) clients, and OpenBSD+iked as the server. OK tobhe@ sthen@ kn@
2020-06-01Fix "comparison of integers of different signs" warning.tobhe
ok patrick@
2020-04-23Support SADB_X_EXT_RDOMAIN extension in pfkey dump (-m).tobhe
ok markus@, patrick@
2020-02-16Quote variables in pf tag stringskn
Macros are expanded by the parser at parse time, whereas variables are read as ordinary strings and left unmodified; hence, quoted `"$domain"' gets passed to the daemon as is, which substitutes proper values before passing it to the kernel. `$domain' without quotes never makes it to the daemon, that is with `domain = foo' somewhere else "foo" is being eventually passed unmodified to the kernel. jmc prompted for a proper explanation and provided the final wording. OK tobhe jmc
2020-02-10briefly mention /etc/examples/ in the FILES section of all theIngo Schwarze
manual pages that document the corresponding configuration files; OK jmc@, and general direction discussed with many
2020-02-07Extend the ipsecctl(8) parser to set the udpencap flag and portAlexander Bluhm
number of an SA. This will be useful to test IPsec with NAT-T. OK sthen@ tobhe@
2019-11-10Consistently use _rcctl enable foo_ in examples, it's simpler and lessLandry Breuil
error prone than manually editing rc.conf.local, and also works to enable ipsec and accounting. tweak from schwarze@ to use the \(dq\(dq syntax for quotes in '.Dl foo_flags="" lines' instead of \&"\&". while at it, fix a reference to a bogus /dev/dhclient.conf file that recently snuck in. ok jmc@ deraadt@ schwarze@
2019-08-26Fix file descriptor leak due to popfile() never closing the main config file.tobhe
The fix is the same as for other parse.y files in the tree (see bgpd(8) or unwind(8)) ok bluhm@
2019-07-03snprintf/vsnprintf return < 0 on error, rather than -1.Theo de Raadt
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-02-13(unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherTheo de Raadt
larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
2018-11-07sync cmdline_symset() changes with src/usr.sbin; OK sashan@ claudio@miko
2018-11-01- odd condition/test in PF lexerAlexandr Nedvedicky
(and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
2018-09-07Remove unnused af argument from unmask(), sync with pfctlkn
Noted by jca, thanks. OK jca claudio
2018-08-28Display per-TDB counters in verbose mode.Martin Pieuchot
ok sthen@
2018-07-11Do for most running out of memory err() what was done for most runningKenneth R Westerback
out of memory log_warn(). i.e. ("%s", __func__) instead of manual function names and redundant verbiage about which wrapper detected the out of memory condition. ok henning@
2018-07-10Include <sys/queue.h> instead of relying on kernel headers to includeMartin Pieuchot
it. ok markus@ as part of a larger diff
2018-07-09No need to mention which memory allocation entry point failed (malloc,Kenneth R Westerback
calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
2018-07-08Be consistent in warn() and log_warn() usage whenKenneth R Westerback
running out of memory. Next step, be correct *and* consistent. ok dennis@ tb@ benno@ schwarze@
2018-04-26Plug leak in error case of the common 'varset' implementations.Kenneth R Westerback
ok benno@
2018-04-17Document how to avoid isakmpd(8) source IP address pitfalls by usingStefan Sperling
the Listen-on directive in isakmpd.conf(5). This directive can be necessary in multi-homed situations, and if isakmpd(8) is used with carp(4). ok sthen@ mpi@
2017-11-23in isakmpd(8), provide a hint: from scott chelohaJason McIntyre
also some minor tweaks while here...
2017-11-20Support collapsing flow outputs.Martin Pieuchot
Makes it easier to check live status of complex setups. ok hshoexer@
2017-10-27Support DH groups 19 to 21 and 25 to 30, just like iked(8) does.Martin Pieuchot
ok visa@, markus@
2017-04-19Rename all SA groups to bundles consistently. The first kernelAlexander Bluhm
commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@
2017-04-18use freezero()Theo de Raadt
2017-04-14Up to now ipsecctl(8) grouped SAs with identical src and dst to theAlexander Bluhm
flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@
2017-04-10Found another len += snprintf...Theo de Raadt
ok mikeb
2017-03-02Now that the kernel provides information about IPsec SA bundles,Alexander Bluhm
print them by default. OK hshoexer@
2017-02-28Depending on the addresses, ipsecctl(8) automatically groups saAlexander Bluhm
bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".Sebastian Benoit
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2015-12-10Remove NULL-checks before free(). ok tb@mmcc
2015-12-09Remove plain DES encryption from IPsec.Christian Weisgerber
DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 02:21:37 +0000