summaryrefslogtreecommitdiff
path: root/sbin/isakmpd/exchange.c
AgeCommit message (Collapse)Author
2001-08-25StyleNiklas Hallqvist
2001-08-22Need an extra sa_release() when de-allocating exchange-associated SAs;Angelos D. Keromytis
thus, failed exchanges/negotiations don't leak SAs and transports. ok niklas@
2001-08-15Some more style...Hakan Olsson
2001-08-11Fix keynote credential case again.Angelos D. Keromytis
2001-07-05Add prototypes and some other various cleanup.Hakan Olsson
2001-07-03strlcpy->strncpy for nowMarkus Friedl
2001-07-01StyleNiklas Hallqvist
2001-07-01Remove inaccurate "Assumes IPv4" comments.Angelos D. Keromytis
2001-06-29oopsNiklas Hallqvist
2001-06-29more AF-independenceNiklas Hallqvist
2001-06-29Change get_src/get_dst API as we get the length with sa_len.Hakan Olsson
2001-06-27Keep track of the ACQUIRE sequence number, and pass it to the kernelAngelos D. Keromytis
along with the ADD message.
2001-06-05Style.Angelos D. Keromytis
2001-06-05Style issues and commentaryNiklas Hallqvist
2001-06-05Dynamically allocate conn, as this is given to the exchange; cleanupAngelos D. Keromytis
conf space on failure to establish dynamic SA. ok niklas@
2001-05-31Copy the new information from the exchange to the sa at the end of theAngelos D. Keromytis
exchange, and generalize certificate copying by taking advantage of the new routines in the cert handler.
2001-05-05Add comment about finalize routine processing.Angelos D. Keromytis
2001-04-24Correct SA refcounting. Fixes a bug where isakmpd could die when a peer wasNiklas Hallqvist
discovered to have rebooted, and old now invalid SAs had to be garbage- collected.
2001-04-09More style fixes...Hakan Olsson
2001-04-08log_print, not log_errorHakan Olsson
2001-03-28Take into consideration the IDs when determining whether two Phase 1Angelos D. Keromytis
SAs match.
2001-02-24For the GETSPI PFKEY message, use the sequence number from the ACQUIREAngelos D. Keromytis
message.
2001-01-27(c) 2001Niklas Hallqvist
2001-01-26Pedantic style policeNiklas Hallqvist
2001-01-22Fix comment and error message reporting.Angelos D. Keromytis
2000-12-12Merge with EOM 1.143Niklas Hallqvist
author: angelos Careful when copying IDs. author: angelos Oops, what am I thinking ? author: angelos Ooops again, I reverted the wrong patch. author: angelos Oops, shouldn't have committed this. author: angelos x509_hash() should also skip the cert length (willey@serasystems.com) author: angelos If it's a dynamically established Phase 2 SA, don't keep a copy of it in isakmpd (the kernel keeps track of everything in this case). author: angelos Comment. author: angelos If no time-based lifetime was negotiated, don't release the SA.
2000-12-02Add comment.Angelos D. Keromytis
2000-12-02Manual sync with EOM -- only release an SA if it's referenced by theAngelos D. Keromytis
timeout routine (should there be a default expiration if none is negotiated ?)
2000-10-16Merge with EOM 1.134Niklas Hallqvist
author: provos better referencing. okay niklas@
2000-10-09Merge with EOM 1.133Niklas Hallqvist
author: angelos Use Default entry for Phase 1 configuration if none is found.
2000-10-07Merge with EOM 1.132Niklas Hallqvist
author: niklas style author: ho (c)-2000 author: provos proper reference counting for isakmp_sa in struct message, remove bogus calls to sa_reference; fix some more memory leaks in conf.c
2000-08-03Merge with EOM 1.129Niklas Hallqvist
author: provos dont strdup exchange->recv_cert, it is not always a 0 terminated string for CERTENC_NONE. we need to malloc and memcpy instead. found by electric fence. author: provos provide transport dependent ID decoding; hope indentation is right now ;) author: ho ISAKMP peer transport defaults to UDP. author: provos make a DOI specific decode_ids, but have isakmp doi decode point to ipsec. author: provos indent author: provos introduce ipsec_decode_ids, also decodes FQDN and USER_FQDN now. new ipsec_clone_id to copy IDs to phase 2 SAs for better status reports. okay angelos@
2000-06-08Merge with EOM 1.123Niklas Hallqvist
author: angelos Reset policy_id and recv_key after we've moved them over from the exchange to the isakmp_sa, so they don't get free'ed. author: angelos Allow exchange of KeyNote credentials over IKE. Multiple credentials may be passed in a single CERT payload. KeyNote is used if a directory named as the local ID we use in an exchange exists in the KeyNote directory (default: /etc/isakmpd/keynote/). Note that asymmetric credentials are possible (use KeyNote in one direction and X509 in the other); such authentication is envisioned to be the most common: the clients will use KeyNote credentials to authenticate and authorize with a server, whilst the server will just provide an X509 certificate proving its binding to the IP address or ID. Totally asymmetric authentication (e.g., shared key in one direction, RSA in the other) is not supported by the IKE protocol. author: angelos Add CERTENC_KEYNOTE. author: ho DOI IPSEC is default if not specified.
2000-04-07Merge with EOM 1.119Niklas Hallqvist
author: niklas log_fatal is only OK during initialization author: ho Missing #ifdef USE_X509 added author: ho Add #ifdef USE_X509
2000-02-25regress/crypto/Makefile: Merge with EOM 1.5Niklas Hallqvist
regress/dh/Makefile: Merge with EOM 1.7 regress/group/Makefile: Merge with EOM 1.9 regress/prf/Makefile: Merge with EOM 1.4 regress/rsakeygen/Makefile: Merge with EOM 1.8 regress/x509/Makefile: Merge with EOM 1.10 Makefile: Merge with EOM 1.62 attribute.c: Merge with EOM 1.10 sa.c: Merge with EOM 1.99 conf.c: Merge with EOM 1.20 crypto.c: Merge with EOM 1.28 isakmpd.c: Merge with EOM 1.45 connection.c: Merge with EOM 1.19 doi.h: Merge with EOM 1.28 field.c: Merge with EOM 1.11 exchange.c: Merge with EOM 1.116 ike_auth.c: Merge with EOM 1.44 pf_key_v2.c: Merge with EOM 1.37 ike_phase_1.c: Merge with EOM 1.22 ipsec.c: Merge with EOM 1.118 isakmp_doi.c: Merge with EOM 1.40 log.c: Merge with EOM 1.26 log.h: Merge with EOM 1.18 math_group.c: Merge with EOM 1.23 message.c: Merge with EOM 1.144 pf_encap.c: Merge with EOM 1.70 policy.c: Merge with EOM 1.18 timer.c: Merge with EOM 1.13 transport.c: Merge with EOM 1.41 udp.c: Merge with EOM 1.47 ui.c: Merge with EOM 1.37 x509.c: Merge with EOM 1.36 author: niklas Made debug logging a compile time selectable feature
2000-02-19Makefile: Merge with EOM 1.61Niklas Hallqvist
crypto.c: Merge with EOM 1.27 exchange.c: Merge with EOM 1.115 ike_quick_mode.c: Merge with EOM 1.115 x509.c: Merge with EOM 1.35 features/ec: Merge with EOM 1.1 features/aggressive: Merge with EOM 1.1 features/policy: Merge with EOM 1.1 features/x509: Merge with EOM 1.1 author: niklas Allow isakmpd builders to remove optional parts and save bytes.
2000-02-01apps/certpatch/certpatch.8: Merge with EOM 1.4Niklas Hallqvist
apps/certpatch/certpatch.c: Merge with EOM 1.6 exchange.c: Merge with EOM 1.114 ike_quick_mode.c: Merge with EOM 1.110 ike_phase_1.c: Merge with EOM 1.16 ike_auth.c: Merge with EOM 1.41 ike_aggressive.c: Merge with EOM 1.4 libcrypto.c: Merge with EOM 1.10 libcrypto.h: Merge with EOM 1.10 isakmpd.8: Merge with EOM 1.19 isakmpd.c: Merge with EOM 1.42 ipsec.h: Merge with EOM 1.40 init.c: Merge with EOM 1.22 message.c: Merge with EOM 1.143 message.h: Merge with EOM 1.49 sa.c: Merge with EOM 1.98 sa.h: Merge with EOM 1.54 policy.c: Merge with EOM 1.14 pf_key_v2.c: Merge with EOM 1.36 x509.c: Merge with EOM 1.32 x509.h: Merge with EOM 1.9 udp.c: Merge with EOM 1.46 author: niklas Angelos copyrights
2000-01-26Merge with EOM 1.113Niklas Hallqvist
author: ho Lower common log message from log_print to log_debug 'level'. author: niklas style & wording
1999-08-26Merge with EOM 1.111Niklas Hallqvist
author: niklas Check that ISAKMP-peer's are phase 1 author: angelos Complete policy work; tested for the shared-key case. Documentation needed.
1999-07-17regress/rsakeygen/Makefile: Merge with EOM 1.4Niklas Hallqvist
regress/rsakeygen/rsakeygen.c: Merge with EOM 1.8 regress/x509/Makefile: Merge with EOM 1.6 regress/x509/x509test.c: Merge with EOM 1.6 regress/Makefile: Merge with EOM 1.8 samples/VPN-east.conf: Merge with EOM 1.6 samples/VPN-west.conf: Merge with EOM 1.6 samples/singlehost-east.conf: Merge with EOM 1.3 samples/singlehost-west.conf: Merge with EOM 1.3 sysdep/openbsd/Makefile.sysdep: Merge with EOM 1.5 x509.h: Merge with EOM 1.6 x509.c: Merge with EOM 1.17 DESIGN-NOTES: Merge with EOM 1.46 Makefile: Merge with EOM 1.55 cert.c: Merge with EOM 1.11 cert.h: Merge with EOM 1.6 exchange.c: Merge with EOM 1.109 exchange.h: Merge with EOM 1.26 ike_auth.c: Merge with EOM 1.32 ike_phase_1.c: Merge with EOM 1.7 init.c: Merge with EOM 1.16 isakmpd.conf.5: Merge with EOM 1.27 README.PKI: Merge with EOM 1.1 author: niklas From Niels Provos, edited by me: certificate support using SSLeay
1999-07-07Merge with EOM 1.108Niklas Hallqvist
author: ho Connection names only match phase 2 exchanges, so let a phase 2 stayalive imply stayalive of the "parent" ISAKMP SA. author: ho 'Connections' should stay alive (SA_FLAG_STAYALIVE)
1999-06-02exchange.c: Merge with EOM 1.106Niklas Hallqvist
timer.c: Merge with EOM 1.12 author: ho Logging nitpicks
1999-05-02Merge with EOM 1.105Niklas Hallqvist
author: niklas Free SAs left in the exchange's SA list always when freeing the exchange. author: niklas disconnect SAs from the exchange when they are ready author: ho Don't create SAs for informational exchanges.
1999-05-01Merge with EOM 1.102Niklas Hallqvist
author: niklas Remove larval SAs if an exchange dies. Also use the DOI from the isakmp_sa if doing an informational exchange in phase 2.
1999-04-30Merge with EOM 1.101Niklas Hallqvist
author: niklas Do not free a message twice
1999-04-30Merge with EOM 1.100Niklas Hallqvist
author: niklas Try to fix the retransmit business, so info exchanges does not retransmit author: niklas Remove unneccesary code author: niklas Keep track of messages in the send queue from the exchange point of view. author: niklas Free the last sent message when freeing an exchange author: niklas New message_drop API. Generate real INVALID_COOKIE notification. Generate informational exchanges in phase 1 too. Really get these messages to the wire
1999-04-27Merge with EOM 1.95Niklas Hallqvist
author: niklas Handle leftover payloads. author: niklas Simplify exchange life logic some. Some style too. author: niklas Collapse MSG_NO_RETRANS & MSG_KEEP into MSG_LAST. author: niklas Style author: ho Keep track of trailing retransmissions by keeping exchanges around longer. Removed references to sa->last_sent_in_setup, use last_sent and last_received in exchange instead. Free setup exchanges by expiration only. author: ho Backout last change. (Go with exchange directly instead of sa->msg) author: ho Handle phase 2 late retransmissions.
1999-04-19./exchange.c: Merge with EOM 1.88Niklas Hallqvist
Check should be for step > 1, not step > 0. Don't drop new incoming phase 1 exchange request if our existing exchange hasn't gotten past step 0. Style. alloc error reporting. Math error propagation. Allocate right sizes. Off by one (< -> <=) Let's get aggressive\! Added classes LOG_SA and LOG_EXCHANGE, converted many LOG_MISC to new classes, adjusted levels slightly. More SA logging. Simplify the checks of existing exchanges by moving it into exchange_establish. This means we need to change the finalize API. Try to make PF_ENCAP support handle multiple connections to a single security gateway. Include sa_list in exchange_dump Add finalization to exchange when we initiate a new exchange while an old one is being setup. Add LOG_REPORT to always go to logchannel regardless of level; misc small fixes Deal with incoming informational exchanges style At end of an exchange, mark the old SAs as replaced. Do not answer on main-mode initiations from peers we already talk to.
1999-04-05Merge with EOM 1.75Niklas Hallqvist
Plug the leak of the last QM message. More error reporting from insufficient memory. Move the finalize call of exchanges as close to the real deallocation as possible. New finalize API so we can call it when failing too, so we do not leak resources. Plug memory leaks in general. More memory allocation error reporting.
1999-04-02Merge with EOM 1.73Niklas Hallqvist
refcounting on exchanges Do not malloc zero bytes, some implementations dislike resource track exchange->name and sa->name
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 16:38:18 +0000