summaryrefslogtreecommitdiff
path: root/sbin/isakmpd/ike_auth.c
AgeCommit message (Collapse)Author
2002-09-11signed vs unsigned, some void * arithmetic, from -pedantic. niklas@ ok.Hakan Olsson
2002-06-10The dlopen() stuff goes away.Hakan Olsson
2002-06-09rm trailing whitespaceTodd T. Fries
2002-06-01size_t must be cast to (unsigned long) and printed using %luTheo de Raadt
2002-05-28off_t to size_t change for printf format and malloc. Pointed out by ↵Hakan Olsson
<greg@nest.cx>
2002-01-23strncat->strlcat, sprintf->snprintfHakan Olsson
2001-08-23Correct ipsec_id_string buffer and length handling.Niklas Hallqvist
2001-08-22use ipsec_id_string() when generating rawkey file names.Hakan Olsson
2001-08-22If we fail to get a key from DNSSEC, RAWKEY can still succeed.Hakan Olsson
2001-08-16openssl black magic.Hakan Olsson
2001-08-16Off-by-one error in [u]fqdn cases, plus better debug messages whenHakan Olsson
looking for public key files.
2001-08-16ISAKMP ID type offset was wrong.Hakan Olsson
2001-08-15Some more style...Hakan Olsson
2001-08-15Support trusted public (RSA) keys as files too. niklas@ ok.Hakan Olsson
2001-07-01StyleNiklas Hallqvist
2001-06-29Remove extra ':' from LOG_DBG_BUF()Angelos D. Keromytis
2001-06-29Initial IPv6 support. (niklas@ ok)Hakan Olsson
2001-06-28Add some more debugging information wrt PRF generation.Angelos D. Keromytis
2001-06-11make #ifdef around x509_generate_kn() consistent.Jun-ichiro itojun Hagino
2001-06-07Actually, don't re-insert X509 certs which we acquired from our storeAngelos D. Keromytis
-- just translate them to KeyNote.
2001-06-07Add an X509 cert in the policy session even if it was found in ourAngelos D. Keromytis
local repository.
2001-06-06NUL-terminate passphrase.Angelos D. Keromytis
2001-06-05Don't use log_error() if it's an internal error.Angelos D. Keromytis
2001-06-05Style issues and commentaryNiklas Hallqvist
2001-06-05Add back check for found/not found public key to use for verificationAngelos D. Keromytis
(somehow was dropped during the previous commit).
2001-05-31When trying to find the right certificate/key to use, first check inAngelos D. Keromytis
the conf space, as we may have been passed that information from the kernel. Likewise, store the peer's key and cert so we can send it back to the kernel when we establish the SA.
2001-05-24Match the IDs without checking the ASN1 length field, similar to howAngelos D. Keromytis
we do things in x509.c --- this should solve some problems with certificate-based authentication not working.
2001-04-09Style police a'la niklas@.Hakan Olsson
2001-03-27Plug one memory leak. Found with boehm-gc.Hakan Olsson
2001-01-27Call OpenSSL functions with LC (). Various style nits.Hakan Olsson
2001-01-27(c) 2001Niklas Hallqvist
2001-01-27include dnssec.h only if USE_DNSSEC; niklas okJun-ichiro itojun Hagino
2001-01-26Preliminary but working code to permit IKE authentication using DNSSECHakan Olsson
validated KEY records. Uses lwresd from the bind-9.1.0 port. Enable by adding 'dnssec' to FEATURES.
2001-01-26include keynote.h only if USE_KEYNOTE is defined; ok niklas@Markus Friedl
2001-01-26Pedantic style policeNiklas Hallqvist
2000-12-19gmp is gone, make it build again; cvs retardMichael Shalayeff
2000-11-23Merge with EOM 1.59Niklas Hallqvist
author: angelos Initialize variable, avoid free() warnings. author: provos when cert_get fails dont dereference p if its NULL, found by francis.dupont@enst-bretagne.fr
2000-10-13util.h: Merge with EOM 1.8Niklas Hallqvist
ike_auth.c: Merge with EOM 1.57 author: ho Add file permission check to private key file. Split out check function to util.c.
2000-10-07Merge with EOM 1.56Niklas Hallqvist
author: niklas Multiple subject name matching, makes certificate interop with PGPnet at least partly working. Added some error checking. author: angelos No need to delete SPIs, they'll just expire. author: provos style as pointed out by the code style pedant.
2000-08-03Merge with EOM 1.53Niklas Hallqvist
author: provos prevent isakmpd crashing when client gives an unknown ID in aggressive mode. bug report from James Winquist <winquist@mail.cybernet.com>
2000-06-20Merge with EOM 1.52Niklas Hallqvist
author: niklas Indentation, bad greek
2000-06-08Merge with EOM 1.51Niklas Hallqvist
author: angelos Don't add the callback at initialization time, we must set it before each invokation. author: angelos Different policy/Keynote sessions per Phase 1 SA. author: angelos Allow exchange of KeyNote credentials over IKE. Multiple credentials may be passed in a single CERT payload. KeyNote is used if a directory named as the local ID we use in an exchange exists in the KeyNote directory (default: /etc/isakmpd/keynote/). Note that asymmetric credentials are possible (use KeyNote in one direction and X509 in the other); such authentication is envisioned to be the most common: the clients will use KeyNote credentials to authenticate and authorize with a server, whilst the server will just provide an X509 certificate proving its binding to the IP address or ID. Totally asymmetric authentication (e.g., shared key in one direction, RSA in the other) is not supported by the IKE protocol.
2000-04-07Merge with EOM 1.48Niklas Hallqvist
author: niklas Style and correct error reporting author: provos remove double free(buf), caused skeyid to point to skeyid_d when using USER_FQDN author: niklas More braindamage with USE_ macros
2000-02-28Merge with EOM 1.45Niklas Hallqvist
author: niklas I must have been on drugs. X509 is not preshared key.
2000-02-25regress/crypto/Makefile: Merge with EOM 1.5Niklas Hallqvist
regress/dh/Makefile: Merge with EOM 1.7 regress/group/Makefile: Merge with EOM 1.9 regress/prf/Makefile: Merge with EOM 1.4 regress/rsakeygen/Makefile: Merge with EOM 1.8 regress/x509/Makefile: Merge with EOM 1.10 Makefile: Merge with EOM 1.62 attribute.c: Merge with EOM 1.10 sa.c: Merge with EOM 1.99 conf.c: Merge with EOM 1.20 crypto.c: Merge with EOM 1.28 isakmpd.c: Merge with EOM 1.45 connection.c: Merge with EOM 1.19 doi.h: Merge with EOM 1.28 field.c: Merge with EOM 1.11 exchange.c: Merge with EOM 1.116 ike_auth.c: Merge with EOM 1.44 pf_key_v2.c: Merge with EOM 1.37 ike_phase_1.c: Merge with EOM 1.22 ipsec.c: Merge with EOM 1.118 isakmp_doi.c: Merge with EOM 1.40 log.c: Merge with EOM 1.26 log.h: Merge with EOM 1.18 math_group.c: Merge with EOM 1.23 message.c: Merge with EOM 1.144 pf_encap.c: Merge with EOM 1.70 policy.c: Merge with EOM 1.18 timer.c: Merge with EOM 1.13 transport.c: Merge with EOM 1.41 udp.c: Merge with EOM 1.47 ui.c: Merge with EOM 1.37 x509.c: Merge with EOM 1.36 author: niklas Made debug logging a compile time selectable feature
2000-02-19cert.c: Merge with EOM 1.14Niklas Hallqvist
ike_auth.c: Merge with EOM 1.43 ike_phase_1.c: Merge with EOM 1.21 init.c: Merge with EOM 1.24 ipsec.c: Merge with EOM 1.117 isakmpd.c: Merge with EOM 1.44 math_group.c: Merge with EOM 1.22 author: niklas Copyright 2000 author: niklas Allow isakmpd builders to remove optional parts and save bytes.
2000-02-01apps/certpatch/certpatch.8: Merge with EOM 1.4Niklas Hallqvist
apps/certpatch/certpatch.c: Merge with EOM 1.6 exchange.c: Merge with EOM 1.114 ike_quick_mode.c: Merge with EOM 1.110 ike_phase_1.c: Merge with EOM 1.16 ike_auth.c: Merge with EOM 1.41 ike_aggressive.c: Merge with EOM 1.4 libcrypto.c: Merge with EOM 1.10 libcrypto.h: Merge with EOM 1.10 isakmpd.8: Merge with EOM 1.19 isakmpd.c: Merge with EOM 1.42 ipsec.h: Merge with EOM 1.40 init.c: Merge with EOM 1.22 message.c: Merge with EOM 1.143 message.h: Merge with EOM 1.49 sa.c: Merge with EOM 1.98 sa.h: Merge with EOM 1.54 policy.c: Merge with EOM 1.14 pf_key_v2.c: Merge with EOM 1.36 x509.c: Merge with EOM 1.32 x509.h: Merge with EOM 1.9 udp.c: Merge with EOM 1.46 author: niklas Angelos copyrights
1999-10-01Merge with EOM 1.40Niklas Hallqvist
author: angelos Allow for new versions of SSLeay author: angelos Remove evil experimental code, fix off-by-1 buffer allocation.
1999-09-29openssl readiness; various group membersTheo de Raadt
1999-08-26Merge with EOM 1.38Niklas Hallqvist
author: angelos When doing preshared key authentication, if the responder has the initiator's ID (as is the case in aggressive mode) and a shared key cannot be found for the initiator's address (as may be the case for a roaming laptop user), try to find the password under using as a lookup key the initiator's Phase 1 ID, if it's an IPv4 address, an FQDN (host.domain), or a User-FQDN (user@host.domain). This allows us to support roaming laptop users with preshared key authentication, using aggressive mode (sick). There is also a lot of experimental, insecure, and ifdef'd out code for fetching credentials and secret passphrases from a remote server if all else fails. Extremely experimental code. Don't use. You'll be blinded and your hair will fall if you even think about using it. You have been warned. author: angelos Complete policy work; tested for the shared-key case. Documentation needed. author: ho Compile without USE_LIBCRYPTO and HAVE_DLOPEN. author: niklas Missing dynamic link fixes author: niklas Add support for dynamic loading of optional facilities, libcrypto first.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-29 12:01:49 +0000