summaryrefslogtreecommitdiff
path: root/sbin/isakmpd
AgeCommit message (Collapse)Author
2019-07-03snprintf/vsnprintf return < 0 on error, rather than -1.Theo de Raadt
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-02-19oops, bad Pp snuck in;Jason McIntyre
2019-02-18Rework the certificate generation examples a bit:Stuart Henderson
- show an example sed to substitute the $ENV::CERTIP/CERTFQDN strings while copying /etc/ssl/x509v3.cnf to a temp file - don't use /etc/ssl/x509v3.cnf on the command line when we've just told people to copy and edit - fix an instance of CERTIP that should have been CERTFQDN based on diffs from Sevan Janiyan, feedback/ok jmc@
2019-01-22PF_ROUTE -> AF_ROUTE in the scattered sock()/setsockopt() callsKenneth R Westerback
where the "wrong" #define was used. ok dlg@
2018-09-20add missing braces implied by indentationJonathan Gray
ok millert@ mpi@
2018-04-17Document how to avoid isakmpd(8) source IP address pitfalls by usingStefan Sperling
the Listen-on directive in isakmpd.conf(5). This directive can be necessary in multi-homed situations, and if isakmpd(8) is used with carp(4). ok sthen@ mpi@
2018-01-15Spacing, no object change.Martin Pieuchot
2018-01-04space -> tabMartin Pieuchot
No object change.
2017-12-07Set the correct ENCAPSULATION_MODE when doing NAT-T.Martin Pieuchot
Fix at least interoperability with Cisco when isakmpd(8) is initiating the connections, originally reported by sebastia@ in 2014. Refreshed diff from and ok hshoexer@, ok sthen@, ok remi@
2017-12-05Use clock_gettime(CLOCK_MONOTONIC) to schedule timersJeremie Courreges-Anglas
From Scott Cheloha, ok tb@
2017-11-23in isakmpd(8), provide a hint: from scott chelohaJason McIntyre
also some minor tweaks while here...
2017-11-08In the final RFC 5903 the computation for the DH shared secret changed.Patrick Wildt
Instead of the full point, only the X point is included. The member g_xy is always the shared secret but so far its buffer has been allocated using the size of the public points. Since this is a different size now, as the shared secret for EC Groups should only store the x point, we need another member to specify the length of g_xy. Since this is a backwards incompatible change older isakmpds won't be able to negotiate if you use EC groups. Bump the version of our own vendor tag so peers can try to keep compatibility based on the presen- ted tag. This could be used to implement backwards compatibility to older isakmpds. Prompted by and ok mpi@
2017-10-27Support DH groups 19 to 21 and 25 to 30, just like iked(8) does.Martin Pieuchot
ok visa@, markus@
2017-09-18Check for failures of exchange_establish_p{1,2}() and call the givenMartin Pieuchot
`finalize' function with the `fail' argument when this happen. Introduce some sanity checks in exchange_free() to be able to call if even if the data structure isn't completely initialized. Plug memory leaks when exchange_establish() fails. While here fix a double free in one of the error paths. Based on a diff from hshoexer@, ok stsp@, markus@
2017-08-22Remove listing of fixed bugs.Martin Pieuchot
ok markus@
2017-08-06Prevent a use-after-free by always passing dynamically allocatedMartin Pieuchot
arguments to f_key_v2_connection_check(). The race can be triggered by sending SIGHUP to the daemon. Note that this change do not fix the memory leak if exchange_establish() fails. Reported by Michał Koc. ok hshoexer@, markus@, henning@
2017-07-18Prevent a NULL dereference when comparing incomplete SAs.Martin Pieuchot
This deference can occur because sa_find() is called from a timer and iterates over all existing `sa'. At that time the corresponding `finalize_exchange' might not have been called, in which case it is unsafe to dereference `src_net', `dst_net' & co. Issue reported by Michał Koc. ok hshoexer@, markus@
2017-07-10remove misc. depend and yacc nits that no longer matter.Marc Espie
okay millert@
2017-07-03Generate source and header files for regress on demand.Alexander Bluhm
OK espie@
2017-06-16mark files as BUILDFIRST, or write explicit dependencies, so that mostMarc Espie
programs will build even without a make depend first. okay tb@ millert@
2017-04-02Check return value of asprintf(), and don't use 0 as a char *Tom Cosgrove
Started by, and ok, deraadt@
2017-02-28Depending on the addresses, ipsecctl(8) automatically groups saAlexander Bluhm
bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@
2017-02-03Stop assuming that in_{addr,port}_t are typedefed in <sys/types.h> andPhilip Guenther
instead pull in <netinet/in.h> or <arpa/inet.h> when those are needed. ok florian@ beck@ millert@
2017-01-04Remove modular exponential groups specified in RFC5114Mike Belopuhov
Brought up by doug@, ok reyk, djm, doug
2017-01-01Hyphenate compound adjectives 'up-to-date', 'out-of-date' and 'well-known'Theo Buehler
if they precede the noun and omit hyphens otherwise. ok tj
2016-09-03A commented block starts withTheo de Raadt
# If you have ElectricFence available, you can spot abuses of the heap." Or, uhm you can simply use our malloc.
2016-09-02move links from http to https://www.openbsd.org/Theo Buehler
ok beck
2016-08-26Pull in <sys/select.h> for fd_setPhilip Guenther
ok deraadt@
2016-04-04Fix memory leak. Call proto_free() always to free proto.YASUOKA Masahiko
Diff from Yuuichi Someya. ok reyk markus
2016-04-02Another use for fcntl() and thus of the superfluous 3rd parameterKenneth R Westerback
is when sanitising standard fd's before calling daemon(). Use a tweaked version of the ssh(1) function in all three places found using fcntl() this way. ok jca@ beck@
2016-03-16More "(<blah> *)0" -> NULL, avoiding any stdarg functions.Kenneth R Westerback
Feedback millert@ kettenis@
2016-03-10Don't retransmit responses for unauthenticated messages.YASUOKA Masahiko
Base on diff from Yuuichi Someya ok markus reyk mikeb
2016-03-05fix steps for cert creation;Jason McIntyre
issue reported by igor.kos (temporary) fix entirely provided by sthen
2016-02-29Print ssize_t with %zd; ok deraadt@ mmcc@Jeremie Courreges-Anglas
2016-01-11typo fix; from julian hsiaoJason McIntyre
2016-01-08tweak; from julian hsiaoJason McIntyre
2015-12-10Remove NULL-checks before free(). ok tb@mmcc
2015-12-09Remove plain DES encryption from IPsec.Christian Weisgerber
DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
2015-10-15A classic case for bzero() -> explicit_bzero()mmcc
ok deraadt@
2015-09-25drop useless .Xo and .Bk, and shorten by avoiding some .SmIngo Schwarze
2015-08-20Do not cast a size_t to (unsigned long) to pass it as an argument to malloc.Theo de Raadt
Like really, who does??!
2015-08-20<stdlib.h> is included, so do not need to cast result fromTheo de Raadt
malloc, calloc, realloc* ok krw millert
2015-06-03Do not assume that asprintf() clears the pointer on failure, whichTodd C. Miller
is non-portable. Also add missing asprintf() return value checks. OK deraadt@ guenther@ doug@
2015-04-21No need to do "size = (size_t)sb.st_size" both before and afterJonathan Gray
a fstat() call. ok mikeb@ markus@
2015-04-20Log if we refuse to continue the exchange when another one that correspondsMike Belopuhov
to the same policy is already active. OK markus, hshoexer
2015-04-17Remove unsupported SADB_X_IDENTTYPE_CONNECTION; OK markus, hshoexerMike Belopuhov
2015-04-14Remove support for storing credentials and auth information in the kernel.Mike Belopuhov
This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
2015-03-26Remove bits of unfinished IPsec proxy support. DNS' KX records, anyone?Mike Belopuhov
ok markus, hshoexer
2015-02-15convert bcmp to memcmpTed Unangst
ok doug millert miod
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 05:20:50 +0000