summaryrefslogtreecommitdiff
path: root/sbin/isakmpd
AgeCommit message (Collapse)Author
2014-03-11For CA generation, go back to using a two-step procedure to create a CSR andStuart Henderson
then self-sign it rather than using the "openssl req" shortcut. This allows us to specify -extfile and thus set the correct certificate extensions so that stricter SSL implementations will trust this as a CA cert, and matches how things are done in ssl(8). This is basically a partial revert of r1.77. Researched by chrisz@, tweak/ok jmc@ ok beck@
2014-03-07If allocation of 'id' fails, don't try to deref it after 'goto fail'.Gerhard Roth
ok millert@
2014-01-23Remove a mid-layer which acts like arc4random isn't fairly standard.Theo de Raadt
ok mikeb
2014-01-22regrand can die, from millertTheo de Raadt
2014-01-22improve randomization. remove some junk debugging features that areTheo de Raadt
fundamentally broken. ok jsing mikeb
2013-11-22Whole bunch of (unsigned char) casts carefully added for ctype calls.Theo de Raadt
Careful second audit by millert
2013-11-21Keep the flow until last IPsec SA is deleted, if the flow is shared byYASUOKA Masahiko
multiple IPsec SAs in NAT-T case. This fixes a problem that L2TP/IPsec connections are disconnected improper in case multiple Windows clients are connected from behind one NAT. ok markus
2013-11-14fix parameter types for x509 routinesTheo de Raadt
ok mikeb
2013-11-14Add STANDARDS section to isakmpd(8).Anthony J. Bentley
tweaks/ok jmc@
2013-10-27If a constant string needs a name, use a static const array instead of aPhilip Guenther
pointer or non-const array, as that minimizes the symbols, maximizes the placement into read-only memory, and avoids warnings from gcc -Wformat=2 when they're used as format strings. ok deraadt@
2013-09-26Removed a break of a switch-case, which had not been removed in the last commit.Patrick Wildt
No functional change.
2013-07-14"r" logs to syslog; From: Anders BerggrenJason McIntyre
ok millert sthen
2013-04-24remove old backwards random junkTheo de Raadt
ok mikeb
2013-04-16remove casts to time_t * which are not neededTheo de Raadt
2013-04-02Stop assuming time_t is longPhilip Guenther
ok deraadt@
2013-03-21remove excessive includesTheo de Raadt
2012-12-21remove makefile hacks that are no longer needed with t1 t2: working properlyMarc Espie
okay krw@
2012-10-29backout possible infinit-loop (from rev 1.5) when parsing nat_d;Markus Friedl
report from Thomas Proell/Siemens ProductCERT; fix from hshoexer; ok mikeb
2012-09-25lost preposition "in"Otto Moerbeek
2012-08-24ikev2 is described in rfc 5996 now;Jason McIntyre
2012-08-12Use .Lk for HTTP hyperlinks, not .Pa.Ingo Schwarze
Most of the patch from Arto Jonsson <ajonsson at kapsi dot fi>. jmc@ agrees in principle that .Lk is the right macro to use. While here, update a few broken links, and add missing markup at a few places.
2012-07-13Support additional MODP DH groups in the Phase 1 and Phase 2.Mike Belopuhov
lteo@ noticed that ipsecctl allowed them within the ike rules while isakmpd failed to load the generated configuration. The fix was verified by hshoexer, ok naddy
2012-06-30enable use of AES-{192,256}-CTR, and explicitly of AES-128-CTR, for IPsec ESPChristian Weisgerber
ok mikeb@
2012-06-04Rounding up a number of bytes in a bignum returned by the BN_num_bytes()Mike Belopuhov
has implications when dealing with leading zeroes. Prevent an incorrect conversion of the EC point to the binary representation by inferring the X and Y components' lengths from the EC group length and zeroing out the appropriate chunks of the target buffer. From hshoexer@
2012-03-24set the vendor string to OpenBSD-5.2; ok mikeb@Markus Friedl
2012-01-16import (and fix) net_addrcmp() from libc as a static function.Eric Faurot
It is going to get removed from libc and this file is the only one using it. discussed with deraadt@ guenther@ ok deraadt@
2011-12-12Allow using FQDN as a ID payload type. Some client (eg Windows XP)YASUOKA Masahiko
uses the FQDN type in NAT-T with transport mode. ok markus
2011-10-20For NAT-T with transport mode, use the ISAKMP's SA addresses for theYASUOKA Masahiko
flow instead of the ID payload. This will fix a part of problems of L2TP/IPsec from NAT'd clients. ok markus@ tested by markus@ and myself.
2011-09-29ssl.8: Certifying Authority -> Certificate AuthorityJason McIntyre
isakmpd.8: rsa:1024 -> rsa:2048 (ok markus) all: X509 -> X.509 from Lawrence Teo
2011-08-02add refcounting for "Configuration" section for acquire-mode SAsMarkus Friedl
ok mikeb@
2011-06-23Use a common text explaining how the various configuration parsers usingStuart Henderson
the standard OpenBSD-style parse.y handle continuing lines with backslashes, paying particular attention to how comments are handled (which can cause nasty side-effects if you're not expecting it). Most wording from jmc@, with suggestions from fgsch@, marc@, Richard Toohey, patrick keshishian and Florian Obser, ok jmc@.
2011-06-15When BN_bn2bin converts a bignum to the binary representationMike Belopuhov
it skips leading zeroes if there are any. To accommodate the difference with the protocol we need to prepend those zeroes ourselves. Fixes PR 6601, tested by Pawel Wieleba, sthen, otto. Huge thanks to Pawel for spending nearly a week testing diffs. ok sthen
2011-06-06some improvements for the text on packet capture; from Lawrence TeoJason McIntyre
ok sthen
2011-05-13wrong id for UDP_ENCAP_TRANSPORT_DRAFT; ok mikeb@Markus Friedl
2011-04-23Indicate which side of the connection responded during phase 1 while using -v.lum
ok sthen@ markus@
2011-04-16Allow -v (verbose logging) to work if a -D option is supplied.Stuart Henderson
Previously, a specific check was made for any -D log option being used and, if so, *no* -v log entries are made, losing potentially useful log entries. ok lum@
2011-04-06Avoid using NULL in non-pointer contexts: use 0 for integer values and '\0'Miod Vallat
for chars.
2011-02-03When binding to addresses, ignore any IP address not in the currentPeter Hessler
routing domain. While here, update comment on what the ioctl is used for (from sthen@). OK mikeb@, sthen@
2010-12-09When looking up an SA based on peer address, also check the portMartin Hedenfal
number. Without this, isakmpd deletes SAs from the same IP on an INITIAL-CONTACT message, possibly deleting unrelated NATed tunnels. Fixes PR 5562. Verified by Mikolaj Kucharski. ok mikeb@
2010-11-29make key exchange faster by not checking the predefined groups with DH_check()Markus Friedl
ok mikeb@, djm@
2010-10-19convert to fuse cast from the libcrypto. with a simplification nit fromMike Belopuhov
blambert, ok jsg, "seems ok" todd
2010-10-18as determined 4 years ago, FortiGate needs DOI of 0 responses to DPDTodd T. Fries
so, copy a small bit of logic to make DPD interop with FortiGate function tested by me, ok mikeb@, silence from 'the usual suspects'
2010-10-15Switch the remaining users of libdes in src to libcrypto,Jonathan Gray
telnet portion partially from the latest heimdal. ok mikeb@
2010-09-22Support for use of AES-GCM-16 (as AESGCM) and ENCR_NULL_AUTH_AES_GMACMike Belopuhov
(as AESGMAC) ciphers in the ISAKMP Phase 2 (aka Quick Mode). Thoroughly tested by me and naddy. Works fine with Linux. Requires updated pfkeyv2.h include file. ok naddy
2010-08-04fixup keylength for aes-128-cbc in quickmodeTheo de Raadt
from mikeb
2010-06-29Replace the hand-crafted Diffie-Hellman implementation in isakmpd withReyk Floeter
the smaller implementation from iked that is using libcrypto instead. This allows to remove a lot of code (which is always good), get rid of some custom crypto code by using libcrypto, theoretically adds support for many new MODP and EC2N/ECP modes (but it is not configurable yet), and allows to share the dh.c/dh.h code in different codebases (it is identical in isakmpd and iked, but could also be used elsewhere). ok deraadt@
2010-06-07make clearer the relationship between isakmpd and ikev1; and iked and ikev2;Jason McIntyre
ok reyk
2010-06-03update the manpages for isakmpd(8) and ipsec.conf(5) to point to iked(8)Reyk Floeter
for IKEv2 and to clarify that a) isakmpd is IKEv1/ISAKMP only and b) iked(8) is IKEv2 only. ISAKMP/IKEv1 support is currently not supported by iked(8) and not worked on, but maybe in the future - I want to get IKEv2 support first done right. So keep on using isakmpd(8) for IKEv1 for now... ok deraadt@
2010-05-10Various comment typos. 'wether' -> 'whether' (most popular), 'possiblity' ->Kenneth R Westerback
'possibility', 'optins' -> 'options', 'resposne' -> 'response', 'unecessary' -> 'unnecessary', 'desination' -> 'destination'. Collected from various misc@ and tech@ postings, many by Brad Tilley.
2010-04-15Log when isakmpd starts - patch from Toni Muellerlum
ok ho@ mpf@ krw@ sthen@ kjell@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 19:55:31 +0000