summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2020-09-19Add SHA2_384 and SHA2_512 to default proposals.tobhe
ok patrick@
2020-09-18Fix memory leak in 'n->name'.tobhe
2020-09-17With the multi rdomain support, slaacd now sees all icmpv6 packets andSebastien Marie
filters in userland. But the packet type check was placed at the wrong place so the hoplimit check was done against every icmpv6 packet but no all of them have a hoplimit constraint. tested and ok by me, committed on behalf of florian@
2020-09-17Fix the previous commit whose conditions were reversed.YASUOKA Masahiko
ok kn
2020-09-17Set retransmit timeout for DELETE message on the replaced SA, not ontobhe
the replacement. ok markus@
2020-09-17Do not send DELETE messages for closing SAs.tobhe
ok markus@
2020-09-17Make pfctl(8) check if the rtable really exists when parsing theYASUOKA Masahiko
config. work with and diff from kn ok kn
2020-09-17Merge IKEV2_EXCHANGE_CREATE_CHILD_SA and IKEV2_EXCHANGE_INFORMATIONALtobhe
cases.
2020-09-16Move all the EAP logic from a single branch in the message parsing code totobhe
somewhere past successful message verification, closer to where the other exchanges are handled. EAP is stll special, but this fits a lot better into the overall architecture. Tested with iOS, Stronswan and Windows ok patrick@ sthen@
2020-09-16Fix EAP authentication if the initiator sends no certificatetobhe
request. The locally configured request is used as fallback to find a certificate or key to send. The local auth method for MSCHAP-V2 should be IKEV2_AUTH_SIG_ANY, which defaults to X509 certificates, instead of raw rsa keys. Tested with Strongswan, iPhone and Windows Found by and ok sthen@ ok patrick@
2020-09-15"Route show" and "netstat -r" provide formatting for routing tables withpamela
sufficient space to display v4 addresses cleanly, but which truncate v6 addresses. The -n flag on each already provides additional column width for IPv6 addresses. Make this formatting the default. OK phessler kn
2020-09-15umb(4) shows the speed of the LTE connection but misses the b in Mbps.Claudio Jeker
OK kettenis@
2020-09-14We might race against removal of an rdomain we just want to handle.Florian Obser
Make setsockopt non-fatal in this case and just ignore the request. Spotted in a diff by reyk for rad(8); discussed with claudio
2020-09-14Let slaacd handle all rdomains in a single daemon.Florian Obser
Suggested by claudio and matthieu Testing matthieu Putting it in now to get enough testing before release so that there is enough time to back it out, suggested by deraadt
2020-09-12When an interface disapears we need to forget the learned autoconfFlorian Obser
resolvers. OK kn
2020-09-09Delete dead code.tobhe
2020-09-08Fix auth method negotiation for IKEV2_CERT_X509_CERT. If a cert matchingtobhe
the CERTREQ is found, don't wait for more requests. Correctly set type if cert was found as fallback. ok patrick@
2020-09-06Drop redundant else for readability.tobhe
2020-09-05Use peer from policy, not from the acquire message.tobhe
2020-09-05Initialize flow_dir and flow_saproto so policy_test() can find the policytobhe
on acquire.
2020-09-04INFORMATIONAL and CREATE_CHILD_SA exchanges cannot be initiated at thetobhe
same time.
2020-09-03Log OCSP url on connection failure.tobhe
2020-09-02Add 30s timeout for OCSP requests.tobhe
ok patrick@
2020-09-01Log SPIs to make it easier to map OCSP messages to SAs.tobhe
2020-09-01Make OCSP response status logging less verbose.tobhe
2020-08-31Do not register a read/write callback on fd -1 (e.g. if connection failed).tobhe
2020-08-31Both ocsp_req_ctx and ocsp_req must be freed. Don't free ocsp_id as ittobhe
is owned by ocsp_req and is cleaned up automatically.
2020-08-31Use SA header (SPIs) to map OCSP connect requests to their respectivetobhe
responses. This fixes concurrent OCSP requests for different IKE SAs. From Hans-Joerg Hoexer ok patrick@
2020-08-29Use SO_REUSEADDR on the listening socketsJeremie Courreges-Anglas
Lets unwind(8) run when another name server listens on the wildcard address. Conflict with unbound(8) spotted by sthen@, ok florian@ deraadt@
2020-08-29Missing prototype for a currently unused function.Florian Obser
Reported upstream.
2020-08-29sync to libunbound-1.11.0Florian Obser
all heavy lifting done by sthen in unbound testing benno
2020-08-28Rename ikev2_*_sa() functions to make clear they handle Child SAs.tobhe
ok patrick@
2020-08-27Make sure to save certificate in the CERTINVALID case to fixtobhe
ikev2_log_cert_info(). ok patrick@
2020-08-26Allow disabling DPD liveness checks by setting dpd_check_interval to 0.tobhe
ok patrick@
2020-08-25Fix undefined symbol.tobhe
2020-08-25Add dpd_check_interval configuration option. If for any IKE SA no IPsectobhe
or IKE message has been received within the specified time interval, iked will start sending DPD messages. ok patrick@
2020-08-24Reduce the amount of boilerplate code and imsgs for config options bytobhe
grouping fixed-size values in 'struct iked_static' which is sent in a single message. ok patrick@
2020-08-24some tweaks to the "group" text, from evan silberman;Jason McIntyre
i replaced the suggested Cm/Ql mix with simple Dq;
2020-08-24Omit common ifconfig optionskn
ifconfig(8)'s TRUNK (LINK AGGREGATION) nicely combines the two drivers, so omit common stuff from the drives specific manuals. This aids in the overall design of having options documented in ifconfig(8) alone unless they're inherently driver specific, e.g. "trunkproto" which stays in trunk(4). OK jmc
2020-08-23Add a new configuration option to limit the number of connections fortobhe
each peer (identified by their 'dstid'). When 'set enforcesingleikesa' is enabled, each peer can only have one active IKE SA at a time. On successful authentication of a new connection, the old IKE SA is automatically deleted. ok patrick@
2020-08-23Rename natt_mode to sc_nattmode for consistency.tobhe
2020-08-22Prevent concurrent CREATE_CHILD_SA and INFORMATIONAL exchanges.tobhe
Make sure not to initiate new exchanges while waiting for an INFORMATIONAL response. ok markus@
2020-08-21Use trusted CA from /etc/iked/ca/ as OCSP issuer to get rid oftobhe
/etc/iked/ocsp/issuer.crt. Try to get the OCSP url from the CA/issuer certificate, otherwise use the URL configured in 'set ocsp' in iked.conf. ok patrick@
2020-08-20Remove redundant variable.tobhe
2020-08-19Restructure traffic selector payload parsing. Add additional size andtobhe
sanity checks. Feedback and ok patrick@
2020-08-19When sending a router solicitation use the link-layer (mac) address ofFlorian Obser
the outgoing interface in the source link-layer address ICMPv6 option instead of the address of the last configured autoconf interface. It is not the most efficient way to first transform an if_index into and interface name and then iterate over all addresses but this is also not in the hot path. Under normal operations slaacd will send one solicitation when an interface is set to autoconf and then never again because it will see unsolicitated router advertisements before addresses expire. OK kn
2020-08-18Add optional time-stamp validaten for ocsp. The new optional 'tolerate'tobhe
parameter specifies how many seconds leeway are allowed in the check. The optional maxage parameter indicates the allowed maximum age of the `thisUpdate' OCSP attribute value. ok patrick@
2020-08-17Fix possible leak of ocsp_id.tobhe
ok patrick@
2020-08-16Clean up unused parameters.tobhe
2020-08-15Remove dead assignments.tobhe
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-15 21:27:20 +0000