summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2020-09-12When an interface disapears we need to forget the learned autoconfFlorian Obser
resolvers. OK kn
2020-09-09Delete dead code.tobhe
2020-09-08Fix auth method negotiation for IKEV2_CERT_X509_CERT. If a cert matchingtobhe
the CERTREQ is found, don't wait for more requests. Correctly set type if cert was found as fallback. ok patrick@
2020-09-06Drop redundant else for readability.tobhe
2020-09-05Use peer from policy, not from the acquire message.tobhe
2020-09-05Initialize flow_dir and flow_saproto so policy_test() can find the policytobhe
on acquire.
2020-09-04INFORMATIONAL and CREATE_CHILD_SA exchanges cannot be initiated at thetobhe
same time.
2020-09-03Log OCSP url on connection failure.tobhe
2020-09-02Add 30s timeout for OCSP requests.tobhe
ok patrick@
2020-09-01Log SPIs to make it easier to map OCSP messages to SAs.tobhe
2020-09-01Make OCSP response status logging less verbose.tobhe
2020-08-31Do not register a read/write callback on fd -1 (e.g. if connection failed).tobhe
2020-08-31Both ocsp_req_ctx and ocsp_req must be freed. Don't free ocsp_id as ittobhe
is owned by ocsp_req and is cleaned up automatically.
2020-08-31Use SA header (SPIs) to map OCSP connect requests to their respectivetobhe
responses. This fixes concurrent OCSP requests for different IKE SAs. From Hans-Joerg Hoexer ok patrick@
2020-08-29Use SO_REUSEADDR on the listening socketsJeremie Courreges-Anglas
Lets unwind(8) run when another name server listens on the wildcard address. Conflict with unbound(8) spotted by sthen@, ok florian@ deraadt@
2020-08-29Missing prototype for a currently unused function.Florian Obser
Reported upstream.
2020-08-29sync to libunbound-1.11.0Florian Obser
all heavy lifting done by sthen in unbound testing benno
2020-08-28Rename ikev2_*_sa() functions to make clear they handle Child SAs.tobhe
ok patrick@
2020-08-27Make sure to save certificate in the CERTINVALID case to fixtobhe
ikev2_log_cert_info(). ok patrick@
2020-08-26Allow disabling DPD liveness checks by setting dpd_check_interval to 0.tobhe
ok patrick@
2020-08-25Fix undefined symbol.tobhe
2020-08-25Add dpd_check_interval configuration option. If for any IKE SA no IPsectobhe
or IKE message has been received within the specified time interval, iked will start sending DPD messages. ok patrick@
2020-08-24Reduce the amount of boilerplate code and imsgs for config options bytobhe
grouping fixed-size values in 'struct iked_static' which is sent in a single message. ok patrick@
2020-08-24some tweaks to the "group" text, from evan silberman;Jason McIntyre
i replaced the suggested Cm/Ql mix with simple Dq;
2020-08-24Omit common ifconfig optionskn
ifconfig(8)'s TRUNK (LINK AGGREGATION) nicely combines the two drivers, so omit common stuff from the drives specific manuals. This aids in the overall design of having options documented in ifconfig(8) alone unless they're inherently driver specific, e.g. "trunkproto" which stays in trunk(4). OK jmc
2020-08-23Add a new configuration option to limit the number of connections fortobhe
each peer (identified by their 'dstid'). When 'set enforcesingleikesa' is enabled, each peer can only have one active IKE SA at a time. On successful authentication of a new connection, the old IKE SA is automatically deleted. ok patrick@
2020-08-23Rename natt_mode to sc_nattmode for consistency.tobhe
2020-08-22Prevent concurrent CREATE_CHILD_SA and INFORMATIONAL exchanges.tobhe
Make sure not to initiate new exchanges while waiting for an INFORMATIONAL response. ok markus@
2020-08-21Use trusted CA from /etc/iked/ca/ as OCSP issuer to get rid oftobhe
/etc/iked/ocsp/issuer.crt. Try to get the OCSP url from the CA/issuer certificate, otherwise use the URL configured in 'set ocsp' in iked.conf. ok patrick@
2020-08-20Remove redundant variable.tobhe
2020-08-19Restructure traffic selector payload parsing. Add additional size andtobhe
sanity checks. Feedback and ok patrick@
2020-08-19When sending a router solicitation use the link-layer (mac) address ofFlorian Obser
the outgoing interface in the source link-layer address ICMPv6 option instead of the address of the last configured autoconf interface. It is not the most efficient way to first transform an if_index into and interface name and then iterate over all addresses but this is also not in the hot path. Under normal operations slaacd will send one solicitation when an interface is set to autoconf and then never again because it will see unsolicitated router advertisements before addresses expire. OK kn
2020-08-18Add optional time-stamp validaten for ocsp. The new optional 'tolerate'tobhe
parameter specifies how many seconds leeway are allowed in the check. The optional maxage parameter indicates the allowed maximum age of the `thisUpdate' OCSP attribute value. ok patrick@
2020-08-17Fix possible leak of ocsp_id.tobhe
ok patrick@
2020-08-16Clean up unused parameters.tobhe
2020-08-15Remove dead assignments.tobhe
2020-08-14Clean up unused variables.tobhe
2020-08-14Delete unused variable 'policy'.tobhe
2020-08-14Print local 'sa' variable instead of 'msg->msg_sa'.tobhe
2020-08-14Delete unused variable 'idtype'.tobhe
2020-08-14Delete unused variable 'certid'.tobhe
2020-08-13Properly set flow_saproto for aquire.tobhe
ok patrick@
2020-08-12style(9).tobhe
2020-08-11Prioritize incoming certificate requests by the order of CERTEQ payloadstobhe
in the received message. ok patrick@
2020-08-10Reduce log spam.tobhe
2020-08-10Remove unused argument.tobhe
ok patrick@
2020-08-08Replace strto*l(3) with strtonum(3)kn
Some bridge options allow values bigger than the corresponding datatype and thus pass overflowed values to the kernel, not all options to range checks and setting invalid "portno" complains about "portidx" values. Use the same, simpler strtonum() idiom across all options with consistent error messages and proper [U]INT*_MAX defines as max values to match the datatype and all option handlers to be consistent (in less code). Keep deferring option dependent min/max value checking to the ioctl(2) interface, i.e. values documented in ifconfig(8) are not duplicated in strtonum() calls. OK millert
2020-08-08add some vertical whitespace;Jason McIntyre
2020-08-06Delete commented out code.tobhe
2020-08-06Avoid reading one byte before the path buffer.Christian Weisgerber
This happens when there's only one component (e.g. "/foo"). This bug has been present since June 1990 when it was commited to mountd.c SCCS version 5.9. Note: the bug is on the second changed line, the first line is changed for visual consistency. From CheriBSD via FreeBSD ok millert@ deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 17:38:21 +0000