summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2020-11-23Ignore duplicate sigsha2 notify, don't fail the exchange.tobhe
2020-11-22Fix comment typo.tobhe
2020-11-21No need to update ifi->state just before setting quit to TERMINATE.Kenneth R Westerback
Check quit != TERMINATE before trying to open leases file.
2020-11-21Clean up NATT hack. Pass 'frompeer' as parameter instead of manipulatingtobhe
msg header to get the correct addresses and spis. ok patrick@
2020-11-21No need to update resolv.conf when renewing a lease does not result in anyKenneth R Westerback
configuration changges.
2020-11-21When REBOOT'ing it is necessary to apply_defaults() to the recordedKenneth R Westerback
lease and use the updated values to initialize ifi->expiry and ifi->rebinding. Fixes odd behaviour, bouncing the link in particular, when using dhclient.conf to change the lease renew/rebind/expiry timing. e.g. when debugging wifi interface behaviour.
2020-11-20The default lease rebind time is 7 * (expiry/8), not 8 * (expiry/7).Kenneth R Westerback
2020-11-20add -s to synopsis and usage; -S before -s in options list;Jason McIntyre
2020-11-20Add -s socket option to specify control socket. This can be useful iftobhe
multiple iked instances running in different rdomains are used. ok patrick@
2020-11-19Avoid spurious resolv.conf updates whenKenneth R Westerback
1) The RTM_PROPOSAL telling unwind(8) about DNS servers is seen. 2) The interface is in the process of getting a new or renewed lease. 3) The default route is not UP. Edge cases discovered while debugging urtwn(4) link bouncing.
2020-11-19More sa cleanup + constify.tobhe
ok patrick@
2020-11-18Constify sa in ikev2_pld_eap(). The parser code must not change anytobhe
sa or policy state, this should help make it clearer. ok patrick@
2020-11-18Recognize get_link_ifa() failure (a.k.a. "invalid interface") as a fatal errorKenneth R Westerback
in interface_state() as it is elsewhere. Avoids any possible NULL pointer dereference.
2020-11-18No need to call get_hw_address() from interface_state() since theKenneth R Westerback
appropriate ifa is already known and ifi->rdomain does not need to be updated because a change of rdomain causes a link bounce and thus reinitialization of ifi. One less invocation of getifaddrs() during route message processing.
2020-11-18Tweak debug messages around resolv.conf updating.Kenneth R Westerback
Take more care to only update resolv.conf when a default route can be found with which to determine the responsible interface.
2020-11-17Remove redundant indirection via msg_parent. This is only needed intobhe
ikev2_pld_parse().
2020-11-17Fix comment sysctl(3) -> sysctl(2).Marcus Glocker
2020-11-16Reenable ikev2_init_auth() return value check. Make sure sa_stateok()tobhe
returns 0 on error. This code path is taken multiple times until all requirements for sa_stateok() are met, so don't delete the SA because of a single failure. ok patrick@
2020-11-16Backout ikev2_init_auth() return check to fix regression withtobhe
certificate authentication. Reported by Mark Patruck <mark (at) wrapped (dot) cx>
2020-11-15Document new 'dynamic' keyword to create flows from or to a dynamicallytobhe
assigned address.
2020-11-14Constify dktypenames and fstypenames in libc.Philip Guenther
Adjust variable declaration in disklabel to match. ok millert@ deraadt@
2020-11-14Make sure not to replace 0.0.0.0 with dynamic address if it is a a networktobhe
address (addr_net is set).
2020-11-13addr_net is already checked in ikev2_cp_setaddr() before sessingtobhe
sa_addrpool, so we don't need to re-check here. ok patrick@
2020-11-12Close SA if ikev2_init_auth() fails.tobhe
ok markus@
2020-11-12Fail if ikev2_init_ike_auth() is entered with invalid state.tobhe
2020-11-11Cleanup after proc_init() in proc_close().tobhe
2020-11-09Use RB_FOREACH_SAFE instead of handrolling itTheo Buehler
No binary change on amd64. ok florian
2020-11-09Check for and handle duplicates on RB_INSERTTheo Buehler
If the configuration contains duplicate domains in the block list file or a force list, the nodes would leak in the frontend process each time the config is reloaded. Also add a check when copying the force list over imsg and fatal if a duplicate is encountered. This should never happen. ok florian
2020-11-09Don't leak domain when freeing block list nodesTheo Buehler
Domains contained in the block list file were not correctly freed. This would grow the frontend process by the size of the blocklist file on each config reload. ok florian
2020-11-07Implement 'from dynamic', which installs flows where 'dynamic' is replacedtobhe
with the received dynamic IP addresse. ok patrick@
2020-11-07Rework source IP address setting.denis
- Move most of the processing out of rtable.c (reasonnable tb@, ok bluhm@) - Remove memory allocation, store pointer to existing ifaddr - Fix tunnel interface handling looks fine mpi@
2020-11-06Remove the -L option. A debugging tool that is no longer required.Kenneth R Westerback
man page and usage() tweaks from jmc@. ok lteo@
2020-11-06Keep track of allowed ips pointer correctlykn
Someone reported wg(4) not working on macppc; fix ifconfig(8)'s "wgaip" to interate over data structures in the same way as the kernel does. Analysis and fiff from Jason A. Donenfeld Tested on macppc, sparc64 and amd64 by me
2020-11-06Add some debug output showing the exact network configurationKenneth R Westerback
changes that will be attempted after accepting a lease. Verbiage enhancement suggested by jmc@.
2020-11-06Set correct netmask on patched addresses for debug printing.tobhe
2020-11-05Enable support for ASN1_DN ipsec identifiers.Peter Hessler
Tested with multiple Window 10 Pro (ver 2004) clients, and OpenBSD+iked as the server. OK tobhe@ sthen@ kn@
2020-11-05Handle DNS answers that are larger than the maximum imsg size (aboutFlorian Obser
16k) by splitting them up. Previously unwind would send meta-data about the finished query from the resolver process to the frontend process and then silently fail to send the actual answer because it was too big for imsg. When receiving the meta-data for the next query the frontend process would then exit via fatal() because it was still expecting an answer. This likely fixes rare crashes observed by Leo Unglaub. Note that even with DNSSEC signatures, answers this big are very rare. OK tb, benno
2020-11-04Add check for static id size.tobhe
ok patrick@
2020-11-03Add 'any' keyword for request to allow 'request address any'.tobhe
2020-11-01Add 'dynamic' keyword to configure flows to dynamically assigned addresses.tobhe
The keyword is replaced at runtime with the address assigned from the pool in 'config address'. ok patrick@
2020-10-30Add missing bits to make 'request addr 0.0.0.0' accept ANY dynamic address.tobhe
2020-10-30style(9)tobhe
2020-10-30Track creation time of address proposals to be able to establish totalFlorian Obser
lifetime. Use this information to renew pltime / vltime of privacy addresses for up to 1 day / 2 days as RFC 4941. This is important when announced pltime / vltime is lower than 1 day / 2 days, privacy addresses would have expired too fast. Spotted after a remark by Fernando Gont on misc@
2020-10-30If Duplicate Address Detection (DAD) fails only generate a new addressFlorian Obser
if we are using Semantically Opaque Interface Identifiers (soii) otherwise we would just create the same address again and DAD will fail again.
2020-10-30Follow RFC 4941 and calculate the desync_factor at startup.Florian Obser
There is probably nothing wrong with calculating a new random value everytime we create an address, but we are also not gaining anything. Makes math in upcomming diffs easier.
2020-10-30Since the RFC 4941 constants are no longer in a public headerFlorian Obser
(netinet6/nd6.h) we can remove the ND6 prefix. While here use a MAX_DESYNC_FACTOR of 10 minutes as the RFC specifies. We are using arc4random_uniform which avoids modulo bias.
2020-10-30Pull check for duplicate address up to skip them early, we are notFlorian Obser
going to renew them. Avoids redundant check for privacy addresses.
2020-10-30update_iface_ra does too much, move prefix handling into function.Florian Obser
2020-10-30update_iface_ra does too much, move dfr handling into function.Florian Obser
2020-10-30update_iface_ra does too much, move rdns handling into function.Florian Obser
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-14 06:06:38 +0000