summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2020-10-24Don't modify sa in ikev2_pld_cp. Store cp_type in msg until message hastobhe
passed all checks. ok patrick@
2020-10-22Handle NO_PROPOSAL_CHOSEN for initiator in IKE_SA_INIT exchange.tobhe
This NOTIFY payload is not encryted, remove check. ok patrick@
2020-10-22Add missing break.tobhe
ok patrick@
2020-10-21Remove SAs from ike_dstid_sas on 'ikectl reset sa' to prevent use after free.tobhe
Found by csszep <csszep (at) gmail (dot) com> ok patrick@
2020-10-21ICMP raw sockets start to receive packets as soon as they are createdFlorian Obser
by socket(2). They also receive all ICMP packets on the system, for example from parallel running ping(8)s. After creating the raw socket ping(8) sets various socket options with setsockopt(2) and assumes that they apply to all packets it later processes. For example ping6(8) uses setsockopt(IPV6_RECVHOPLIMIT) to print the IPv6 hop count. Packets received between the socket(2) and setsockopt(2) call however do not have the hoplimit information and ping6(8) prints a wrong and missleading warning. To avoid this we have to drain our socket of packets we received before we were fully setup. Problem reported and testing by martijn Input deraadt OK benno
2020-10-19Handle NO_PROPOSAL_CHOSEN as IKE_AUTH initiator.tobhe
ok markus@
2020-10-14Accommodate a basename(3) that takes a non-const parameter and mayChristian Weisgerber
in fact modify the string buffer. ok kn@ sashan@ cVS: ----------------------------------------------------------------------
2020-10-09More unused headers.tobhe
2020-10-09Remove unused "wait.h" includes.tobhe
2020-10-07Fix display of P2P link to be consistent over all AF.denis
OK kn@, input from claudio@
2020-10-07Reverse previous, needs discussion.denis
2020-10-07Fix display of P2P link to be consistent over all AF.denis
2020-10-06Always allocate hash_keylength() for buffers passed to hash_final() totobhe
make sure there is enough space for the non truncated hash output.
2020-10-05Only handle AUTHENTICATION_FAILED for IKE_AUTH and INFORMATIONAL exchanges.tobhe
Reply to INFORMATIONAL messages with AUTHENTICATION_FAILED before deleting the SA. ok markus@
2020-10-03React to DELETE notifications only in INFORMATIONAL messagestobhe
and move the logic closer to the other INFORMATIONAL payloads. Add some more sanity checks while we're at it. ok patrick@
2020-10-02Send AUTH_FAILED in ikev2_ike_auth_recv() if the message did not containtobhe
an AUTH payload and the policy does not use EAP authentication. ok patrick@
2020-10-02Plug leak of 'str': at the end of the strsep() loop it is NULL, soOtto Moerbeek
freeing it is a no-op. Leak detected by my experimental malloc leak detector. ok florian@
2020-10-01Skip DELETE payload responses only after they are validated.tobhe
ok patrick@
2020-10-01Teach wsconsctl about astfb(4).Mark Kettenis
2020-10-01rdomain IDs do not need to exist for "on rdomain N" to workkn
Unlike "... rtable N", pf.conf(5)'s "on rdomain N" does not alter packet state and will always work no matter if rdomain N currently exists or not, i.e. the rule "pass on rdomain 42" will simply match (and pass) packets if rdomain 42 exists, and it will simply not match (neither pass nor block) packets if 42 does not exist. There's no need to reload the ruleset whenever routing domains are created or deleted, which can already be observed now by creating an rdomain, loading rules referencing it and deleting the same rdomain immediately afterwards: pf will continue to work as expected. Relax both pfctl(8)'s parser check as well as pf(4)'s copyin routine to accept any valid routing domain ID without expecting it to exist at the time of ruleset creation - this lifts the requirement to create rdomains before referencing them in pf.conf while keeping pf behaviour unchanged. Prompted by yasuoka's recent pfctl parse.y r1.702 commit requiring an rtable to exist upon ruleset creation. Discussed with claudio and bluhm at k2k20. Feedback sashan OK sashan yasouka claudio
2020-10-01Only count the proper node types. Avoid out of-bound access for largeOtto Moerbeek
filesystems. From FreeBSD. ok millert@
2020-09-30Don't accept AUTH payloads with invalid auth_method 0.tobhe
Fixes duplicate AUTH payload detection. ok patrick@
2020-09-30Don't accept ID payloads with ID type IKEV2_ID_NONE.tobhe
0 is not a valid type and triggers undesired edge cases. ok patrick@
2020-09-30Don't leak sa->sa_peerauth.id_buf.tobhe
ok patrick@
2020-09-29Check ibuf_seek() return value.tobhe
ok patrick@
2020-09-28Revert a wording change that was made in revision 1.05solene
which was reverting a change made into 1.03 bioctl -d is "detaching" and not "deleting" a volume
2020-09-26Cleanup msg_eap in ikev2_msg_cleanup().tobhe
2020-09-25Simplify RB_TREE cleanup loops.tobhe
ok markus@
2020-09-24Cleanup logging, print SPIs where it makes sense.tobhe
2020-09-23Add new 'set cert_partial_chain' config option to allow verification oftobhe
partial certificate chains if a trusted intermediate CA is found in /etc/iked/ca/. ok patrick@
2020-09-21Fix reassembly of out-of-order fragments. Always take the nextpld fieldtobhe
from the IKE header of fragment #1, not the first received fragment. ok patrick@
2020-09-21Missing space for '-i interval' option error message.Marcus Glocker
From <piotr (at) durlej (dot) net>. Thanks!
2020-09-19Add SHA2_384 and SHA2_512 to default proposals.tobhe
ok patrick@
2020-09-18Fix memory leak in 'n->name'.tobhe
2020-09-17With the multi rdomain support, slaacd now sees all icmpv6 packets andSebastien Marie
filters in userland. But the packet type check was placed at the wrong place so the hoplimit check was done against every icmpv6 packet but no all of them have a hoplimit constraint. tested and ok by me, committed on behalf of florian@
2020-09-17Fix the previous commit whose conditions were reversed.YASUOKA Masahiko
ok kn
2020-09-17Set retransmit timeout for DELETE message on the replaced SA, not ontobhe
the replacement. ok markus@
2020-09-17Do not send DELETE messages for closing SAs.tobhe
ok markus@
2020-09-17Make pfctl(8) check if the rtable really exists when parsing theYASUOKA Masahiko
config. work with and diff from kn ok kn
2020-09-17Merge IKEV2_EXCHANGE_CREATE_CHILD_SA and IKEV2_EXCHANGE_INFORMATIONALtobhe
cases.
2020-09-16Move all the EAP logic from a single branch in the message parsing code totobhe
somewhere past successful message verification, closer to where the other exchanges are handled. EAP is stll special, but this fits a lot better into the overall architecture. Tested with iOS, Stronswan and Windows ok patrick@ sthen@
2020-09-16Fix EAP authentication if the initiator sends no certificatetobhe
request. The locally configured request is used as fallback to find a certificate or key to send. The local auth method for MSCHAP-V2 should be IKEV2_AUTH_SIG_ANY, which defaults to X509 certificates, instead of raw rsa keys. Tested with Strongswan, iPhone and Windows Found by and ok sthen@ ok patrick@
2020-09-15"Route show" and "netstat -r" provide formatting for routing tables withpamela
sufficient space to display v4 addresses cleanly, but which truncate v6 addresses. The -n flag on each already provides additional column width for IPv6 addresses. Make this formatting the default. OK phessler kn
2020-09-15umb(4) shows the speed of the LTE connection but misses the b in Mbps.Claudio Jeker
OK kettenis@
2020-09-14We might race against removal of an rdomain we just want to handle.Florian Obser
Make setsockopt non-fatal in this case and just ignore the request. Spotted in a diff by reyk for rad(8); discussed with claudio
2020-09-14Let slaacd handle all rdomains in a single daemon.Florian Obser
Suggested by claudio and matthieu Testing matthieu Putting it in now to get enough testing before release so that there is enough time to back it out, suggested by deraadt
2020-09-12When an interface disapears we need to forget the learned autoconfFlorian Obser
resolvers. OK kn
2020-09-09Delete dead code.tobhe
2020-09-08Fix auth method negotiation for IKEV2_CERT_X509_CERT. If a cert matchingtobhe
the CERTREQ is found, don't wait for more requests. Correctly set type if cert was found as fallback. ok patrick@
2020-09-06Drop redundant else for readability.tobhe
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 19:56:24 +0000