summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2017-04-16Different compilers and versions of compilers have different warnings.Jonathan Gray
Remove -Werror to give code a greater chance of building. ok deraadt@ florian@
2017-04-14Up to now ipsecctl(8) grouped SAs with identical src and dst to theAlexander Bluhm
flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@
2017-04-13fix wrongly indented linesJonathan Gray
2017-04-13Add a NAT-T keepalive timer in case we are behind a NAT gateway.Patrick Wildt
See RFC 5996, section 2.23, NAT Traversal: In the case of a mismatching NAT_DETECTION_DESTINATION_IP hash, it means that the system receiving the NAT_DETECTION_DESTINATION_IP payload is behind a NAT and that system SHOULD start sending keepalive packets as defined in [UDPENCAPS]. With markus@, ok reyk@
2017-04-12Prevent inosused from wrapping when soft updates is enabled whileTodd C. Miller
scanning the used inode map. The code as written assumes inosused is signed but this is no longer the case. OK deraadt@
2017-04-12RTM_PROTO3 messages should not trigger a resolv.conf check.Kenneth R Westerback
2017-04-12Shuffle another function.Kenneth R Westerback
2017-04-11Shuffle route/interface changing functions together into kroute.c. Try toKenneth R Westerback
group related functions in kroute.c together and comment them a bit. No intentional functional change.
2017-04-11Fold priv_write_file() into its only remaining userKenneth R Westerback
priv_write_resolv_conf() and move the latter into kroute.c with all its priv_ friends. No intentional functional change.
2017-04-10Rework -L logic to use the idiom used in handling the leases file.Kenneth R Westerback
i.e. open FILE during program set up and use the FILE created for the rest of the program lifetime after dropping privilege and pledge()'ing. No need for passing messages to the priv process. Tweak lease file handling a bit in passing. Monitoring the -L file with external programs like sysutils/entr still works. Looks good to sthen@.
2017-04-10Found another len += snprintf...Theo de Raadt
ok mikeb
2017-04-10Remove always false comparison: inosused type is ino_t, which isFrederic Cambus
unsigned. While there, fix a whitespace issue. OK deraadt@
2017-04-09Seven casts, a couple of tweaks and CFLAGS+=-Wsign-compare for theKenneth R Westerback
win. No intentional functional change.
2017-04-08Reduce the overburden of signed vs unsigned comparisons by sprinklingKenneth R Westerback
'int' -> 'unsigned int' (and visa versa) where obvious. Steal a couple of 'unsigned' -> u_int32_t from reyk@'s dhcrelay tweaks. No intentional functional change.
2017-04-08Replace another snprintf() dance with easier to read code usingKenneth R Westerback
strlcat(). Shorter, clearer, fewer signed vs unsigned questions. Use an 8K static buffer for pretty_print_classless() and use it rather scribbling intermediate values into the final destination. No intentional functional change.
2017-04-08Replace a mess of snprintf() dances with easier to read code usingKenneth R Westerback
strlcat(). Shorter, clearer, fewer signed vs unsigned questions. Shrink static buffer for the string version of an option value from 32K to 8K. Since the string version of the entire lease is constructed in a 8K buffer, bigger option values are pointless. Use 8K of the saved space for a static buffer for pretty_print_string() and use it rather scribbling intermediate values into the final destination. No intentional functional change.
2017-04-07Simply decoding of domain search option. No intentional functionalKenneth R Westerback
change.
2017-04-06Inspired by recent dhcrelay(8) changes add some stricter CFLAGS. No codeKenneth R Westerback
changes needed (yet).
2017-04-06less chatty EXAMPLES; from anton lindqvistJason McIntyre
2017-04-06document -=; while here, simplify things so that we don;t add a separateJason McIntyre
usage every time we think of a new way to use this; -= bits from anton lindqvist ok tb tom
2017-04-05Shuffle sendhup() into dispatch.c, the only place it is used.Kenneth R Westerback
2017-04-05various improvements, from klemens nanni;Jason McIntyre
i've omitted hunk 3 of his diff, as what's there now is correct; ok mikeb
2017-04-04Send a RTM_PROPOSAL to clear out other dhclient instances on startup.Kenneth R Westerback
Replaces forcing interface link state down and up to generate RTM_IFINFO messages.
2017-04-04Treat SSID's like the 0 to 32 bytes of uint8_t data that they reallyKenneth R Westerback
are. Track and use the actual lengths and use memcpy()/memcmp() instead of strcmp()/strdup().
2017-04-03warn format string should be literal.Frederic Cambus
OK deraadt@, millert@
2017-04-03Change parse_string() to take an optional integer pointer that canKenneth R Westerback
be used to return the final size of the parsed (i.e. un-vis'ed) string. Use same, plus memcpy() to ensure entire final string is copied to intended destination even if there are embedded NULs.
2017-04-03Simplify read_string() to just read the characters between the '"'s.Kenneth R Westerback
Push the un-vising up to parse_string(). This allows both the actual string and the un-vised version to be available as desired. Use memcpy() instead of strdup() to copy un-vised string since it may legitimately contain NUL.
2017-04-03Tweak parse_string() to not consume the ';'. Simplifies/shortensKenneth R Westerback
some logic.
2017-04-03Tweak 'expecting' parse_warn() messages to be more consistent.Kenneth R Westerback
2017-04-02Check return value of asprintf(), and don't use 0 as a char *Tom Cosgrove
Started by, and ok, deraadt@
2017-04-02Change parse_string() warning from "filename must be a string" toKenneth R Westerback
"expecting a string". Things other than filenames are parsed here.
2017-03-30Only close the SA if an error happens before ikev2_msg_init() was calledPatrick Wildt
to make sure we do not run ikev2_msg_cleanup() on an unitialized stack variable. ok deraadt@ reyk@
2017-03-28Add helpful debug messages to tell us why public key authentication failed.Reyk Floeter
This is currently only visible in debug mode (eg. iked -dvv), some debug messages will be turned into regular warnings later. OK claudio@ deraadt@
2017-03-28Remove RSA from the list of keywords, lookup is now done in a table.Reyk Floeter
This lets us configure explicit old-style RSA again. OK mikeb@
2017-03-28Don't send informational responses before we're having the key material.Reyk Floeter
iked starts sending keepalive messages after authentication and after successfully completing the handshake. Other implementations, like we've seen on Microsoft Azure, start sending keepalive messages right after receiving the first SA_INIT message when they set up the key material, even before we received the SA_INIT response to complete the DH exchange. The solution is to ignore early keepalive messages before we're ready to encrypt our response, in the transition between SA_INIT and AUTH. The peer should still accept one or more missed keepalives. OK mikeb@
2017-03-28Returning -1 in an imsg handler like ikev2_dispatch_cert aborts iked.Reyk Floeter
-1 means "I didn't handle or know this imsg", it should not be used to indicate an application error in this context. OK mikeb@
2017-03-27rather than printing the wrong function name, dont print it at all.Sebastian Benoit
found by Klemens Nanni
2017-03-27Don't cache the DH group in the policyMike Belopuhov
When tearing IKE SA down, the DH group referred by it is destroyed, however it remains cached in the policy. With the introduction of IKE SA rekeying we have extended the life of this dangling pointer by reusing it on new SAs. So instead of caching the pointer in the policy we can store the DH group ID and create a DH group on demand using this parameter if it's specified. With and OK reyk
2017-03-27correct verb pattern;Jason McIntyre
2017-03-27Factor out flows into separate configuration messagesMike Belopuhov
We reach an imsg payload limit with just a few traffic selectors so in order to load more we need to split them up and send separately. Suggested and OK reyk
2017-03-27spacingReyk Floeter
2017-03-27Fix another iked leak of SAs in pfkey_sa(), copy tags correctly.Reyk Floeter
Diff from markus@ OK mikeb@ patrick@
2017-03-27Add support to reflect the responder IKEv2 COOKIE.Reyk Floeter
This fixes connecting to Azure VPN and other implementations that implement the IKEv2 COOKIE mechanism on the responder side. Azure decides to send you a responder COOKIE after too many connection attempts - we have to keep it and reflect it to establish a connection. This implementation is only for the initiator (client) side, we do not support sending COOKIEs on the responder (server) side yet. OK patrick@ mikeb@
2017-03-27Add support for RFC4754 (ECDSA) and RFC7427 authentication.Reyk Floeter
These modes provide stronger and more flexible ways for authentication: while RSA public key auth relies on SHA-1 hashes, the news modes use SHA2-256 and up to SHA2-512 hashes. Original diff from markus@ with patches from mikeb@ and me. OK mikeb@ patrick@
2017-03-26Fix dhclient vis/unvis of strings stored in the leases file.Kenneth R Westerback
Replaces incorrect manual emulation of vis() for single, double and back quotes, dollar signs and back slashes. Just use vis() with VIS_ALL for these characters. Should fix problem reported by robert@ with ssid's containing back slash.
2017-03-26cleanup fdisk(8) partition names used by FAT file systems so they are moreIgor Sobrado
consistent and easier to identify, as outlined here: - FAT12: FAT12 (01h) - FAT16: FAT16S (04h), FAT16B (06h), FAT16L (0Eh) - FAT32: FAT32 (0Bh), FAT32L (0Ch) nothing in our tree is looking to the strings being replaced for anything but printing them out, only to the numerical ids taken from disklabel.h ok krw@, jmc@
2017-03-23Fix printf() incantation for non-NULL terminated string.Kenneth R Westerback
Pointed out by florian@. ok bluhm@
2017-03-23set ps_noaction to not fork uneeded children when checking config with -nJonathan Gray
ok mikeb@ reyk@
2017-03-21From a syslog perspective it does not make sense to log fatal andAlexander Bluhm
warn with the same severity. Switch log_warn() to LOG_ERR and keep fatal() at LOG_CRIT. OK reyk@ florian@
2017-03-21Replace a magic number with the corresponding macro from ieee80211_ioctl.h.Stefan Sperling
No functional change. ok deraadt@ tb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 22:38:56 +0000