wireguard-openbsd/sbin/iked/parse.y, branch jd/queueboosts WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sbin/iked/parse.y?h=jd%2Fqueueboosts 2020-06-05T14:47:26Z Add default proposals for AES-GCM ciphers in IKE and ESP. 2020-06-05T14:47:26Z tobhe tobhe@openbsd.org 2020-06-05T14:47:26Z urn:sha1:89f5c52562156e99041ddebdcee64c92dba70633 ok patrick@ Add AES-GCM mode ciphers (IANA IDs 19 and 20) for IKEv2. 2020-05-26T20:24:31Z tobhe tobhe@openbsd.org 2020-05-26T20:24:31Z urn:sha1:15863c3aa5cc846f5fa06f4b927df4a984e4b770 They can be configured with the new ikesa enc options aes-128-gcm, aes-256-gcm, aes-128-gcm-12 and aes-256-gcm-12. Tested with Strongswan by Stephan Mendling and myself Tested with Juniper SRX by remi@ ok sthen@, patrick@ Add ECDH groups and higher order MODP DH groups to default proposal. 2020-04-30T21:11:13Z tobhe tobhe@openbsd.org 2020-04-30T21:11:13Z urn:sha1:2e1d665042a9f50224ea748cd7c6163dae0c165c ok sthen@, patrick@ Remove trailing tab 2020-04-29T16:09:11Z tobhe tobhe@openbsd.org 2020-04-29T16:09:11Z urn:sha1:2b636bfac334e8525e932b1100aa82653e0e4f17 Missing whitespace. 2020-04-29T14:55:21Z tobhe tobhe@openbsd.org 2020-04-29T14:55:21Z urn:sha1:828ad0660a2a84b075a102c8b35cf2a81d964de9 Remove support for insecure EC2N groups. Clarify which Diffie-Hellman 2020-04-28T15:18:52Z tobhe tobhe@openbsd.org 2020-04-28T15:18:52Z urn:sha1:bc77414b5b305cd4b19f50d475b00357f0a91dde groups are not recommended to use and are only supported for backwards compatibility. Feedback from sthen@ ok kn@ Only print valid rdomains. '-1' is used as default value and should 2020-04-26T16:55:47Z tobhe tobhe@openbsd.org 2020-04-26T16:55:47Z urn:sha1:1a46f25785af0faf93cef018a9a414e56baf21bf not be printed. Add support for switching rdomain on IPsec encryption/decryption. 2020-04-23T20:17:48Z tobhe tobhe@openbsd.org 2020-04-23T20:17:48Z urn:sha1:0347364bcafdc08a518dbaa9a2e5afa4f10abdc0 It can be configured per policy with the new 'rdomain' option (see iked.conf(5)). Only the unencrypted (inner) rdomain has to be configured, the encrypted rdomain is always the one the responsible iked instance is running in. The configured rdomain must exist before iked activates the IPsec SAs, otherwise pfkey will return an error. ok markus@, patrick@ Print 'ipcomp' in print_policy() if configured. 2020-04-14T11:30:15Z tobhe tobhe@openbsd.org 2020-04-14T11:30:15Z urn:sha1:4a2a67d26243ba9f9961202954ffb744b80b6204 No need to call lc_idtype(). idstr does not contain a leading type 2020-04-12T22:11:29Z tobhe tobhe@openbsd.org 2020-04-12T22:11:29Z urn:sha1:df1d12c102cab91c942026eea6e0d57c49fa6139 specifier (e.g. 'FQDN/').