wireguard-openbsd/sbin/ipsecctl/ike.c, branch jd/queueboosts

Support DH groups 19 to 21 and 25 to 30, just like iked(8) does.

2017-10-27T08:29:32Z

ok visa@, markus@

Remove plain DES encryption from IPsec.

2015-12-09T21:41:49Z

DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@

bump up the default Diffie-Hellman group to modp3072; ok mikeb@ djm@

2015-05-25T19:29:36Z

Replace with and other less dirty headers where

2015-01-16T06:39:28Z

possible. Annotate lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)

the comment that comma characters cannot be used in transform

2013-08-25T23:15:20Z

names in ike_section_p2 applies to phase-1 transforms as well.

unbreak the last commit by making sure that the transform name

2012-09-17T20:38:28Z

does not include a "," character. ok otto@

Encode the transform parameters in the transform name, too.

2012-09-15T13:17:48Z

Only using p1name or p2name as a transform identifier (as in rev 1.74) breaks setups that allow multiple transforms for a connection, e.g. in ike passive esp from any to 1.1.1.1 quick enc aes-128 ike passive esp from any to 1.1.1.1 quick enc aes-192 the aes-128 will be overwritten. ok and feedback mikeb@

Do not issue a spurious "force" when "group none" is specified.

2012-08-30T20:03:18Z

Tweaked from his fix and ok mikeb@

Change the configuration format fed to the isakmpd FIFO to be able

2012-07-13T19:36:07Z

to specify extended options like SA Lifetime. All the hard work was done by lteo@, while naddy@ and me have made sure that defaults and AH still work; sthen and jmc have looked over the diffs as well.

Rename "life" to "lifetime" to match iked.

2012-07-10T13:58:33Z

ok mikeb naddy sthen; procedures ok henning