wireguard-openbsd/sbin/ipsecctl/ipsec.conf.5, branch jd/queueboosts WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sbin/ipsecctl/ipsec.conf.5?h=jd%2Fqueueboosts 2020-02-16T11:28:28Z Quote variables in pf tag strings 2020-02-16T11:28:28Z kn kn@openbsd.org 2020-02-16T11:28:28Z urn:sha1:521965d7276a55d855f498ed63519ccc32edf828 Macros are expanded by the parser at parse time, whereas variables are read as ordinary strings and left unmodified; hence, quoted `"$domain"' gets passed to the daemon as is, which substitutes proper values before passing it to the kernel. `$domain' without quotes never makes it to the daemon, that is with `domain = foo' somewhere else "foo" is being eventually passed unmodified to the kernel. jmc prompted for a proper explanation and provided the final wording. OK tobhe jmc briefly mention /etc/examples/ in the FILES section of all the 2020-02-10T13:18:20Z schwarze schwarze@openbsd.org 2020-02-10T13:18:20Z urn:sha1:c9d6433d50ff1ac58fa567b9a0e2cfcd09ff7590 manual pages that document the corresponding configuration files; OK jmc@, and general direction discussed with many Extend the ipsecctl(8) parser to set the udpencap flag and port 2020-02-07T13:01:34Z bluhm bluhm@openbsd.org 2020-02-07T13:01:34Z urn:sha1:a3b4c2abd806f43bf603f8f0086c568ea77dc3d0 number of an SA. This will be useful to test IPsec with NAT-T. OK sthen@ tobhe@ Consistently use _rcctl enable foo_ in examples, it's simpler and less 2019-11-10T20:51:52Z landry landry@openbsd.org 2019-11-10T20:51:52Z urn:sha1:f2cc1b425fc19b24e9e47473e4618055f8126f43 error prone than manually editing rc.conf.local, and also works to enable ipsec and accounting. tweak from schwarze@ to use the \(dq\(dq syntax for quotes in '.Dl foo_flags="" lines' instead of \&"\&". while at it, fix a reference to a bogus /dev/dhclient.conf file that recently snuck in. ok jmc@ deraadt@ schwarze@ Document how to avoid isakmpd(8) source IP address pitfalls by using 2018-04-17T12:13:29Z stsp stsp@openbsd.org 2018-04-17T12:13:29Z urn:sha1:89adc933c6c7cad59ed4128865c03dbd29e73bff the Listen-on directive in isakmpd.conf(5). This directive can be necessary in multi-homed situations, and if isakmpd(8) is used with carp(4). ok sthen@ mpi@ in isakmpd(8), provide a hint: from scott cheloha 2017-11-23T20:49:38Z jmc jmc@openbsd.org 2017-11-23T20:49:38Z urn:sha1:9772ab45da1ddacbe1de7c219ed4e2731f0b0902 also some minor tweaks while here... Support DH groups 19 to 21 and 25 to 30, just like iked(8) does. 2017-10-27T08:29:32Z mpi mpi@openbsd.org 2017-10-27T08:29:32Z urn:sha1:26c588cc18e0ac59a6019c7d831ab03bb591779c ok visa@, markus@ Up to now ipsecctl(8) grouped SAs with identical src and dst to the 2017-04-14T18:06:28Z bluhm bluhm@openbsd.org 2017-04-14T18:06:28Z urn:sha1:07f0d149a598a346ea652df7a5a7cbfebb21ca31 flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@ Remove plain DES encryption from IPsec. 2015-12-09T21:41:49Z naddy naddy@openbsd.org 2015-12-09T21:41:49Z urn:sha1:0e80007105b2a3774fa4fdec1372aebe62193da5 DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@ replace "can not" with "cannot"; 2015-11-01T21:26:48Z jmc jmc@openbsd.org 2015-11-01T21:26:48Z urn:sha1:0aee06c65c1409025c9a1bb7ab69d4b7b5f69aee