wireguard-openbsd/sbin/ipsecctl/ipsecctl.h, branch jd/queueboosts WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sbin/ipsecctl/ipsecctl.h?h=jd%2Fqueueboosts 2020-02-07T13:01:34Z Extend the ipsecctl(8) parser to set the udpencap flag and port 2020-02-07T13:01:34Z bluhm bluhm@openbsd.org 2020-02-07T13:01:34Z urn:sha1:a3b4c2abd806f43bf603f8f0086c568ea77dc3d0 number of an SA. This will be useful to test IPsec with NAT-T. OK sthen@ tobhe@ Support collapsing flow outputs. 2017-11-20T10:51:24Z mpi mpi@openbsd.org 2017-11-20T10:51:24Z urn:sha1:aa9f7a4d226cb57cabd666fd7fce7f7b34f561de Makes it easier to check live status of complex setups. ok hshoexer@ Support DH groups 19 to 21 and 25 to 30, just like iked(8) does. 2017-10-27T08:29:32Z mpi mpi@openbsd.org 2017-10-27T08:29:32Z urn:sha1:26c588cc18e0ac59a6019c7d831ab03bb591779c ok visa@, markus@ Rename all SA groups to bundles consistently. The first kernel 2017-04-19T15:59:38Z bluhm bluhm@openbsd.org 2017-04-19T15:59:38Z urn:sha1:a6bcba92419d4e18dcd565b47ebebb02bfc697ba commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@ Up to now ipsecctl(8) grouped SAs with identical src and dst to the 2017-04-14T18:06:28Z bluhm bluhm@openbsd.org 2017-04-14T18:06:28Z urn:sha1:07f0d149a598a346ea652df7a5a7cbfebb21ca31 flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@ Remove plain DES encryption from IPsec. 2015-12-09T21:41:49Z naddy naddy@openbsd.org 2015-12-09T21:41:49Z urn:sha1:0e80007105b2a3774fa4fdec1372aebe62193da5 DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@ Decode Chacha20-Poly1305 when dumping SAs; ok reyk, naddy 2015-11-04T12:46:13Z mikeb mikeb@openbsd.org 2015-11-04T12:46:13Z urn:sha1:f705960c822c5a2b9d07f8bc06ae3de05cf56bac Rename "life" to "lifetime" to match iked. 2012-07-10T13:58:33Z lteo lteo@openbsd.org 2012-07-10T13:58:33Z urn:sha1:f94146a9ca572306c6011c24ec5b9bbc36fb31a6 ok mikeb naddy sthen; procedures ok henning Disallow manual security associations that use AES-CTR, AES-GCM, 2012-07-08T17:51:51Z naddy naddy@openbsd.org 2012-07-08T17:51:51Z urn:sha1:bda04dede2ae2a9f101f6eb4d4180d3e29ed9076 or AES-GMAC. These algorithms cannot be used safely with static keys and RFCs 3686, 4106, and 4543 expressly forbid such configurations. Also include a tweak (with jmc@) to the key size explanation, for completeness sake. ok mikeb@ don't output "esn" string in the rule section as we can't use the 2012-07-05T09:02:20Z mikeb mikeb@openbsd.org 2012-07-05T09:02:20Z urn:sha1:fd81a95b96b5c21caf380b9c4380c1640568f11d keyword in the grammar to create a esn-enabled rule (no reason to do so for manual sa configuration). instead decode sa flags so that we can also watch changes happening in the realtime with the monitor mode. prompted and ok by naddy