wireguard-openbsd/sbin/ipsecctl/pfkdump.c, branch jd/queueboosts WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sbin/ipsecctl/pfkdump.c?h=jd%2Fqueueboosts 2020-06-01T21:00:51Z Fix "comparison of integers of different signs" warning. 2020-06-01T21:00:51Z tobhe tobhe@openbsd.org 2020-06-01T21:00:51Z urn:sha1:14c62822489bc2afb05e096dd1cd9fd97c96140c ok patrick@ Support SADB_X_EXT_RDOMAIN extension in pfkey dump (-m). 2020-04-23T19:57:01Z tobhe tobhe@openbsd.org 2020-04-23T19:57:01Z urn:sha1:f59246387ffbc3b586525e71fd3931d34bab343e ok markus@, patrick@ snprintf/vsnprintf return < 0 on error, rather than -1. 2019-07-03T03:24:01Z deraadt deraadt@openbsd.org 2019-07-03T03:24:01Z urn:sha1:515e489c3d599b9cfcdf9cf6842ac49f92e154d6 Display per-TDB counters in verbose mode. 2018-08-28T15:17:56Z mpi mpi@openbsd.org 2018-08-28T15:17:56Z urn:sha1:7fc6e3f06dd0e43d868f837091c4e7ca2b8cdffc ok sthen@ Include <sys/queue.h> instead of relying on kernel headers to include 2018-07-10T09:35:27Z mpi mpi@openbsd.org 2018-07-10T09:35:27Z urn:sha1:0bfe572bb913d278e5c5c9cb2715b8b30be0be2e it. ok markus@ as part of a larger diff Rename all SA groups to bundles consistently. The first kernel 2017-04-19T15:59:38Z bluhm bluhm@openbsd.org 2017-04-19T15:59:38Z urn:sha1:a6bcba92419d4e18dcd565b47ebebb02bfc697ba commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@ Found another len += snprintf... 2017-04-10T14:32:47Z deraadt deraadt@openbsd.org 2017-04-10T14:32:47Z urn:sha1:79d7816a74a0b8a3429fb24a999f30301f6d3a3a ok mikeb Now that the kernel provides information about IPsec SA bundles, 2017-03-02T17:44:32Z bluhm bluhm@openbsd.org 2017-03-02T17:44:32Z urn:sha1:fbd50af56a11314f850094ab77f51ab5b415c827 print them by default. OK hshoexer@ Depending on the addresses, ipsecctl(8) automatically groups sa 2017-02-28T16:46:27Z bluhm bluhm@openbsd.org 2017-02-28T16:46:27Z urn:sha1:d44c51a1611305bdb03515161662f4bc88a16504 bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@ Remove plain DES encryption from IPsec. 2015-12-09T21:41:49Z naddy naddy@openbsd.org 2015-12-09T21:41:49Z urn:sha1:0e80007105b2a3774fa4fdec1372aebe62193da5 DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@