wireguard-openbsd/sbin/ipsecctl/pfkey.c, branch jd/queueboosts

Extend the ipsecctl(8) parser to set the udpencap flag and port

2020-02-07T13:01:34Z

number of an SA. This will be useful to test IPsec with NAT-T. OK sthen@ tobhe@

When system calls indicate an error they return -1, not some arbitrary

2019-06-28T13:32:41Z

value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.

Rename all SA groups to bundles consistently. The first kernel

2017-04-19T15:59:38Z

commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@

use freezero()

2017-04-18T02:29:56Z

Depending on the addresses, ipsecctl(8) automatically groups sa

2017-02-28T16:46:27Z

bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@

Remove NULL-checks before free(). ok tb@

2015-12-10T17:26:59Z

Remove plain DES encryption from IPsec.

2015-12-09T21:41:49Z

DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@

Use explicit_bzero() when the memory is freed directly afterward.

2015-10-18T02:30:53Z

ok deraadt@

simple conversion from select() to poll()

2014-11-03T03:22:22Z

enable use of AES-{192,256}-CTR, and explicitly of AES-128-CTR, for IPsec ESP

2012-06-30T14:51:31Z

ok mikeb@