wireguard-openbsd/sbin/ipsecctl, branch master WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sbin/ipsecctl?h=master 2020-12-29T19:50:03Z getifaddrs() can return entries where ifa_addr is NULL. Check for this 2020-12-29T19:50:03Z benno benno@openbsd.org 2020-12-29T19:50:03Z urn:sha1:fffd0e6dcaa751a71c35d627fd72a37ef6e04267 before accessing anything in ifa_addr. ok claudio@ Enable support for ASN1_DN ipsec identifiers. 2020-11-05T19:28:27Z phessler phessler@openbsd.org 2020-11-05T19:28:27Z urn:sha1:d8131d03a3f821108393c167a423d11adf045faf Tested with multiple Window 10 Pro (ver 2004) clients, and OpenBSD+iked as the server. OK tobhe@ sthen@ kn@ Fix "comparison of integers of different signs" warning. 2020-06-01T21:00:51Z tobhe tobhe@openbsd.org 2020-06-01T21:00:51Z urn:sha1:14c62822489bc2afb05e096dd1cd9fd97c96140c ok patrick@ Support SADB_X_EXT_RDOMAIN extension in pfkey dump (-m). 2020-04-23T19:57:01Z tobhe tobhe@openbsd.org 2020-04-23T19:57:01Z urn:sha1:f59246387ffbc3b586525e71fd3931d34bab343e ok markus@, patrick@ Quote variables in pf tag strings 2020-02-16T11:28:28Z kn kn@openbsd.org 2020-02-16T11:28:28Z urn:sha1:521965d7276a55d855f498ed63519ccc32edf828 Macros are expanded by the parser at parse time, whereas variables are read as ordinary strings and left unmodified; hence, quoted `"$domain"' gets passed to the daemon as is, which substitutes proper values before passing it to the kernel. `$domain' without quotes never makes it to the daemon, that is with `domain = foo' somewhere else "foo" is being eventually passed unmodified to the kernel. jmc prompted for a proper explanation and provided the final wording. OK tobhe jmc briefly mention /etc/examples/ in the FILES section of all the 2020-02-10T13:18:20Z schwarze schwarze@openbsd.org 2020-02-10T13:18:20Z urn:sha1:c9d6433d50ff1ac58fa567b9a0e2cfcd09ff7590 manual pages that document the corresponding configuration files; OK jmc@, and general direction discussed with many Extend the ipsecctl(8) parser to set the udpencap flag and port 2020-02-07T13:01:34Z bluhm bluhm@openbsd.org 2020-02-07T13:01:34Z urn:sha1:a3b4c2abd806f43bf603f8f0086c568ea77dc3d0 number of an SA. This will be useful to test IPsec with NAT-T. OK sthen@ tobhe@ Consistently use _rcctl enable foo_ in examples, it's simpler and less 2019-11-10T20:51:52Z landry landry@openbsd.org 2019-11-10T20:51:52Z urn:sha1:f2cc1b425fc19b24e9e47473e4618055f8126f43 error prone than manually editing rc.conf.local, and also works to enable ipsec and accounting. tweak from schwarze@ to use the \(dq\(dq syntax for quotes in '.Dl foo_flags="" lines' instead of \&"\&". while at it, fix a reference to a bogus /dev/dhclient.conf file that recently snuck in. ok jmc@ deraadt@ schwarze@ Fix file descriptor leak due to popfile() never closing the main config file. 2019-08-26T18:53:58Z tobhe tobhe@openbsd.org 2019-08-26T18:53:58Z urn:sha1:da1e1ceac58e972f1471c3c499f362dc1e1435e7 The fix is the same as for other parse.y files in the tree (see bgpd(8) or unwind(8)) ok bluhm@ snprintf/vsnprintf return < 0 on error, rather than -1. 2019-07-03T03:24:01Z deraadt deraadt@openbsd.org 2019-07-03T03:24:01Z urn:sha1:515e489c3d599b9cfcdf9cf6842ac49f92e154d6