summaryrefslogtreecommitdiffstats
path: root/sbin/ipsecctl/parse.y
AgeCommit message (Collapse)AuthorFilesLines
2020-02-07Extend the ipsecctl(8) parser to set the udpencap flag and portbluhm1-11/+37
number of an SA. This will be useful to test IPsec with NAT-T. OK sthen@ tobhe@
2019-08-26Fix file descriptor leak due to popfile() never closing the main config file.tobhe1-13/+14
The fix is the same as for other parse.y files in the tree (see bgpd(8) or unwind(8)) ok bluhm@
2019-02-13(unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherderaadt1-3/+3
larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
2018-11-07sync cmdline_symset() changes with src/usr.sbin; OK sashan@ claudio@miko1-7/+3
2018-11-01- odd condition/test in PF lexersashan1-2/+3
(and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
2018-07-11Do for most running out of memory err() what was done for most runningkrw1-51/+51
out of memory log_warn(). i.e. ("%s", __func__) instead of manual function names and redundant verbiage about which wrapper detected the out of memory condition. ok henning@
2018-07-09No need to mention which memory allocation entry point failed (malloc,krw1-5/+5
calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
2018-07-08Be consistent in warn() and log_warn() usage whenkrw1-3/+3
running out of memory. Next step, be correct *and* consistent. ok dennis@ tb@ benno@ schwarze@
2018-04-26Plug leak in error case of the common 'varset' implementations.krw1-1/+3
ok benno@
2017-10-27Support DH groups 19 to 21 and 25 to 30, just like iked(8) does.mpi1-17/+35
ok visa@, markus@
2017-04-19Rename all SA groups to bundles consistently. The first kernelbluhm1-21/+21
commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@
2017-04-14Up to now ipsecctl(8) grouped SAs with identical src and dst to thebluhm1-15/+23
flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQkrw1-5/+7
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".benno1-1/+9
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2015-12-09Remove plain DES encryption from IPsec.naddy1-2/+1
DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
2015-11-04Decode Chacha20-Poly1305 when dumping SAs; ok reyk, naddymikeb1-1/+2
2015-06-03Do not assume that asprintf() clears the pointer on failure, whichmillert1-6/+7
is non-portable. Also add missing asprintf() return value checks. OK deraadt@ guenther@ doug@
2014-11-20Don't allow embedded nul characters in strings.jsg1-1/+4
Fixes a pfctl crash with an anchor name containing an embedded nul found with the afl fuzzer. pfctl parse.y patch from and ok deraadt@
2014-11-04Add gcc format attributes to ipsecctl's parse.y. Also, fix a few formatdoug1-8/+12
characters. ok sthen@ naddy@ markus@
2014-01-22relax the cfg file secrecy check slightly to allow group readabilityhenning1-3/+3
default permissions and mtree NOT changed. prodded by benno, ok phessler benno jmatthew theo pelikan florian
2013-11-25use u_char for buffers in yylex, for ctype callsbenno1-7/+7
found by millert@, ok deraadt@
2013-11-22Whole bunch of (unsigned char) casts carefully added for ctype calls.deraadt1-2/+2
Careful second audit by millert
2012-07-10Rename "life" to "lifetime" to match iked.lteo1-31/+56
ok mikeb naddy sthen; procedures ok henning
2012-07-08Disallow manual security associations that use AES-CTR, AES-GCM,naddy1-23/+28
or AES-GMAC. These algorithms cannot be used safely with static keys and RFCs 3686, 4106, and 4543 expressly forbid such configurations. Also include a tweak (with jmc@) to the key size explanation, for completeness sake. ok mikeb@
2012-07-07copy&paste mistake in error messagenaddy1-3/+3
2012-06-30enable use of AES-{192,256}-CTR, and explicitly of AES-128-CTR, for IPsec ESPnaddy1-1/+4
ok mikeb@
2011-12-20unsigned long should use "%lu" format; from eric lax, thanksmikeb1-3/+3
2011-07-06For non-crypted flows (such as ipcomp and ipip), default theirderaadt1-2/+14
type (if not specified) to "use" instead of "require". (since they will not get a key...) ok mikeb claudio
2010-10-06Retire Skipjackmikeb1-2/+1
There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
2010-09-22Support AES-GCM-16 (as aes-gcm) and ENCR_NULL_AUTH_AES_GMACmikeb1-39/+59
(as aes-gmac) encryption transformations in the ipsec.conf(5). Available "enc" arguments denoting use of 1) AES-GCM-16: aes-128-gcm for 160 bit key (128+nonce) aes-192-gcm for 224 bit key (192+nonce) aes-256-gcm for 288 bit key (256+nonce) 2) ENCR_NULL_AUTH_AES_GMAC: aes-128-gmac for 160 bit key (128+nonce) aes-192-gmac for 224 bit key (192+nonce) aes-256-gmac for 288 bit key (256+nonce) Please note that aes-gmac family performs no encryption and provides no confidentiality and is intended for cases in which confidentiality is not desired (it can be thought of as AH with NAT-T support). Also, although this implementation supports manual keying, it's use is strictly discouraged as AES-GCM security depends on frequent re-keying. So it can be thought of as a debug facility only. Example configuration: ike esp from 172.23.61.36 to 172.23.61.156 \ quick enc aes-256-gcm \ psk humppa Thoroughly tested by me and naddy. Works fine with Linux. Requires updated pfkeyv2.h include file. OK naddy
2010-08-03fix linecount bug with comments spanning multiple lineshenning1-3/+4
problem reported with the obvious fix for bgpd by Sebastian Benoit <benoit-lists at fb12.de>, also PR 6432 applied to all the others by yours truly. ok theo isn't it amazing how far this parser (and more) spread?
2010-05-10Various comment typos. 'wether' -> 'whether' (most popular), 'possiblity' ->krw1-2/+2
'possibility', 'optins' -> 'options', 'resposne' -> 'response', 'unecessary' -> 'unnecessary', 'desination' -> 'destination'. Collected from various misc@ and tech@ postings, many by Brad Tilley.
2009-08-04Specify an ID-type of IPV4_ADDR or IPV6_ADDR if the srcid or dstid isjsing1-3/+13
given as an IPv4 or IPv6 address, rather than treating the IP address as a FQDN. ok hshoexer@ markus@ todd@
2009-03-31Fixed memory leaks which would occur if the second of two memorytobias1-3/+7
allocations fails. looks right deraadt, krw ok henning
2009-01-30If the "peer" address is not specified or derived from "to" forbluhm1-7/+67
"ike" rules in ipsec.conf, the default peer is used. In theory ipsecctl -f ipsec.conf can configure the default peer for each "ike" entry. As isakmpd only supports one default peer, the last "ike" rule that uses a default peer wins. This configuration is then significant for all "ike" rules that use the default peer. Now a warning is printed if a later rule in ipsec.conf changes the configuration of the original default peer. This should be an error but that would break existing user configs. So only a warning is printed. ok hshoexer@, todd@
2009-01-29After checking that peer == NULL do not assign peer = NULL a fewbluhm1-7/+3
lines later. No functional change. ok grunk@, hshoexer@
2009-01-28Allow to specify ike and flow explicitly without peer. The anybluhm1-13/+32
keyword as argument for the peer parameter will do that. An ike without peer creates the peer-default config. A flow without peer acquires a host-to-host SA. tested by grunk@, todd@, ok grunk@, hshoexer@, todd@
2009-01-20Add support to isakmpd(8) and ipsecctl(8) to install SA's with ampf1-3/+30
different source network than we have negotiated with a peer. This enables us to do nat/binat on the enc(4) interface. Very useful to work around rfc 1918 collisions. Manpage and testing by Mitja Muzenic. Thanks! OK hshoexer@, markus@. "I like it" todd@
2008-11-14When parsing v4 addresses mark them as network addresseshshoexer1-2/+2
(IPV4_ADDR_SUBNET) when they contain a '/'. This allows to choose between IPV4_ADDR and IPV4_ADDR_SUBNET by adding "/32", ie. "a.b.c.d" vs. "a.b.c.d/32". This helps to interop with other IKE implementations. From Mitja Muzenic <mitja at muzenic dot net>, thanks! Idea supported by markus@ and jdixon@.
2008-10-17findeol() fix from pfctlhenning1-3/+5
2008-07-01If a rules contains a hostname instead of an address, use the listbluhm1-4/+9
of all possible addresses from DNS and not only the first one. So during expansion, the right address family can be chosen and regression test ike56 passes again. There localhost resolves to 127.0.0.1 and ::1. ok hshoexer
2008-07-01If multiple to addresses but no peer are given in an ike or flowbluhm1-41/+58
rule, the current to address is taken as peer during expansion. This makes the broken regress test ikefail7 obsolete as address family mismatch cannot happen anymore. ok hshoexer
2008-06-14Move ike and flow peer selection to common function.bluhm1-38/+31
No functional change yet. ok hshoexer
2008-06-11trivial code simplificationbluhm1-5/+3
tested and ok hshoexer, grunk
2008-04-11add support for the "include" directive using code from pfctl/parse.y.reyk1-1/+19
pointed out by Prabhu Gurumurthy ok deraadt@
2008-02-22Support for specifying aes-{128,192,256}. Originial idea by Prabhuhshoexer1-1/+4
Gurumurthy, tweaks and commit-ready diff by Mitja Muzenic! Thanks guys! ok todd@
2007-11-12Remove space/tab compression function from lgetc() and replacempf1-10/+2
it with a simple filter in the yylex() loop. The compression in lgetc() didn't happen for quoted strings, thus creating a regression when tabs were used in variables. Some testing by todd@ and pyr@ OK deraadt@
2007-10-22sync with daemon parser code.pyr1-3/+6
ok deraadt@
2007-10-16Allow '=' to end a number in all lexers.mpf1-2/+2
Requested and OK deraadt@
2007-10-16in the lex... even inside quotes, a \ followed by space or tab shouldderaadt1-2/+4
expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). pointed out by mpf, discussed with pyr
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.