summaryrefslogtreecommitdiffstats
path: root/sbin/ipsecctl (follow)
Commit message (Collapse)AuthorAgeFilesLines
* getifaddrs() can return entries where ifa_addr is NULL. Check for thisbenno2020-12-291-2/+3
| | | | | before accessing anything in ifa_addr. ok claudio@
* Enable support for ASN1_DN ipsec identifiers.phessler2020-11-051-1/+2
| | | | | | | Tested with multiple Window 10 Pro (ver 2004) clients, and OpenBSD+iked as the server. OK tobhe@ sthen@ kn@
* Fix "comparison of integers of different signs" warning.tobhe2020-06-011-3/+3
| | | | ok patrick@
* Support SADB_X_EXT_RDOMAIN extension in pfkey dump (-m).tobhe2020-04-231-1/+13
| | | | ok markus@, patrick@
* Quote variables in pf tag stringskn2020-02-161-4/+5
| | | | | | | | | | | | | Macros are expanded by the parser at parse time, whereas variables are read as ordinary strings and left unmodified; hence, quoted `"$domain"' gets passed to the daemon as is, which substitutes proper values before passing it to the kernel. `$domain' without quotes never makes it to the daemon, that is with `domain = foo' somewhere else "foo" is being eventually passed unmodified to the kernel. jmc prompted for a proper explanation and provided the final wording. OK tobhe jmc
* briefly mention /etc/examples/ in the FILES section of all theschwarze2020-02-101-2/+7
| | | | | manual pages that document the corresponding configuration files; OK jmc@, and general direction discussed with many
* Extend the ipsecctl(8) parser to set the udpencap flag and portbluhm2020-02-074-18/+65
| | | | | number of an SA. This will be useful to test IPsec with NAT-T. OK sthen@ tobhe@
* Consistently use _rcctl enable foo_ in examples, it's simpler and lesslandry2019-11-101-14/+21
| | | | | | | | | | | | | error prone than manually editing rc.conf.local, and also works to enable ipsec and accounting. tweak from schwarze@ to use the \(dq\(dq syntax for quotes in '.Dl foo_flags="" lines' instead of \&"\&". while at it, fix a reference to a bogus /dev/dhclient.conf file that recently snuck in. ok jmc@ deraadt@ schwarze@
* Fix file descriptor leak due to popfile() never closing the main config file.tobhe2019-08-261-13/+14
| | | | | | | The fix is the same as for other parse.y files in the tree (see bgpd(8) or unwind(8)) ok bluhm@
* snprintf/vsnprintf return < 0 on error, rather than -1.deraadt2019-07-031-4/+4
|
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-281-2/+2
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* (unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherderaadt2019-02-131-3/+3
| | | | | | larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
* sync cmdline_symset() changes with src/usr.sbin; OK sashan@ claudio@miko2018-11-071-7/+3
|
* - odd condition/test in PF lexersashan2018-11-011-2/+3
| | | | | | | | | | | | | | (and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
* Remove unnused af argument from unmask(), sync with pfctlkn2018-09-071-5/+4
| | | | | | Noted by jca, thanks. OK jca claudio
* Display per-TDB counters in verbose mode.mpi2018-08-281-41/+66
| | | | ok sthen@
* Do for most running out of memory err() what was done for most runningkrw2018-07-111-51/+51
| | | | | | | | out of memory log_warn(). i.e. ("%s", __func__) instead of manual function names and redundant verbiage about which wrapper detected the out of memory condition. ok henning@
* Include <sys/queue.h> instead of relying on kernel headers to includempi2018-07-101-1/+2
| | | | | | it. ok markus@ as part of a larger diff
* No need to mention which memory allocation entry point failed (malloc,krw2018-07-091-5/+5
| | | | | | | | | calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
* Be consistent in warn() and log_warn() usage whenkrw2018-07-081-3/+3
| | | | | | | | running out of memory. Next step, be correct *and* consistent. ok dennis@ tb@ benno@ schwarze@
* Plug leak in error case of the common 'varset' implementations.krw2018-04-261-1/+3
| | | | ok benno@
* Document how to avoid isakmpd(8) source IP address pitfalls by usingstsp2018-04-171-3/+12
| | | | | | the Listen-on directive in isakmpd.conf(5). This directive can be necessary in multi-homed situations, and if isakmpd(8) is used with carp(4). ok sthen@ mpi@
* in isakmpd(8), provide a hint: from scott chelohajmc2017-11-231-5/+3
| | | | also some minor tweaks while here...
* Support collapsing flow outputs.mpi2017-11-203-12/+207
| | | | | | Makes it easier to check live status of complex setups. ok hshoexer@
* Support DH groups 19 to 21 and 25 to 30, just like iked(8) does.mpi2017-10-274-40/+123
| | | | ok visa@, markus@
* Rename all SA groups to bundles consistently. The first kernelbluhm2017-04-195-44/+44
| | | | | | | commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@
* use freezero()deraadt2017-04-181-7/+4
|
* Up to now ipsecctl(8) grouped SAs with identical src and dst to thebluhm2017-04-143-18/+36
| | | | | | | | flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@
* Found another len += snprintf...deraadt2017-04-101-3/+8
| | | | ok mikeb
* Now that the kernel provides information about IPsec SA bundles,bluhm2017-03-022-7/+38
| | | | | print them by default. OK hshoexer@
* Depending on the addresses, ipsecctl(8) automatically groups sabluhm2017-02-282-3/+13
| | | | | | | | | | bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@
* Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQkrw2017-01-051-5/+7
| | | | | | | | | | | with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
* do not allow whitespace in macro names, i.e. "this is" = "a variable".benno2016-06-211-1/+9
| | | | | | | | change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
* Remove NULL-checks before free(). ok tb@mmcc2015-12-102-36/+19
|
* Remove plain DES encryption from IPsec.naddy2015-12-096-28/+9
| | | | | | | | | | DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
* remove unimplemented PF_KEY algorithms; ok sthen@ mpi@ mikeb@naddy2015-12-021-8/+1
|
* Decode Chacha20-Poly1305 when dumping SAs; ok reyk, naddymikeb2015-11-043-4/+10
|
* replace "can not" with "cannot";jmc2015-11-011-3/+3
|
* Use explicit_bzero() when the memory is freed directly afterward.mmcc2015-10-181-4/+4
| | | | ok deraadt@
* Do not assume that asprintf() clears the pointer on failure, whichmillert2015-06-031-6/+7
| | | | | is non-portable. Also add missing asprintf() return value checks. OK deraadt@ guenther@ doug@
* bump up the default Diffie-Hellman group to modp3072; ok mikeb@ djm@naddy2015-05-252-6/+6
|
* Remove unsupported SADB_X_IDENTTYPE_CONNECTION; OK markus, hshoexermikeb2015-04-171-2/+1
|
* Remove support for storing credentials and auth information in the kernel.mikeb2015-04-141-39/+1
| | | | | | | | | This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
* Reduce usage of predefined strings in manpages.bentley2015-02-281-3/+3
| | | | | | | | | | | Predefined strings are not very portable across troff implementations, and they make the source much harder to read. Usually the intended character can be written directly. No output changes, except for two instances where the incorrect escape was used in the first place. tweaks + ok schwarze@
* Replace <sys/param.h> with <limits.h> and other less dirty headers wherederaadt2015-01-163-6/+6
| | | | | | | | | possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
* tell the truth about DES.sobrado2015-01-101-4/+4
| | | | | | | joint work with djm@ and jsing@, who suggested stronger words warning people away from single-DES. ok djm@
* PFS stands for Perfect Forward Secrecy.sobrado2015-01-021-3/+3
| | | | ok reyk@
* Unbreak the tree. Looks like tedu did not tedu enough when killing KPDKclaudio2014-12-281-3/+1
| | | | support.
* Yet more #include de-duplication.krw2014-11-201-2/+1
| | | | ok deraadt@ tedu@
* Don't allow embedded nul characters in strings.jsg2014-11-201-1/+4
| | | | | | | Fixes a pfctl crash with an anchor name containing an embedded nul found with the afl fuzzer. pfctl parse.y patch from and ok deraadt@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.