summaryrefslogtreecommitdiffstats
path: root/sbin/isakmpd (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Link isakmpd dynamically. Mount /usr on NFS via IPsec does notbluhm2021-02-111-2/+4
| | | | | | | work anyway. Dynamic binaries help building errata, reduce disk usage and make ROP harder. Also remove an unused bsd.subdir.mk include. OK sthen@ mvs@ deraadt@ tobhe@ patrick@
* Extern transport_list. Fixed compilation with -fno-common.mortimer2021-01-282-3/+6
| | | | ok deraadt@
* Fix shared DH secret length in log message.tobhe2020-07-071-2/+2
| | | | ok patrick@
* Fix isakmpd monitor process to use the exit status of main processyasuoka2020-01-241-3/+8
| | | | | | when exiting. "make sense" deraadt
* The previous fix for creating isakmpd(8) IKE pcap file, weakenedbluhm2019-12-191-8/+30
| | | | | | the path sanitizer in the privsep parent. Bring back the checks in a way that works with new realpath(3). tested and OK hshoexer@
* If a file or directory component does not exists, realpath(3) returnsbluhm2019-12-101-4/+3
| | | | | | | ENOENT. In this case, try to open(2) the path. Then a non-existing file will be created, but a missing directory component still causes an error. This fixes isakmpd(8) IKE pcap file creation. from hshoexer@
* Change the default security level for incoming IPsec flows fromtobhe2019-11-291-3/+2
| | | | | | isakmpd and iked to REQUIRE. Filter policy violations earlier. ok sashan@ bluhm@
* Do not print misleading error message about permission error forbluhm2019-11-141-13/+6
| | | | | | non existing isakmpd.conf(5) file. This was a result of the changed realpath(3) behavior. Now isakmpd(8) uses the errno from the system. reported by igor kos; OK deraadt@
* mop up for the pcap.3 rename;jmc2019-08-301-4/+4
| | | | help/ok deraadt
* snprintf/vsnprintf return < 0 on error, rather than -1.deraadt2019-07-031-3/+3
|
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-286-15/+15
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* oops, bad Pp snuck in;jmc2019-02-191-3/+2
|
* Rework the certificate generation examples a bit:sthen2019-02-181-13/+19
| | | | | | | | | | | | - show an example sed to substitute the $ENV::CERTIP/CERTFQDN strings while copying /etc/ssl/x509v3.cnf to a temp file - don't use /etc/ssl/x509v3.cnf on the command line when we've just told people to copy and edit - fix an instance of CERTIP that should have been CERTFQDN based on diffs from Sevan Janiyan, feedback/ok jmc@
* PF_ROUTE -> AF_ROUTE in the scattered sock()/setsockopt() callskrw2019-01-221-2/+2
| | | | | | where the "wrong" #define was used. ok dlg@
* add missing braces implied by indentationjsg2018-09-201-2/+3
| | | | ok millert@ mpi@
* Document how to avoid isakmpd(8) source IP address pitfalls by usingstsp2018-04-172-6/+18
| | | | | | the Listen-on directive in isakmpd.conf(5). This directive can be necessary in multi-homed situations, and if isakmpd(8) is used with carp(4). ok sthen@ mpi@
* Spacing, no object change.mpi2018-01-1520-89/+89
|
* space -> tabmpi2018-01-0420-111/+111
| | | | No object change.
* Set the correct ENCAPSULATION_MODE when doing NAT-T.mpi2017-12-071-4/+36
| | | | | | | Fix at least interoperability with Cisco when isakmpd(8) is initiating the connections, originally reported by sebastia@ in 2014. Refreshed diff from and ok hshoexer@, ok sthen@, ok remi@
* Use clock_gettime(CLOCK_MONOTONIC) to schedule timersjca2017-12-0513-80/+81
| | | | From Scott Cheloha, ok tb@
* in isakmpd(8), provide a hint: from scott chelohajmc2017-11-231-5/+4
| | | | also some minor tweaks while here...
* In the final RFC 5903 the computation for the DH shared secret changed.patrick2017-11-087-31/+76
| | | | | | | | | | | | | | | | | Instead of the full point, only the X point is included. The member g_xy is always the shared secret but so far its buffer has been allocated using the size of the public points. Since this is a different size now, as the shared secret for EC Groups should only store the x point, we need another member to specify the length of g_xy. Since this is a backwards incompatible change older isakmpds won't be able to negotiate if you use EC groups. Bump the version of our own vendor tag so peers can try to keep compatibility based on the presen- ted tag. This could be used to implement backwards compatibility to older isakmpds. Prompted by and ok mpi@
* Support DH groups 19 to 21 and 25 to 30, just like iked(8) does.mpi2017-10-274-15/+34
| | | | ok visa@, markus@
* Check for failures of exchange_establish_p{1,2}() and call the givenmpi2017-09-182-34/+57
| | | | | | | | | | | | `finalize' function with the `fail' argument when this happen. Introduce some sanity checks in exchange_free() to be able to call if even if the data structure isn't completely initialized. Plug memory leaks when exchange_establish() fails. While here fix a double free in one of the error paths. Based on a diff from hshoexer@, ok stsp@, markus@
* Remove listing of fixed bugs.mpi2017-08-221-49/+1
| | | | ok markus@
* Prevent a use-after-free by always passing dynamically allocatedmpi2017-08-062-7/+18
| | | | | | | | | | | arguments to f_key_v2_connection_check(). The race can be triggered by sending SIGHUP to the daemon. Note that this change do not fix the memory leak if exchange_establish() fails. Reported by Michał Koc. ok hshoexer@, markus@, henning@
* Prevent a NULL dereference when comparing incomplete SAs.mpi2017-07-181-1/+10
| | | | | | | | | This deference can occur because sa_find() is called from a timer and iterates over all existing `sa'. At that time the corresponding `finalize_exchange' might not have been called, in which case it is unsafe to dereference `src_net', `dst_net' & co. Issue reported by Michał Koc. ok hshoexer@, markus@
* remove misc. depend and yacc nits that no longer matter.espie2017-07-101-2/+2
| | | | okay millert@
* Generate source and header files for regress on demand.bluhm2017-07-031-2/+3
| | | | OK espie@
* mark files as BUILDFIRST, or write explicit dependencies, so that mostespie2017-06-161-1/+3
| | | | | programs will build even without a make depend first. okay tb@ millert@
* Check return value of asprintf(), and don't use 0 as a char *tom2017-04-021-10/+10
| | | | Started by, and ok, deraadt@
* Depending on the addresses, ipsecctl(8) automatically groups sabluhm2017-02-281-3/+3
| | | | | | | | | | bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@
* Stop assuming that in_{addr,port}_t are typedefed in <sys/types.h> andguenther2017-02-035-5/+11
| | | | | | instead pull in <netinet/in.h> or <arpa/inet.h> when those are needed. ok florian@ beck@ millert@
* Remove modular exponential groups specified in RFC5114mikeb2017-01-041-63/+1
| | | | Brought up by doug@, ok reyk, djm, doug
* Hyphenate compound adjectives 'up-to-date', 'out-of-date' and 'well-known'tb2017-01-011-4/+4
| | | | | | if they precede the noun and omit hyphens otherwise. ok tj
* A commented block starts withderaadt2016-09-031-6/+1
| | | | | # If you have ElectricFence available, you can spot abuses of the heap." Or, uhm you can simply use our malloc.
* move links from http to https://www.openbsd.org/tb2016-09-021-2/+2
| | | | ok beck
* Pull in <sys/select.h> for fd_setguenther2016-08-261-1/+2
| | | | ok deraadt@
* Fix memory leak. Call proto_free() always to free proto.yasuoka2016-04-041-6/+4
| | | | | | Diff from Yuuichi Someya. ok reyk markus
* Another use for fcntl() and thus of the superfluous 3rd parameterkrw2016-04-021-4/+27
| | | | | | | | | is when sanitising standard fd's before calling daemon(). Use a tweaked version of the ssh(1) function in all three places found using fcntl() this way. ok jca@ beck@
* More "(<blah> *)0" -> NULL, avoiding any stdarg functions.krw2016-03-161-2/+2
| | | | Feedback millert@ kettenis@
* Don't retransmit responses for unauthenticated messages.yasuoka2016-03-103-4/+18
| | | | | | Base on diff from Yuuichi Someya ok markus reyk mikeb
* fix steps for cert creation;jmc2016-03-051-5/+13
| | | | | | issue reported by igor.kos (temporary) fix entirely provided by sthen
* Print ssize_t with %zd; ok deraadt@ mmcc@jca2016-02-291-5/+4
|
* typo fix; from julian hsiaojmc2016-01-111-3/+3
|
* tweak; from julian hsiaojmc2016-01-081-3/+3
|
* Remove NULL-checks before free(). ok tb@mmcc2015-12-106-20/+13
|
* Remove plain DES encryption from IPsec.naddy2015-12-096-154/+19
| | | | | | | | | | DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
* A classic case for bzero() -> explicit_bzero()mmcc2015-10-151-2/+2
| | | | ok deraadt@
* drop useless .Xo and .Bk, and shorten by avoiding some .Smschwarze2015-09-251-81/+14
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.