Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
210,086 Commits 606 Branches 0 Tags 3.1 GiB
f9113d007b
Commit Graph

581 Commits

Author SHA1 Message Date
tteras
6615d57c07 From M E Andersson <debian@gisladisker.se>: Fix parsing of restricted RSA 
key addresses.
 2011-02-10 11:17:17 +00:00
vanhu
bfe163c1a3 store ph1id in an u_int32_t instead of a (signed)int. Patch from Christophe Carre 2011-02-02 15:21:34 +00:00
tteras
2ee6d137de From Roman Hoog Antink <rha@open.ch>: Clean up sainfo reloading: rename 
the functions, and remove unneeded global variable.
 2011-01-28 13:02:34 +00:00
tteras
5d9b9d50e9 From Roman Hoog Antink <rha@open.ch>: Clean up rmconf reloading: rename 
the functions, and remove unneeded global variable.
 2011-01-28 13:00:14 +00:00
tteras
c54595ebf5 From Roman Hoog Antink <rha@open.ch>: Log remote IP address if available 
(slightly modified by tteras)
 2011-01-28 12:51:40 +00:00
tteras
79764be6dd From Roman Hoog Antink <rha@open.ch>: Fixes a null pointer dereference 
that might occur after removing peers from the config and then reloading.
 2011-01-22 07:38:51 +00:00
vanhu
4d9d52d8fa fixed a typo, it will now compile when KMADDRESS is defined. reported by Roman Hoog Antink (rha (at) open.ch) 2011-01-20 16:08:35 +00:00
tteras
785cabdaf2 From Roman Hoog Antink <rha@open.ch>: Fix config reload to not delete 
too many phase 2 handles, because wrong chain field is used when
enumerating the handles.
 2010-12-28 06:00:18 +00:00
gdt
f1cf9a1e3b When encountering a certificate where "ID mismatched with ASN1 
SubjectName", and verify_identifier is off, don't raise an error.
This makes the behavior match the man page.

Patch sent for review long ago:
  http://mail-index.netbsd.org/tech-security/2006/03/24/0000.html
with no negative feedback received to date.
 2010-12-16 16:59:05 +00:00
tteras
566286569e From Roman Hoog Antink <rha@open.ch>: Fix possible null derefence. 2010-12-14 17:57:31 +00:00
tteras
0303048b1e Use separate SA addresses for phase2's created by admin command. The 
phase2 startup overwrites src/dst with ISAKMP ports if they are zero
and we don't want that to happen for the SA ports.
 2010-12-08 07:38:35 +00:00
joerg
0d0af5032c ANSIfy 2010-12-08 01:55:12 +00:00
tteras
1246e1db41 Fix spacing and improve wording in some log messages. 2010-12-07 14:28:12 +00:00
tteras
b3dca9dae4 Recognize direction for Linux per-socket policies. 2010-12-03 15:01:11 +00:00
tteras
7d13a088be Support GRE key as upper layer protocol specifier (will be supported in 
Linux kernel 2.6.38).
 2010-12-03 14:32:52 +00:00
tteras
3a9671366f Netlink deletion notification does not guarentee actual address deletion: 
it might still exist on some other interface. Make sure we do not unbind
unless the address is really gone.
 2010-12-03 09:46:24 +00:00
tteras
6a6cffd67e Fix my previous patch to not call purge_remote() twice. Change the place 
where purge_remote() is called. This fixes also a possible crash from the
same patch since ph1->remote can be NULL (when we are responder and config
is not yet selected).
 2010-11-17 10:40:41 +00:00
tteras
939a5bdbb6 isakmp_post_acquire is now called from admin commands too, add a flag so 
admin commands can be used to establish even passive links on demand.
 2010-11-12 10:36:37 +00:00
tteras
fafea48525 Purge all IPsec-SA's if the last main ISAKMP-SA for the node is deleted 
by remote request and the phase1 rekeying is enabled (this will also
trigger the new phase1_dead script hook).
 2010-11-12 09:11:37 +00:00
tteras
3d7d638a63 Improve DPD sequence checks to allow any reply within valid sequence window 
to be proof of livelyness. This can improves things if there's random
packet delays, or if racoon is not getting enough CPU time.
 2010-11-12 09:09:47 +00:00
tteras
731159f704 Extern admin protocol to allow reply packets to exceed 64kb. E.g SA dumps 
with many established SAs can be easily over the limit.
 2010-11-12 09:08:26 +00:00
tteras
0a922db186 Change Linux Netlink address monitoring to monitor local route changes. 
This works around a kernel bug, and slightly improves behaviour on some
special cases.
 2010-10-22 06:26:26 +00:00
tteras
84874398b5 Introduce priorities for file descriptor polling mechanism and give 
priority to admin port. If admin port is used by ISAKMP-SA hook scripts
they should be preferred, other wise heavy traffic can delay admin port
requests considerably. This in turn may cause renegotiation loop for
ISAKMP-SA. This is mostly useful for OpenNHRP setup, but can benefit
other setups too.
 2010-10-21 06:15:28 +00:00
tteras
af50f9e5f9 Remove initial-contact entry when all ISAKMP-SA are purged via adminport. 
This will avoid stale security associations if some of the delete
notifications happens to get lost.
 2010-10-21 06:04:33 +00:00
tteras
976b63b0c6 Use high-level openssl EVP and HMAC functions when possible: this allows 
openssl to perform hardware acceleration if available.
 2010-10-20 13:40:02 +00:00
tteras
fa4803bf0a Various improvements to error log messages and a few additional error log 
messages to improve diagnosing an error condition.
 2010-10-20 13:37:37 +00:00
tteras
49a8dd9d23 Fix address comparison so we actually close sockets which were bound to 
IP-address that got deconfigured.
 2010-10-20 10:56:39 +00:00
vanhu
fe1c6ea2f2 report a higher encryption key length in approval for OBEY / CLAIM / STRICT modes 2010-10-11 14:16:30 +00:00
vanhu
45f0ad8281 fixed some typos in logs (reported by fazaeli (at) sepehrs.com) 2010-09-27 11:57:59 +00:00
vanhu
1da0e31bfc fixed a fd leak, patch by getlaser (at) gmail.com 2010-09-24 15:09:29 +00:00
vanhu
23e038ba26 get the correct length of username when processing ADMIN_LOGOUT_USER, patch by rweikusat (at) mssgmbh.com 2010-09-22 13:37:35 +00:00
vanhu
40e858e050 fixed a typo in macros, reported by marisp (at) mt.lv 2010-09-22 07:34:51 +00:00
vanhu
a4e6ec9d93 moved from utmp.h to utmpx.h (patch provided by marcin.cieslak (at) gmail.com) 2010-09-21 13:14:17 +00:00
vanhu
71f4bdc1a9 fixed remoteconf selection when no ID specified in configuration, and added some debug to remoteconf selection 2010-09-08 12:18:35 +00:00
vanhu
12865805af fix by Sergio.Gelato (at) astro.su.se: duplicate some dynamic values in duprmconf() 2010-08-26 13:31:55 +00:00
vanhu
4020e47561 fixed answer for IP4_SUBNET request 2010-08-04 09:16:58 +00:00
vanhu
62c45492f0 updated link to NetBSD's documentation 2010-07-30 14:50:47 +00:00
wiz
432f682f2f Bump date for previous. 2010-06-22 20:51:04 +00:00
vanhu
9049130b27 added a specific script hook when a dead peer is detected 2010-06-22 09:41:33 +00:00
wiz
ee938d1113 New sentence, new line. Bump date for previous. 2010-06-04 21:53:36 +00:00
vanhu
a0bdaf1b16 Added support for spdupdate command in setkey 2010-06-04 13:06:03 +00:00
vanhu
ba30b496b8 by Eric Preston: fixed a typo 2010-04-07 14:53:52 +00:00
christos
bd7ae6bd09 handle ctime returning NULL. 2010-04-02 15:13:26 +00:00
christos
fcbd1014fb PR/42363: Yasuoka Masahiko: Second part of the patch: iterate only on the 
phase2 handles that are bound by the given phase1 handle.
 2010-03-11 15:44:48 +00:00
tteras
e3413574b5 From Stefan Bauer: Fix multiple typoes and manpage formatting errors. 2010-03-05 06:47:58 +00:00
vanhu
709abc828e From Pierre POMES: fixed admin port initialization 2010-03-04 15:13:53 +00:00
snj
ccaf1e96be Fight the ever-increasing size of src checkouts by spelling "useful" 
without an extra l.
 2010-02-28 15:52:16 +00:00
wiz
8e35c759e7 Fix typo in comment. 2010-02-09 23:05:16 +00:00
wiz
e15635055f Free strdeupped string after using it. Found by cppcheck. 2010-01-17 23:03:01 +00:00
wiz
44e3b1fff7 Close file handles after using them. Found by cppcheck. 2010-01-17 23:02:48 +00:00
joerg
0e901e0c61 Use .%U instead of .%O for URLs. 2010-01-15 19:18:51 +00:00
tteras
119e5ecd44 From Paul Wernau: vmbuf.h was defined twice in the headers. Remove the 
redundant entry so new install tool does not complain about overwriting
just installed file.
 2009-12-11 09:04:04 +00:00
christos
aabb31871d PR/42363: Yasuoka Masahiko: 
racoon uses a wrong IPsec-SA handle that is for other peer in case it
receives a ISAKMP message for IPsec-SA that has the same message-id as
the message-id that is received before.

racoon uses message-id to find the handle of IPsec-SA.  The message-id
is a unique number for each peer, but different peers may use the same
value.

Different Windows Vista or Windows 7 peers seem to use the same
message-id.  racoon can handle the first Windows's Phase-2, but it
cannot handle the second Windows.  Because racoon misunderstands the
message for the second Windows as the message for the first Windows.

>Category:       bin
>Synopsis:       racoon uses a wrong IPsec-SA that is for different peer
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 22 18:25:00 +0000 2009
>Originator:     yasuoka@iij.ad.jp
 2009-11-22 19:34:55 +00:00
christos
792f03d2b0 use %option noinput nounput 2009-10-29 14:34:27 +00:00
christos
cd2a002a7a no unput 2009-10-28 20:59:46 +00:00
joerg
4467064d5b Do not use .Xo/.Xc to workaround ancient groff limits. 2009-10-14 23:36:55 +00:00
joerg
a453670196 Do not use .Xo/.Xc to work around ancient groff limits. 
Fix markup.
 2009-10-14 18:34:14 +00:00
joerg
0639ebde24 Don't use .Xo/.Xc to work around ancient groff limits. 
Set only one list type.
 2009-10-14 18:22:04 +00:00
tteras
ff2c7b7d5c From Tomas Mraz: Fix gssapi error checking. 2009-09-18 10:31:11 +00:00
tteras
63bcd231eb When rekeying phase2 use phase1 used to negotiate phase2 as a hint to 
select the phase1 for rekeying the new phase2.
 2009-09-03 09:29:07 +00:00
tteras
ae0beb16dc Check nat_traversal configuration from remote configuration candidates 
when acting as responder. Enable NAT-T if any of the remote candidates
have NAT-T enabled.
 2009-09-01 12:22:09 +00:00
tteras
5e74d5d98f Change remote conf matching level to matching score. This way one can 
override anonymous certificate block config with more exact "inhereted"
IP specific block.
 2009-09-01 09:49:59 +00:00
tteras
43e6802298 From Maik Broemme: export ISAKMP SA identity as REMOTE_ID for phase1 up 
script (trac #313).
 2009-09-01 09:24:21 +00:00
vanhu
b7f72d1283 fixed typo: algoriym -> algorithm 2009-08-24 09:33:03 +00:00
vanhu
a3d9e80f96 fixed address check in rmconf_match_type(), just check address with wildcard port 2009-08-19 13:54:07 +00:00
tteras
95f3bd08bb Have an enum for rmconf_match_type() return values to make the code a bit 
more readable.
 2009-08-19 12:20:02 +00:00
vanhu
e2ffc89458 typo: algoritym -> algorithm 2009-08-18 08:21:12 +00:00
vanhu
eb15fbb554 do not use SADB_X_NAT_T_NEW_MAPPING to check system support for NAT-T, as at least FreeBSD doesn't have this define anymore 2009-08-17 13:52:14 +00:00
vanhu
82dd0659f2 include stddef.h so we have a chance to get the system offsetof if present 2009-08-17 12:00:53 +00:00
vanhu
c2c64af1e8 removed a self include 2009-08-17 11:59:10 +00:00
vanhu
0667dd70bd fixed a potential DoS in oakley_do_decrypt(), reported by Orange Labs 2009-08-13 09:18:28 +00:00
tteras
ea830abf58 Don't print EAGAIN error from pfkey_handler(), it can occur normally 
under some code paths and is not a hard error in any case.
 2009-08-10 08:22:13 +00:00
tteras
c2919dd501 From Paul Wenau: Check fgets return value in setkey to make gcc happy. 2009-08-06 04:44:43 +00:00
tteras
4180506456 From Paul Wernau: Fix transport mode per-port security associations that 
got broke during NAT-T fixes.
 2009-08-05 13:16:01 +00:00
tteras
aab4a00722 From Arnaud Ebalard: Fix possible usage of uninitialized local variable 
(not sure if any code path triggers this, but this makes compiler happy).
 2009-07-07 12:25:22 +00:00
tteras
3d0db58d61 Get rid of the evil CMPSADDR macro. Trac #295. 2009-07-03 06:41:46 +00:00
tteras
edd4f79009 From Yvan Vanhullebus: Use SADB_X_EXT_NAT_T_* consistently for passing the 
NAT-T port information. This might break compatibility with some kernels,
but as discussed this is the proper way to pass NAT-T ports and the broken
kernels need to be fixed.
 2009-07-03 06:40:10 +00:00
tteras
a8d702d9b1 Fix a call to null pointer: in some cases, the unmonitor_fd can be called 
from another fd's callback. That could lead to still have callback pending
after unmonitoring the fd resulting in a call to null pointer.
This is fixed by making unmonitor_fd now clear the pending fd_set too.
Bug was introduced by my commit in 2008-12-23.
 2009-06-24 11:28:48 +00:00
vanhu
f61fedc250 typo 2009-05-20 07:54:50 +00:00
tteras
68ab535bfd From Jukka Salmi: Fix couple of typos from previous commit. 2009-05-19 09:34:52 +00:00
tteras
0ab43f031c From Tomas Mraz: Introduce union sockaddr_any and use it to make code 
more readable. Related to trac #293.
 2009-05-18 17:40:38 +00:00
tteras
ef94861331 From Tomas Mraz: Remove variable that is not really used; only referenced 
while uninitialized causing valgrind error.
 2009-05-18 17:07:15 +00:00
tteras
5e83df8c82 From Tomas Mraz: Fix natt_flags check. 2009-05-18 17:00:42 +00:00
wiz
decd684ac0 Remove superfluous spaces around parentheses. 2009-05-04 22:28:30 +00:00
tteras
ec20a1edf8 From Ross Meng: Fix a memory leak in X509 certificate validation. 2009-04-29 10:50:01 +00:00
tteras
8bcee86f68 Reset nat_oa variables too when reusing phase two handler. Otherwise 
phase2 rekeying might fail in some scenarios.
 2009-04-28 13:54:07 +00:00
tteras
95b420bbeb From Neil Kettle: Fix a possible null pointer dereference in fragmentation 
code.
 2009-04-22 11:24:20 +00:00
tteras
fab62310e7 Fix strict_address to work again. The lists needs to be initialized 
before configuration is read, which happens before my_addr_init() call.
 2009-04-21 18:38:31 +00:00
tteras
7019ec4077 Fix a memory leak in certificate request generation. 2009-04-20 13:24:36 +00:00
tteras
f273c7c2bb Orignally from Bin Li: Fix possible memory corruption in binsanitize(). 2009-04-20 13:23:54 +00:00
tteras
a2f9e36ab3 From Stephen Bevan: Fix a x509 signature verification memory leak. 2009-04-20 13:22:41 +00:00
tteras
b1fd61f62f Originally from Bin Li: Fix a crash with racoonctl logout user. 2009-04-20 13:22:00 +00:00
tteras
8759a6c72c Fix a memory leak in nat-t keepalive code. 2009-04-20 13:17:35 +00:00
tteras
8c22b469e0 From Paul Moore: Phase2 message id's should be unique wrt phase1, not 
globally.
 2009-04-20 13:16:52 +00:00
tteras
0c68acc1de From Arnaud Ebalard: Fix couple of problems with previous commit. 2009-03-13 04:49:16 +00:00
he
976380d183 When casting to/from a pointer to an integral type (a bad practice, 
if you ask me), you need to cast via intptr_t for portability.
 2009-03-12 23:05:27 +00:00
wiz
2df943f931 New sentence, new line. Avoid marking up punctuation. 2009-03-12 15:18:57 +00:00
wiz
0d4480d10a Bump date for previous. Sort options to establish-sa. 
Stop using Xo/Xc.
 2009-03-12 14:01:09 +00:00
tteras
983cc8fecf Support multiple anonymous remotes and decide remoteconf based on identity, 
received certificates and other information. General code clean up.
 2009-03-12 10:57:26 +00:00
tteras
e3372d2f8f setkey: fix deleteall in Linux 
Linux requires SADB_DELETE message to have SPI. So send
a SADB_DELETE message for each matching SA. Trac #284.

From: Gabriel Somlo <somlo@cmu.edu>
 2009-03-06 11:45:03 +00:00