3225 lines
120 KiB
Plaintext
3225 lines
120 KiB
Plaintext
2008-07-21 Timo Teras <timo.teras@iki.fi>
|
||
* src/racoon/cfparse.y : do not set default gss id if xauth is used
|
||
* src/racoon/isakmp_agg.c
|
||
src/racoon/isakmp_base.c
|
||
src/racoon/isakmp_ident.c
|
||
src/racoon/vendorid.c
|
||
src/racoon/vendorid.h : separate generic vendor id handling to
|
||
a new function and use it
|
||
|
||
2008-07-14 Matthew Grooms
|
||
* src/racoon/isakmp_cfg.c : fix hybrid enabled builds
|
||
|
||
2008-07-14 Matthew Grooms
|
||
* src/racoon/crypto_openssl.c
|
||
src/racoon/eaytest.c
|
||
src/racoon/misc.c
|
||
src/racoon/misc.h
|
||
src/racoon/racoonctl.c : fix conflict with freebsd8 hexdump()
|
||
|
||
2008-07-14 Timo Teras <timo.teras@iki.fi>
|
||
* src/racoon/handler.h
|
||
src/racoon/isakmp.c
|
||
src/racoon/isakmp_agg.c
|
||
src/racoon/isakmp_ident.c
|
||
src/racoon/isakmp_inf.c
|
||
src/racoon/isakmp_inf.h
|
||
src/racoon/isakmp_quick.c
|
||
src/racoon/strnames.c : clean ups to notification payload handling,
|
||
and handle INITIAL-CONTACT notification in last main mode exchange
|
||
(delayed) and during quick mode exchanges (Track:264)
|
||
* src/racoon/handler.h
|
||
src/racoon/ipsec_doi.c
|
||
src/racoon/ipsec_doi.h
|
||
src/racoon/isakmp_quick.c
|
||
src/racoon/pfkey.c : handle RESPONDER-LIFETIME notification
|
||
according to proposal check level (Track:265)
|
||
|
||
2008-07-11 Timo Teras <timo.teras@iki.fi>
|
||
Track:259, original patch from Atis Elsts <the.kfx@gmail.com>:
|
||
* src/racoon/isakmp.c, src/racoon/isakmp_inf.c: fix double memfree
|
||
by changing copy_ph1addresses() to not free ph1 on failure
|
||
and remove misplaced remph1() calls causing memory corruption
|
||
|
||
2008-07-09 Timo Teras <timo.teras@iki.fi>
|
||
Track:269, from Chong Peng <chongpeng@gmail.com>:
|
||
* src/racoon/cfparse.y: remove parser initialization causing
|
||
fd leak from cfreparse() since cfparse() initializes it anyway
|
||
|
||
2008-07-02 Yvan Vanhullebus <vanhu@netasq.com>
|
||
Track:266, from Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/isakmp_inf.c: fixed some %d to %zu (size_t values)
|
||
|
||
2008-06-18 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/admin.h
|
||
src/racoon/admin.c
|
||
src/racoon/racoonctl.c
|
||
src/racoon/racoonctl.8 : acquire peer certificate via admin port
|
||
|
||
2008-06-18 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/misc.c
|
||
src/racoon/misc.h
|
||
src/racoon/admin.c
|
||
src/racoon/grabmyaddr.c
|
||
src/racoon/isakmp.c : avoid inherited file descriptor issues
|
||
|
||
2008-06-18 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/grabmyaddr.c
|
||
src/racoon/ipsec_doi.c
|
||
src/racoon/isakmp.c
|
||
src/racoon/isakmp_cfg.c
|
||
src/racoon/isakmp_inf.c
|
||
src/racoon/privsep.c
|
||
src/racoon/remoteconf.c
|
||
src/racoon/admin.c : network port value manipulation cleanup
|
||
|
||
2008-06-18 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/admin.c
|
||
src/racoon/racoonctl.c : admin port code cleanup
|
||
|
||
2008-06-18 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/pfkey.c : correct a phase2 status event
|
||
|
||
2008-05-08 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Christian Hohnstaedt <christian@hohnstaedt.de>:
|
||
* configure.ac: allow out of tree building
|
||
|
||
2008-04-25 Yvan Vanhullebus <vanhu@netasq.com>
|
||
Track:4, from Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/isakmp_inf.c: extract ports information from
|
||
SADB_X_EXT_NAT_T_[SD]PORT if present in purge_ipsec_spi()
|
||
|
||
2008-04-02 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Timo Ter<65>s <timo.teras@iki.fi>
|
||
* src/racoon/{sockmisc.h|sockmisc.c|Makefile.am}: fix Linux build
|
||
after 2008-03-28's change
|
||
|
||
2008-03-28 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Cyrus Rahman <crahman@gmail.com>
|
||
* src/racoon/{sockmisc.c|isakmp.c|isakmp_inf.c|privsep.c|privsep.h}
|
||
src/racoon/Makefile.am: allow interface reconfiguration when
|
||
running in privilege s<>paration mode
|
||
src/racoon/doc/README.privsep: new file on privilege separation
|
||
|
||
2008-03-06 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/oakley.c: Generates a log if cert validation has been
|
||
disabled by configuration.
|
||
|
||
2008-03-06 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Cyrus Rahman <crahman@gmail.com>
|
||
* src/racoon/{privsep.c|session.c}: privilegied instance exit when
|
||
unprivilegied one terminates. Save PID in real root, not in chroot
|
||
|
||
2008-03-05 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/admin.c
|
||
src/racoon/isakmp.c
|
||
src/racoon/isakmp_var.h
|
||
src/racoon/pfkey.c
|
||
src/racoon/racoonctl.c
|
||
src/racoon/racoonctl.8: establish IPsec SAs using the admin socket
|
||
|
||
2008-03-05 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/admin.c
|
||
src/racoon/admin.h
|
||
src/racoon/evt.c
|
||
src/racoon/evt.h
|
||
src/racoon/handler.c
|
||
src/racoon/handler.h
|
||
src/racoon/isakmp.c
|
||
src/racoon/isakmp_agg.c
|
||
src/racoon/isakmp_base.c
|
||
src/racoon/isakmp_cfg.c
|
||
src/racoon/isakmp_ident.c
|
||
src/racoon/isakmp_inf.c
|
||
src/racoon/isakmp_var.h
|
||
src/racoon/isakmp_xauth.c
|
||
src/racoon/racoonctl.8
|
||
src/racoon/racoonctl.c
|
||
src/racoon/session.c: refactor admin socket event protocol to be
|
||
less error prone.
|
||
|
||
2008-03-05 Matthew Grooms
|
||
* src/racoon/cfparse.y: properly initialize the unity network struct
|
||
|
||
2008-03-05 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/pfkey.c
|
||
src/racoon/pfkey.h
|
||
src/racoon/session.c: reload SPD on SIGHUP or adminport reload
|
||
* src/racoon/pfkey.c: better handling for pfkey socket read errors
|
||
|
||
2008-02-25 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Brian Haley <brian.haley@hp.com>
|
||
* src/racoon/ipsec_doi.c: Do check SPI size (it was not due to a typo)
|
||
|
||
2008-02-22 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Brian Haley <brian.haley@hp.com>
|
||
* src/racoon/isakmp.c: Fix address length
|
||
|
||
2008-02-10 S.P.Zeidler <spz@netbsd.org>
|
||
* src/racoon/ipsec_doi.c: fix NetBSD PR bin/37644
|
||
|
||
2008-01-11 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/handler.[ch]: added an 'established' arg to getph1byaddr()
|
||
From Krzysztof Oledzki <olel@ans.pl>:
|
||
* src/racoon/isakmp.c: Only search for established ph1 handles in
|
||
DPD (also reported new getph1byaddr() arg)
|
||
* src/racoon/isakmp_inf.c: added some details to some logs (also
|
||
reported new getph1byaddr() arg)
|
||
* src/racoon/crypto_openssl.c: fixed compilation with idea and
|
||
recent gcc
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/isakmp_inf.c: reset iph1->dpd_r_u in the scheduler's
|
||
callback, to avoid some access to freed memory
|
||
|
||
2007-12-30 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/racoonctl.8
|
||
src/racoon/racoonctl.c: add GRE protocol number to racoonctl
|
||
* src/racoon/policy.c: correct id wildcard matching for transport mode
|
||
* src/racoon/isakmp_inf.c: reset iph1->dpd_r_u in the scheduler's
|
||
callback, to avoid some access to freed memory
|
||
|
||
2007-12-11 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/handler.c
|
||
src/racoon/handler.h
|
||
src/racoon/isakmp_quick.c
|
||
src/racoon/pfkey.c: add support for nat-t oa payload handling.
|
||
|
||
2007-12-04 Matthew Grooms
|
||
From Timo Teras <timo.teras@iki.fi>:
|
||
* src/racoon/ipsec_doi.c
|
||
src/racoon/ipsec_doi.h
|
||
src/racoon/isakmp_quick.c: modify ipsecdoi_sockaddr2id to obtain host
|
||
address without specific prefix legth.
|
||
src/racoon/isakmp_quick.c: correct a memory leak in phase2.
|
||
|
||
2007-11-29 Yvan Vanhullebus <vanhu@netasq.com>
|
||
From Natanael Copa <natanael.copa@gmail.com>:
|
||
* src/racoon/Makefile.am: fixed a race condition when building
|
||
yacc stuff.
|
||
|
||
2007-11-09 Yvan Vanhullebus <vanhu@netasq.com>
|
||
From Arnaud Ebalard <arno@natisbad.org>:
|
||
* src/racoon/pfkey.c: Some sanity check in pk_recv()
|
||
* src/racoon/policy.c: better matching of SPD entries in
|
||
getsp_r().
|
||
* src/racoon/isakmp_quick.c: added some debug in get_proposal_r().
|
||
|
||
2007-10-18 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/{isakmp_unity.[ch]|isakmp_cfg.c|racoon.conf.5}:
|
||
Add SPLITNET_{INCLUDR_LOCAL}_CIDR to hook scripts
|
||
|
||
2007-10-15 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/libipsec/pfkey.c: Try to increase the buffer size of the
|
||
pfkey socket, this may help things when we have a huge SPD.
|
||
|
||
2007-10-02 Yvan Vanhullebus <vanhu@netasq.com>
|
||
From Scott Lamb <slamb@slamb.org>
|
||
* src/racoon/plog.[ch]: new plog macro
|
||
* src/racoon/kmpstat.c: plog changed to _plog to work with new plog macro
|
||
* src/racoon/crypto_openssl.c: includes plog.h to work with the
|
||
new plog macro
|
||
|
||
2007-09-19 Matthew Grooms <mgrooms@shrew.net>
|
||
From Gabriel Somlo <somlo@cmu.edu>
|
||
* src/racoon/isakmp.c: Set REUSE option on sockets to prevent failures
|
||
associated with closing and immediately re-opening.
|
||
|
||
2007-09-19 Matthew Grooms <mgrooms@shrew.net>
|
||
From Gabriel Somlo <somlo@cmu.edu>
|
||
* src/racoon/isakmp_unity.c: Prevent duplicate entries in splitnet list.
|
||
|
||
2007-09-12 Matthew Grooms <mgrooms@shrew.net>
|
||
From Joy Latten <latten@austin.ibm.com>
|
||
* configure.ac: Fix autoconf check for selinux support.
|
||
|
||
2007-09-12 Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/cfparse.y
|
||
src/racoon/cftoken.l
|
||
src/racoon/handler.c
|
||
src/racoon/isakmp_quick.c
|
||
src/racoon/pfkey.c
|
||
src/racoon/sainfo.c
|
||
src/racoon/sainfo.h
|
||
src/racoon/racoon.conf.5 : Implement clientaddr sainfo remote id option
|
||
and cleanup sainfo syntax in the man page.
|
||
|
||
2007-09-05 Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/sainfo.c: Sort sainfos on insert and improve matching logic.
|
||
|
||
2007-09-03 Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/racoon.conf.5: Correct wins4 and nbns4 modecfg option syntax.
|
||
* src/racoon/cftoken.l: Add nbns4 as an alias for wins4.
|
||
|
||
2007-08-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/isakmp_xauth.c: Don't mix up RADIUS authentication and
|
||
authorization ports. Allow interoperability with freeradius
|
||
|
||
2007-07-18 Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/racoon.conf.5: various man page updates
|
||
|
||
2007-07-18 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* configure.ac
|
||
src/libipsec/ipsec_dump_policy.c
|
||
src/libipsec/ipsec_get_policylen.c
|
||
src/libipsec/ipsec_strerror.c
|
||
src/libipsec/key_debug.c
|
||
src/libipsec/libpfkey.h
|
||
src/libipsec/pfkey.c
|
||
src/libipsec/pfkey_dump.c
|
||
src/libipsec/policy_parse.y
|
||
src/libipsec/policy_token.l
|
||
src/libipsec/test-policy-priority.c
|
||
src/racoon/admin.c
|
||
src/racoon/backupsa.c
|
||
src/racoon/cfparse.y
|
||
src/racoon/cftoken.l
|
||
src/racoon/ipsec_doi.c
|
||
src/racoon/isakmp.c
|
||
src/racoon/isakmp_inf.c
|
||
src/racoon/isakmp_quick.c
|
||
src/racoon/pfkey.c
|
||
src/racoon/policy.c
|
||
src/racoon/proposal.c
|
||
src/racoon/remoteconf.c
|
||
src/racoon/sainfo.c
|
||
src/racoon/session.c
|
||
src/racoon/sockmisc.c
|
||
src/racoon/strnames.c
|
||
src/setkey/parse.y
|
||
src/setkey/setkey.c
|
||
src/setkey/token.l:
|
||
use a single PATH_IPSEC_H to fix some path_to_ipsec.h issues.
|
||
|
||
2007-07-16 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/proposal.c: indentation
|
||
* src/racoon/grabmyaddr.c: fixed a socket leak.
|
||
|
||
2007-06-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Paul Winder <Paul.Winder@tadpole.com>:
|
||
* src/racoon/isakmp_cfg.c: Fix ignored INTERNAL_DNS4_LIST
|
||
|
||
2007-06-06 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/handler.c: ignore obsolete lifebyte when validating
|
||
reloaded configuration.
|
||
From Jianli Liu <jlliu@nortel.com>:
|
||
* src/racoon/session.c: speeds up interfaces update when they changed.
|
||
From Rong-En Fan <rafan@freebsd.org>
|
||
* src/racoon/{var.h|eaytest.c}: fixed compilation with gcc 4.2
|
||
|
||
2007-05-31 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Joy Latten <latten@austin.ibm.com>
|
||
* src/racoon/{main.c|policy.h|security.c}: Fix file descriptor
|
||
shortage when using labeled IPsec.
|
||
|
||
2007-05-30 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Jianli Liu <jlliu@nortel.com>:
|
||
* src/racoon/kmpstat.c: Use the specified socket path instead of
|
||
the default location
|
||
|
||
2007-05-04 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/pfkey.c: Force the update of ph2 in pk_recvupdate()
|
||
if NAT_T support, to solve some port match problems with the
|
||
first IPSec SAs negociated as initiator.
|
||
* src/racoon/isakmp_inf.c: added some debug for DELETE_SA process.
|
||
* src/racoon/isakmp.c: added some debug in isakmp_chkph1there() to
|
||
track some port matching problems with NAT-T.
|
||
* src/racoon/handler.c: added some debug in getph1byaddr() to
|
||
track some port matching problems with NAT-T.
|
||
* src/racoon/handler.c: search a ph1 by address if iph2->ph1 is
|
||
NULL when validating the new config.
|
||
|
||
2007-04-04 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/oakley.c: dumps peer's ID and peer's certificate
|
||
subject /subjectaltname if they don't match.
|
||
* src/racoon/ipsec_doi.c: checks proto_id in ipsecdoi_chkcmpids().
|
||
|
||
2007-03-26 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/isakmp_inf.c: Store the DPD main scheduler in ph1
|
||
handler, to be able to cancel it when removing the handler, and
|
||
some minor cleanups in DPD code.
|
||
|
||
2007-03-23 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/{oakley.c|racoon.conf.5}: give more details about
|
||
what is checked when using certificates to authenticate. Patch
|
||
by Cyrus Rahman.
|
||
* src/racoon/handler.c: expire zombie handlers in getph2byid(), to
|
||
avoid situations where we'll never negociate a phase2
|
||
again. Would be better to find out why do we have such zombies !!
|
||
* src/racoon/{ipsec_doi.c|security.c}: fixed a segfault when using
|
||
security labels between a 32bit and a 64bit host. Patch by
|
||
Joy Latten.
|
||
|
||
2007-03-22 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/{ipsec_doi.c|cfparse.y}: fixed subnet check to
|
||
generate IPV4_ADDRESS when needed in sockaddr2id().
|
||
|
||
2007-03-21 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/schedule.h: checks if arg is NULL in SCHED_KILL.
|
||
* src/racoon/{handler.c|isakmp.c|isakmp_inf.c|pfkey.c}: NULL sched
|
||
check is now done in SCHED_KILL.
|
||
|
||
2007-03-15 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/isakmp.c: Consider a negociation timeout when
|
||
retry_counter is <=0 instead of < 0.
|
||
* src/racoon/grabmyaddr.c: enable monitoring of ipv6 addresse
|
||
changes on linux. Patch by Yves-Alexis Perez.
|
||
|
||
2007-02-27 Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/ipsec_doi.c: add logic to match ip address ids to
|
||
ip subnet ids when appropriate. reported by Yvan.
|
||
|
||
2007-02-21 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/ipsec_doi.c: block variable declaration before code
|
||
in ipsecdoi_id2str().
|
||
|
||
2007-02-20 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/{handler.c|isakmp_var.h}: updated delete_spd() calls.
|
||
* src/racoon/isakmp.c: Only delete a generated SPD if it's
|
||
creation date matches the creation date of the SA we are
|
||
currently deleting.
|
||
* src/racoon/{pfkey.c|isakmp_inf.c}: fills creation date of
|
||
generated SPDs.
|
||
* src/racoon/policy.h: added 'created' var.
|
||
* src/racoon/isakmp_inf.c: Removed a debug printf....
|
||
|
||
2007-02-19 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/isakmp.c: Removed a debug printf....
|
||
|
||
2007-02-16 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/ipsec_doi.c: Fixed a %zu in a printf. Reported by
|
||
Olivier Warin.
|
||
|
||
2007-02-15 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* configure.ac: fix typo in SELinux option
|
||
* src/racoon/security.c: missing file from Joy Latten
|
||
|
||
2007-02-15 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/isakmp.c: Fixed the way phase1/2 messages are
|
||
sent/resent, to avoid zombie handles and acces to freed memory.
|
||
* src/racoon/isakmp_inf.c: Just expire a ph1 handle when receiving
|
||
a DELETE-SA instead of calling purge_remote(). Reported by
|
||
"Uncle Pedro" on Sourceforge's bugtracker.
|
||
|
||
2007-02-02 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/cfparse.y: Fixed a check of NAT-T support in libipsec.
|
||
|
||
2007-02-01 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/isakmp_inf.c: When receiving an Isakmp DELETE_SA,
|
||
gets the cookie of the SA to be deleted from payload instead of
|
||
just deleting the Isakmp SA used to protect the informational.
|
||
Problem reported by "unclepedro" on Sourceforge's bugtracker.
|
||
|
||
2006-12-18 Yvan Vanhullebus <vanhu@netasq.com>
|
||
From Joy Latten <latten@austin.ibm.com>
|
||
* src/racoon/crypto_openssl.c: fixed a memory leak
|
||
|
||
---------------------------------------------
|
||
|
||
Branch for 0.7 created (ipsec-tools-0_7-branch)
|
||
|
||
2006-12-11 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/libipsec/{Makefile.am|libpfkey.h|pfkey.c}
|
||
src/racoon/{backupsa.c|pfkey.c}: Bring back API and ABI backward
|
||
compatibility with previous libipsec interface change. Bump
|
||
libipsec minor version. Remove ifdefs in struct pfkey_send_sa_args
|
||
to avoid ABI compatibility lossage.
|
||
* src/libipsec/{libpfkey.h|pfkey.c} src/racoon/cfparse.y: add
|
||
capability flags to detect missing optional feature in libipsec
|
||
|
||
2006-12-10 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Joy Latten <latten@austin.ibm.com>
|
||
* src/racoon/Makefile.am
|
||
src/racoon/doc/README.plainrsa: new file documenting plain RSA auth
|
||
|
||
2006-12-09 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Joy Latten <latten@austin.ibm.com>
|
||
* configure.ac src/libipsec/{libpfkey.h|pfkey.c}
|
||
src/racoon/{Makefile.am|backupsa.c|backupsa.h|cftoken.l|ipsec_doi.c}
|
||
src/racoon/{ipsec_doi.h|isakmp_inf.c|isakmp_quick.c|pfkey.c|policy.c}
|
||
src/racoon/{policy.h|proposal.c|proposal.h|remoteconf.c}: Add
|
||
support for SELinux security contexts. Also cleanup the libipsec
|
||
interface for adding and updating security associations.
|
||
|
||
From Simon Chang <simonychang@gmail.com>
|
||
* src/racoon/racoon.conf.5: More hints about plain RSA authentication
|
||
|
||
2006-12-05 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/proposal.[ch]: Check keys length regarding
|
||
pcheck_level in cmpsatrns().
|
||
* src/racoon/racoon.conf.5: updated man page about what is
|
||
impacted by proposal_check level.
|
||
|
||
2006-11-12 Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/sainfo.c: fix anonymous sainfo selection.
|
||
|
||
2006-10-22 Yvan Vanhullebus <vanhu@netasq.com>
|
||
From Michal Ruzicka <michal.ruzicka@comstar.cz>:
|
||
* src/racoon/{backupsa.c|cfparse.y}: fixed typos.
|
||
|
||
2006-10-19 Yvan Vanhullebus <vanhu@netasq.com>
|
||
From Matthew Grooms:
|
||
* src/racoon/ipsec_doi.[ch]: Added ipsecdoi_chkcmpids() function
|
||
* src/racoon/sainfo.c: uses ipsecdoi_chkcmpids() and changed
|
||
src/dst to loc/rmt in getsainfo().
|
||
|
||
2006-10-09 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/isakmp_unity.c: correctly check read() return (Coverity)
|
||
* src/racoon/proposal.c: Fix memory leak (Coverity)
|
||
|
||
2006-10-06 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Tomoyuki Okazaki <okazaki@kick.gr.jp>
|
||
* configure.ac src/libipsec/pfkey_dump.c
|
||
src/racoon/{algorithm.c|algorithm.h|cftoken.l|crypto_openssl.c}
|
||
src/racoon/{crypto_openssl.h|eaytest.c|ipsec_doi.c|ipsec_doi.h}
|
||
src/racoon/{oakley.h|pfkey.c|racoon.conf.5|strnames.c}
|
||
src/setkey/{setkey.8|test-pfkey.c|token.l}: Camelia cipher
|
||
support (RFC 4312)
|
||
|
||
2006-10-03 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/admin.c: fix endianness issue introduced yesterday
|
||
|
||
2006-10-03 Yvan Vanhullebus <vanhu@netasq.com>
|
||
* src/racoon/{remoteconf.h|sainfo.h}: Added remoteid/ph1id values.
|
||
* src/racoon/{handler.c|isakmp_quick.c|pfkey.c|sainfo.c}: Uses
|
||
remoteid/ph1id values.
|
||
* src/racoon/{cfparse.y|cftoken.l}: Parses remoteid/ph1id values.
|
||
* src/racoon/racoon.conf.5: Added remoteid/ph1id syntax.
|
||
|
||
2006-10-02 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/socketmisc.c: don't use NULL pointer (Coverity)
|
||
* src/racoon/racoonctl.c: don't use NULL pointer (Coverity)
|
||
* src/racoon/proposal.c: don't use NULL pointer (Coverity)
|
||
* src/racoon/pfkey.c: don't use NULL pointer (Coverity)
|
||
* src/racoon/ipsec_doi.c: don't use NULL pointer (Coverity)
|
||
* src/racoon/isakmp.c: don't use NULL pointer (Coverity)
|
||
* src/racoon/oakley.c: don't use NULL pointer (Coverity)
|
||
* src/racoon/admin.c: avoid reusing free'd pointer (Coverity)
|
||
* src/racoon/{admin.c|sockmisc.c}: Fix memory leak (Coverity), refactor
|
||
the code to use port get/set function
|
||
* src/racoon/admin.c: fix memory leak (Coverity)
|
||
* src/racoon/algorithm.c: fix array overrun (Coverity)
|
||
* src/racoon/isakmp_ident.c: Remove dead code (Coverity)
|
||
* src/racoon/isakmp_inf.c: Check for NULL pointer (Coverity)
|
||
* src/racoon/isakmp_base.c: avoid reusing free'd pointer (Coverity)
|
||
|
||
2006-10-01 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/isakmp.c: Avoid using NULL pointer (Coverity)
|
||
* src/racoon/ipsec_doi.c: FIx memory leak (Coverity)
|
||
|
||
2006-09-30 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/isakmp_agg.c: Remove dead code (Coverity)
|
||
* src/racoon/isakmp_cfg.c: Fix memory leak (Coverity)
|
||
* src/racoon/samples/roadwarrior/client/{phase1-up.sh|phase1-down.sh}:
|
||
update the scripts for wrorking around routing problems on NetBSD
|
||
* src/racoon/admin.c: Do not free id and key, as they are used later
|
||
* src/racoon/session.c: Reuse existing code for closing IKE sockets,
|
||
and avoid screwing things by setting p->sock = -1, which is not
|
||
expected (Coverity).
|
||
|
||
2006-09-29 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/racoonctl.c: Fix the previous fix
|
||
|
||
2006-09-28 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/racoonctl.c: Fix access after free (Coverity)
|
||
* src/racoon/isakmp_xauth.c: Fix unchecked mallocs (Coverity)
|
||
|
||
2006-09-26 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/admin.c: Fix memory leaks in racoonctl (Coverity)
|
||
* src/racoon/admin.c: Remove dead code (Coverity)
|
||
* src/racoon/backupsa.c: Fix memory leak (Coverity)
|
||
* src/racoon/cfparse.y: Fix memory leak (Coverity)
|
||
|
||
From Jeff Bailey:
|
||
* src/racoon/{pfkey.c|proposal.c}: fix SA bundle (e.g.: ESP+IPcomp)
|
||
|
||
From Matthew Grooms:
|
||
* src/racoon/ipsec_doi.c: fix buffer overflow
|
||
|
||
2006-09-25 Yvan Vanhullebus <vanhu@NetBSD.org>
|
||
Reported by Yves-Alexis Perez:
|
||
* src/racoon/isakmp.c: struct ip -> struct iphdr for Linux.
|
||
|
||
2006-09-15 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Matthew Grooms:
|
||
* src/racoon/ipsec_doi.c: fix double free
|
||
|
||
2006-09-21 Yvan Vanhullebus <vanhu@NetBSD.org>
|
||
Reported by Yves-Alexis Perez:
|
||
* src/libipsec/pfkey.c: use sysdep_sa_len to make it compile on
|
||
Linux.
|
||
|
||
2006-09-19 Yvan Vanhullebus <vanhu@NetBSD.org>
|
||
* src/racoon/isakmp.c: always include some headers, as they are
|
||
required even without NAT-T.
|
||
From Larry Baird:
|
||
* src/libipsec/pfkey_dump.c, src/setkey/token.l: define
|
||
SADB_X_EALG_AESCBC as SADB_X_EALG_AES if needed.
|
||
* src/racoon/crypto_openssl.c: some printf() -> plog().
|
||
From Yves-Alexis Perez:
|
||
* src/racoon/proposal.c: fixed default value for encmodesv in
|
||
set_proposal_from_policy().
|
||
|
||
2006-09-18 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Matthew Grooms:
|
||
* src/racoon/{cfparse.y|cftoken.l|isakmp.c|isakmp_frag.h}
|
||
src/racoon/{racoon.conf.5|remoteconf.c}: ike_frag force option to
|
||
force the use of IKE on first packet exchange (prior to peer consent)
|
||
|
||
2006-09-18 Yvan Vanhullebus <vanhu@NetBSD.org>
|
||
* src/racoon/{cfparse.c|cftoken.c|prsa_par.c|prsa_tok.c}
|
||
rpm/suse/ipsec-tools.spec: removed those files from the CVS,
|
||
as they are generated during the build.
|
||
|
||
2006-09-18 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Matthew Grooms:
|
||
* src/racoon/isakmp.c: handle IKE frag used in the first packet.
|
||
|
||
2006-09-16 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Matthew Grooms:
|
||
* src/racoon/ipsec_doi.c: Trivial bugfix in RFC2407 4.6.2 conformance
|
||
|
||
2006-09-15 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/ipsec_doi.c: fix build on Linux
|
||
|
||
---------------------------------------------
|
||
|
||
Migration to cvs.netbsd.org
|
||
|
||
2006-08-22 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Matthew Grooms:
|
||
* src/racoon{cfparse.y|cftoken.l|isakmp_cfg.c|isakmp_cfg.h}
|
||
src/racoon{isdakmp_quick.c|isakmp_xauth.c|isakmp_xauth.h}
|
||
src/racoon/racoon.conf.5: Add a group check option
|
||
|
||
2006-08-17 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
Patch from Matthew Grooms:
|
||
* src/racoon/ipsec_doi.c: fixed an ASN1 size in
|
||
ipsecdoi_checkid1()
|
||
|
||
2006-08-11 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
Patch from Matthew Grooms:
|
||
* src/racoon/ipsec_doi.[ch]: fixed and public ipsecdoi_id2str()
|
||
* src/racoon/isakmp_quick.c: text fix
|
||
* src/racoon/pfkey.c: sainfo debug
|
||
* src/racoon/sainfo.c: sainfo debug
|
||
|
||
2006-07-17 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
Reported by Matthew Grooms:
|
||
* src/racoon/isakmp_quick.c: Fixed iph2->id / id_p checks in
|
||
get_sainfo_r().
|
||
* src/racoon/racoon.conf.5: updated man page for sainfo logic.
|
||
|
||
2006-07-31 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/{cfparse.y|isakmp_cfg.c|isakmp_cfg.h}
|
||
src/racoon/{isakmp_unity.c|isakmp_unity.h}: splinet support
|
||
becomes dynamic, bugfixes
|
||
|
||
2006-07-19 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Peter Eisch <peter@boku.net>
|
||
* src/racoon/samples/roadwarrior/client/phase1-up.sh: add missing
|
||
netmask in network interface configuration
|
||
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* configure.ac src/racoon/isakmp_xauth.c: update the LDAP API usage
|
||
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/{cfparse.y|cftoken.l|isakmp_cfg.c|isakmp_cfg.h}
|
||
src/racoon/{isakmp_cfg.c|isakmp_unity.c|racoon.conf.5}: Split DNS
|
||
support (server side)
|
||
|
||
2006-07-17 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/libipsec/pfkey.c: Fixed SADB_X_EXT_SEC_CTX support in pfkey_align().
|
||
Break reported by Matthew Grooms.
|
||
|
||
2006-07-13 Frederic Senault <fred@lacave.net>
|
||
|
||
* src/racoon/isakmp_cfg.c: fix a typo that rendered DNS4 / WINS4
|
||
unoperable on 64bit architectures ; add a packetdump of MODE_CFG
|
||
exchange in debug mode.
|
||
|
||
2006-07-09 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon{cfparse.y|cftoken.l|isakmp_quick.c|isakmp_xauth.c}
|
||
src/racoon{isakmp_xauth.h|racoon.conf.5|sainfo.c|sainfo.h}:
|
||
Group authentication for Xauth. Supports system groups and LDAP.
|
||
|
||
2006-07-04 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/nattraversal.c: fixed a malloc check in
|
||
natt_keepalive_add(). Patch from Bruno Wagenseil.
|
||
|
||
2006-06-30 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{cfparse.l|cftoken.l}: meaningful error message when
|
||
we cannot find the configuration file.
|
||
|
||
2006-06-24 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon{cfparse.y|cftoken.l|isakmp_cfg.c|isakmp_cfg.h}
|
||
src/racoon/{isakmp_xauth.c|isakmp_xauth.h|racoon.conf.5}: network
|
||
configuration obtained from LDAP directory
|
||
|
||
2006-06-23 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* configure.ac: build fixes
|
||
|
||
2006-06-22 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/evt.c: build fix
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* configure.ac: build fixes around libldap and libiconv search
|
||
|
||
2006-06-21 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/evt.c: Do not record events if admin socket is
|
||
disabled.
|
||
|
||
2006-06-20 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* configure.ac: Check for conflicts between system libiconv
|
||
and newer libiconv header
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* configure.ac src/racoon/{cfparse.y|cftoken.l}
|
||
src/racoon/{isakmp_cfg.h|isakmp_xauth.c|isakmp_xauth.h}
|
||
src/racoon/{main.c|racoon.conf.5}: Use LDAP for Xauth
|
||
|
||
2006-06-20 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* configure.ac: fixed SHA256 detection on some systems. Patch by
|
||
Dmitry Andrianov.
|
||
* src/racoon/{cfparse.y|cftoken.l|plog.[ch]|racoon.conf.5}:
|
||
changed logging levels. Patch by Michal Ruzicka.
|
||
|
||
2006-06-15 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/main.c: make sure RADIUS is correctly initialized
|
||
|
||
2006-06-14 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* Makefile.am, src/Makefile.am: fixed make dist on *BSD
|
||
|
||
2006-06-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/isakmp_cfg.c: Fix build.
|
||
|
||
2006-05-26 Emmanuel Dreyfus <manu@netbsd.org>
|
||
From Pawel Jakub Dawidek <pjd@FreeBSD.org>
|
||
* src/racoon/handler.c: Fix a crash caused by a NULL pointer
|
||
* src/racoon/oakley.c: Typos
|
||
* src/racoon/isakmp_base.c: Fix uninitialized buffer
|
||
* src/racoon/isakmp_base.c: Do send DPD VID in resp case (base mode)
|
||
|
||
2006-05-23 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/isakmp_cfg.c: Mode cfg can be used without Xauth, so
|
||
do not assume Xauth when preparing a hook script environement.
|
||
From chunkeey@web.de
|
||
* src/racoon/{algorithm.c|oakley.c|gssapi.c|ipsec_doi.c}: Fix amd64
|
||
build warnings
|
||
* src/racoon/ipsec_doi.c: Don't free a referenced buffer
|
||
From Matthew Grooms <mgrooms@shrew.net>
|
||
* src/racoon/isakmp_cfg.c: Fix for unity local_lan support
|
||
|
||
2006-05-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
* src/racoon/{isakmp.c|session.c|sockmisc.c|racoon.conf.5}: Do
|
||
not reconfigure interface sockets when running in privilege
|
||
separation as it will not work. Add debug for setsockopt().
|
||
* src/racoon/racoonctl.8: Do not tell config reload is completely
|
||
broken (it's only somewhat broken).
|
||
|
||
2006-05-06 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{remoteconf.c|remoteconf.h|isakmp.c|cfparse.y}: Fix
|
||
memory leak (Coverity)
|
||
* src/racoon/pfkey.c: Fix memory leak (Coverity)
|
||
* src/racoon/ipsec_doi.c: Fix memory leak (Coverity)
|
||
* src/racoon/isakmp.c: Fix memory leak (Coverity)
|
||
* src/racoon/dnssec.c: Fix memory leak (Coverity)
|
||
* src/racoon/backupsa.c: Fix memory leak (Coverity)
|
||
* src/racoon/{nattraversal.c|isakmp.c|cfparse.y}: Check for non NULL
|
||
allocation (Coverity)
|
||
* src/racoon/isakmp_quick.c: Remove dead code (Coverity)
|
||
* src/racoon/oakley.c: Remove dead code (Coverity)
|
||
* src/racoon/crypto_openssl.c: Remove dead code (Coverity)
|
||
|
||
2006-05-05 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/pfkey.c: Sets NAT-T ports to 0 if no NAT
|
||
encapsulation in pk_sendgetspi().
|
||
|
||
2006-05-04 Yvan Vanhullebus <vanhu@netasq.com>
|
||
From Preggna S (spreggna@novell.com)
|
||
* src/racoon/schedule.h: fixed gnuc.h include.
|
||
* src/racoon/{cfparse.y|cftoken.l}: Address range sainfos support.
|
||
* src/racoon/ipsec_doi.[ch]: ipsecdoi_sockrange2id() function.
|
||
|
||
2006-05-03 Yvan Vanhullebus <vanhu@netasq.com>
|
||
From Joy Latten <latten@austin.ibm.com>
|
||
* configure.ac: security context support check
|
||
* src/libipsec/{pfkey.c|pfkey_dump.c}:
|
||
SADB_X_EXT_PACKET / SADB_X_EXT_SEC_CTX support
|
||
* src/setkey/{parse.ytoken.l}: parses optionnal security context
|
||
* src/setkey/setkey.8: security context syntax
|
||
|
||
2006-04-27 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{remoteconf.c|proposal.c}: fix memory leak (Coverity)
|
||
|
||
2006-04-24 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/isakmp.c: style cleanup in delete_spd()
|
||
|
||
2006-04-13 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/pfkey.c: Sets NAT-T ports to 0 if no NAT
|
||
encapsulation in pk_sendupdate().
|
||
|
||
2006-04-12 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/ipsec_doi.c: fix memory leaks (Coverity)
|
||
|
||
2006-04-06 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{admin.c|cfparse.y|cftoken.l|debugrm.c|debugrm.h}
|
||
src/racoon/{gcmalloc.h|isakmp.c|isakmp_inf.c|isakmp_xauth.c}
|
||
src/racoon/{logger.c|misc.h|plog.c|racoonctl.c|sockmisc.c}: Add
|
||
strdup in the malloc debugging framework, check for strdup failures
|
||
(found by Coverity)
|
||
* src/racoon/admin.c: Do not use an unallocated pointer (Coverity)
|
||
* src/racoon/schedule.c: Check for NULL pointer
|
||
* src/racoon/{grabmyaddr.c|handler.c|isakmp.c|isakmp_cfg.c}
|
||
src/racoon/{isakmp_inf.c|isakmp_quick.c|nattraversal.c}: Check
|
||
that dupsaddr returns non NULL pointers (Coverity)
|
||
* src/racoon/isakmp_quick.c: Ignore multiple notifications in the
|
||
same message, and do not leak memory (Coverity)
|
||
* src/racoon/{isakmp_agg.c|isakmp_ident.c}: Fix memory leak in
|
||
GSSAPI code (Coverity)
|
||
* src/racoon/racoonctl.c: fix minor memory leak (Coverity)
|
||
* src/racoon/isakmp.c: fix memory leak (Coverity)
|
||
* src/racoon{isakmp.c|isakmp_inf.c}: fix phase 1 handler leak (Coverity)
|
||
|
||
2006-04-05 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_xauth.c: fix unitialized variable, found by
|
||
Coverity
|
||
* src/racoon/{isakmp_cfg.c|isakmp_xauth.h|isakmp_xauth.c}: Do not
|
||
use deleted phase 1 handler after errors, found by coverity
|
||
* src/racoon/main.c: tell which config file we use
|
||
* src/racoon/isakmp_cfg.c: Do not use deleted phase 1 handler, found
|
||
by Coverity
|
||
* src/racoon/{isakmp_agg.c|isakmp_ident.c}: Do not use deleted phase 1
|
||
handler, found by Coverity
|
||
* src/racoon/dnssec.c: do not return a free'ed certificate, found by
|
||
Coverity
|
||
* src/racoon/oakley.c: fix stale pointer alias, found by Coverity
|
||
* src/racoon/throttle.c: do not free current item while walking a
|
||
chained list, found by Coverity
|
||
* src/racoon/vmbuf.c: handle NULL argument for vdup, found by Coverity
|
||
|
||
2006-03-18 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From John Nemeth <jnemeth@victoria.tc.ca> and a Coverity scan
|
||
* src/racoon/isakmp_xauth.c: fix memory leak
|
||
|
||
2006-02-25 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Thomas Klausner <wiz@NetBSD.org>
|
||
* src/racoon/{cfparse.y|handler.h}: typos
|
||
|
||
2006-02-23 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/main.c: do not reset isakmp_cfg structure after
|
||
config reload.
|
||
|
||
2006-02-22 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/vendorid.c: Fixed Vendor IDs order (well, should not
|
||
be really necessary) and DPD VId hash generation
|
||
|
||
2006-02-17 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/{cfparse.y|sainfo.c}: Support for "semi anonymous"
|
||
sainfos.
|
||
* src/racoon/racoon.conf.5: updated sainfos syntax
|
||
* src/racoon/vendorid.[ch]: IPSec-Tools Vendor ID
|
||
|
||
2006-02-15 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/{cfparse.y|cftoken.l}: Parse new generate_policy
|
||
levels
|
||
* src/racoon/remoteconf.h: defines for REQUIRE/UNIQUE/NONE
|
||
generate policy levels
|
||
* src/racoon/proposal.c: Sets optionnal reqid for generated
|
||
policies
|
||
* src/racoon/pfkey.c: sends UNIQUE policies to kernel if reqid
|
||
specified
|
||
* src/racoon/racoon.conf.5: updated generate_policy syntax
|
||
|
||
2006-02-02 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/isakmp.c: Fixed zombie PH1 handler when isakmp_send()
|
||
fails in isakmp_ph1resend()
|
||
|
||
2006-01-17 Frederic Senault <fred@lacave.net>
|
||
|
||
* src/racoon/cfparse.y: Add the keyid [ (tag|file) ] semantics to the
|
||
peers_identifier keyword.
|
||
|
||
* src/racoon/{evt.h|isakmp.c|racoonctl.c}: Send a message to the
|
||
adminsock to allow for racoonctl to stop looping when the
|
||
vpn-connect command is used and there is no mode config exchange.
|
||
|
||
2006-01-08 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_cfg.c: make software behave as the documentation
|
||
advertise for INTERNAL_NETMASK4. Keep the old INTERNAL_MASK4 to
|
||
avoid breaking backward compatibility.
|
||
|
||
2005-12-19 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/session.c: Fixed / cleaned up signal handling.
|
||
|
||
2005-12-13 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/libipsec/samples/*: replaced "obey" mode by "strict" mode.
|
||
|
||
2005-12-07 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/libipsec/pfkey_dump.c: fixed compilation when NAT_T
|
||
disabled (Fred has still some CVS problems).
|
||
* src/racoon/session.c: Calls isakmp_cfg_init() only if
|
||
ENABLE_HYBRID in reload_conf().
|
||
|
||
2005-12-04 Frederic Senault <fred@lacave.net>
|
||
|
||
* src/libipsec/{libpfkey.h|pfkey_dump.c}: add a sadump_withports
|
||
function to display SAD entries with their associated ports.
|
||
* src/setkey/{parse.y|setkey.c|setkey.8}: allow to use setkey -p flag
|
||
in conjunction with -D to show SADs with the port, allow both get and
|
||
delete commands to use bracketed ports if needed.
|
||
|
||
2005-11-26 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/session.c: fix possible race conditions in signal handlers
|
||
* src/racoon/{isakmp_cfg.c|isakmp_cfg.h|main.c|session.c}: when
|
||
reloading configuration, do not new add mode_cfg config to the
|
||
existign one, overwrite it instead.
|
||
|
||
2005-11-25 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Thomas Klausner <wiz@netbsd.org>
|
||
* src/racoon/racoon.conf.5: Style changes
|
||
|
||
2005-11-21 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/isakmp_[ident|agg].c: Check if natt is available when
|
||
receiving a NAT_D payload from initiator. It saves a crash,
|
||
reported by Dave Huang to NetBSD.
|
||
|
||
2005-11-20 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/isakmp_agg.c: Check that we got some needed payloads
|
||
from peer (could cause a DoS). Crash reported by Adrian Portelli
|
||
using IKE test suite from
|
||
http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/isakmp/
|
||
|
||
2005-11-10 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
Patches from Francis Dupont
|
||
* src/libipsec/key_debug.c: SADB_X_EXT_PACKET support
|
||
* src/libipsec/{libpfkey.h|pfkey.c}: pfkey_send_migrate() function
|
||
* src/setkey/parse.y: IPPROTO_MH support
|
||
* src/racoon/pfkey.c: fixed some logs
|
||
* src/racoon/strnames.c: fixed a typo for SADB_X_PROMISC,
|
||
appropriate define for SADB_X_NAT_T_NEW_MAPPING, added
|
||
SADB_X_MIGRATE
|
||
|
||
2005-11-06 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/main.c, src/racoon/session.c: moved .pid file writing
|
||
just before main loop. Thanks Stephen Thorne
|
||
* src/racoon/localconf.h, src/racoon/cftoken.l: introduced
|
||
path pidfile directive
|
||
* src/racoon/racoon.conf.5: documented above
|
||
* configure.ac: OpenSSL 0.9.8 compilation fix. Thank Ganesan
|
||
Rajagopal
|
||
* configure.ac: added check for strlcat function
|
||
* src/racoon/misc.h: define strlcat function for systems without one
|
||
* src/racoon/remoteconf.c: strncat -> strlcat
|
||
|
||
2005-11-01 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/isakmp_inf.c: repeated gcc-4.0 build fix. Thanks
|
||
Andreas Tobler
|
||
|
||
2005-10-30 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
Patches from Christoph Nadig for compilation on MacOS X
|
||
* configure.ac: no lcrypt for darwin
|
||
* src/libipsec/key_debug.c: include stdint.h if HAVE_STDINT_H
|
||
* src/racoon/isakmp_cfg.c: some includes and some %zu
|
||
* src/racoon/isakmp_unity.c: fixed a %zu
|
||
* src/racoon/vmbuf.h: vfree already defined for Apple
|
||
|
||
2005-10-17 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
Introduced subnet sainfo type.
|
||
* src/racoon/cftoken.l: new token "subnet"
|
||
* src/racoon/cfparse.y: added address/subnet diferentiation logic
|
||
* src/racoon/ipsec-doi.h: new constant
|
||
* src/racoon/ipsec-doi.c: adopted to above
|
||
* src/racoon/racoon.conf.5: documented above
|
||
|
||
2005-09-14 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/libipsec/pfkey.c: One forgotten cast caddr_t -> void *
|
||
|
||
2005-10-14 Yvan Vanhullebus <vanhu@netasq.com>
|
||
|
||
* src/racoon/ipsec_doi.c: don't allow NULL or empty FQDNs or
|
||
USER_FQDNs (problem reported by Bernhard Suttner).
|
||
|
||
2005-09-10 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon[isakmp.c|isakmp_cfg.c|isakmp_inf.c}
|
||
src/racoon/doc/FAQ configure.ac: Add --enable-broken-natt for
|
||
kernel implementing NAT-T but unable to cope with IKE ports in
|
||
SAD and SPD.
|
||
|
||
2005-09-05 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Wilfried Weissmann:
|
||
* src/libipsec/policy_parse.y src/racoon/oakley.c
|
||
src/racoon/{sockmisc.c|sockmisc.h}: build fixes
|
||
|
||
|
||
2005-09-03 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Francis Dupont <Francis.Dupont@enst-bretagne.fr>
|
||
* src/libipsec/pfkey.c src/racoon/pfkey.c: Cope with extensions
|
||
|
||
2005-08-26 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/evt.c: Fix memory leak when event queue overflows
|
||
|
||
2005-08-23 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{isakmp_agg.c|isakmp_ident.c|isakmp_base.c}: Correctly
|
||
initialize NAT-T VID to avoid freeing unallocated stuff.
|
||
|
||
2005-08-21 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Matthias Scheler <matthias.scheler@tadpole.com>
|
||
* src/racoon/{isakmp_cfg.c|racoon.conf.5}: enable the use of
|
||
ISAKMP mode config without Xauth.
|
||
|
||
2005-08-16 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Thomas Klausner <wiz@netbsd.org>
|
||
* src/setkey/setkey.8: remove trailing whitespaces
|
||
|
||
2005-09-09 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/policy.c: Do not parse all sptree in inssp() if we
|
||
don't use Policies priority.
|
||
|
||
2005-08-20 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/handler.c: Fixed a possible crash in
|
||
remove_ph2(). Reported by Dietmar Eggemann.
|
||
|
||
2005-08-14 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Francis Dupont <Francis.Dupont@enst-bretagne.fr>
|
||
* src/racoon/dnssec.c: fix bogus test on function result
|
||
|
||
2005-08-11 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp.c: Improved in/out SA addresses check in
|
||
purge_remote(). Reported by Patrick Ma.
|
||
|
||
2005-08-08 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/libipsec/{key_debug.c|pfkey.c|pfkey_dump.c}: de-lint, warnings
|
||
|
||
2005-08-08 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/privsep.c: Fixed a %d -> %zu in
|
||
port_check() (reported by Matthias Scheler).
|
||
|
||
2005-08-04 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* configure.ac: correctly quote RACOON_PATH_LIBS arguments
|
||
|
||
2005-08-02 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_inf.c: First fix to
|
||
info_recv_initialcontact(): do a basic IP check when no NAT-T.
|
||
|
||
2005-07-26 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp.c: Fixed purge_remote()
|
||
|
||
2005-07-25 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp.c: Do not purge IPSec SAs in purge_remote() if
|
||
a new ph1handle exists (patch by Krzysztof Oledzki)
|
||
|
||
2005-07-20 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* configure.ac: disabled --enable-samode-unspec under linux
|
||
|
||
2005-07-20 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_quick.c: Ignore NATOA payloads in
|
||
quick_r1recv() as it is done in quick_i2recv().
|
||
* configure.ac: new --enable-fastquit option
|
||
* src/racoon/session.c: new code optional code when flushing SAs,
|
||
which is faster and should have no deadlocks. configure
|
||
--enable-fastquit option to enable it.
|
||
|
||
2005-07-19 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp.c: Checks in isakmp_ph1begin_r() if we got the
|
||
packet from NAT-T port, and set up the NAT_PORTS_CHANGED in that
|
||
case (RFC 3947, sect 4, we MUST allow new phase1 negociations on
|
||
NAT-T floated port), to correctly generate the reply.
|
||
|
||
2005-07-16 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/grabmyaddr.c: fixed file descriptor leak. Thanks to
|
||
Patrice Fournier
|
||
* src/racoon/setkey.c: disabled readline's filename completion
|
||
(bug 1179281 fix)
|
||
* src/racoon/proposal.c: fixed mode selection for SAs with
|
||
complex_bundle on behind NAT
|
||
|
||
2005-07-14 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/handler.c: - Clears the DPD schedule in delph1()
|
||
- Cleared up sanity checks in delph1()
|
||
- Sets p->rmconf to NULL if no new
|
||
remoteconf in revalidate_ph1tree_rmconf()
|
||
* src/racoon/isakmp.c: Added sanity checks in script_hook()
|
||
* src/racoon/oakley.c: Sanity check in save_certbuf()
|
||
|
||
|
||
2005-07-13 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/setkey/Makefile.am: missing file in distribution
|
||
|
||
2005-07-12 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp.c: Fixed a mem leak in isakmp_send().
|
||
|
||
2005-07-12 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/pfkey.c: Set IKE ports to 0 in the SA when NAT-T is not
|
||
used.
|
||
* src/racoon/{crypto_openssl.c|ipsec_doi.c|oakley.c} configure.ac
|
||
src/racoon/missing/crypto/sha2/sha2.h: Support OpenSSL-0.9.8
|
||
* src/racoon/{admin.c|session.c}: Don't use the adminport if it is
|
||
disabled
|
||
* src/racoon/samples/roadwarrior/client/{pahse1-up.sh|phase1-down.sh}:
|
||
Add comments for using the scripts without NAT-T
|
||
|
||
2005-07-11 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/ipsec_doi.c configure.ac: More build fixes on Linux.
|
||
Accomodate various libiconv versions
|
||
|
||
2005-07-10 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/ipsec_doi.c configure.ac: build fixes on Linux.
|
||
Accomodate various libiconv versions
|
||
|
||
2005-07-09 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/crypto_openssl.c: Fixed evp_crypt when using crypto
|
||
algorithms with variable key size but not OpenSSL default key
|
||
size.
|
||
|
||
2005-07-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Mathias Scheler <tron@netbsd.org>
|
||
* src/racoon/raccon.conf.5: Document that aes can be used in
|
||
racoon.conf
|
||
|
||
2005-07-06 Frederic Senault <fred@lacave.net>
|
||
|
||
* src/setkey/setkey.c: fix compilation with readline.
|
||
* src/racoon/oakley.c: move declarations to fix compilation issues
|
||
with gcc 2.95.4/FreeBSD4, re-indentation and style cleanup of the
|
||
pkcs7 patch.
|
||
|
||
2005-07-04 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_inf.c: safety checks on informational messages
|
||
* src/racoon/{pfkey.c|proposal.c}: IPcomp fixes
|
||
|
||
2005-07-01 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Uri Blumenthal <urimobile@optonline.net>:
|
||
* src/racoon/{ipsec_doi.c|Makefile.am}: Linux build fixes
|
||
* src/racoon/oakley.c: pkcs7 support
|
||
|
||
2005-06-29 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Christos Zoulas <christos@zoulas.com>
|
||
* configure.ac src/setkey/{parse.y|setkey.c|token.l}
|
||
src/libipsec/{ipsec_dump_policy.c|ipsec_get_policylen.c|key_debug.c}
|
||
src/libipsec/{libpfkey.h|pfkey_dump.c|policy_parse.y}: de-lint,
|
||
using void * instead of caddr_t and adding const where appropriate.
|
||
* src/setkey/extern.h: new file
|
||
* src/libipsec/{pfkey.c|pfkey_dump.c|policy_parse.y}
|
||
src/racoon/{sockmisc.c|sockmisc.h}: de-lint signed/unsigned,
|
||
size_t/int and lint constants
|
||
|
||
2005-06-24 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/handler.c: Fixed phase2 enc algo check when reloading
|
||
conf (could flush a phase2 handler when not needed).
|
||
|
||
2005-06-19 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{admin.c|handler.c|handler.h|racoonctl.c|racoonctl.h}
|
||
src/racoon/racoonctl.8:
|
||
Add a logout-user command to racoonctl to kick out all SA for a
|
||
given Xauth user
|
||
|
||
From Ludo Stellingwerff <ludo@protactive.nl>:
|
||
* src/racoon/isakmp.c: NAT-T fix: We treat null ports in SPD as
|
||
wildcard so that IKE ports are used instead. This was done on
|
||
phase 2 initiation from the kernel (acquire message), but not
|
||
on phase 2 initiation retries when the phase 2 had been queued
|
||
for a phase 1.
|
||
|
||
From Uri Blumenthal <urimobile@optonline.net>
|
||
and Larry Baird <lab@gta.com>:
|
||
* src/libipsec/pfkey_dump.c src/setkey/test-pfkey.c
|
||
src/racoon/{algorithm.c|cftoken.l|eaytest.c|ipsec_doi.c}
|
||
src/racoon/{ipsec_doi.h|pfkey.c|strnames.c}: Add SHA2 support
|
||
* src/setkey/setkey.8 src/racoon/racoon.conf.5: update doc for SHA2
|
||
* src/setkey/token.l: Add aliases shaxxx for sha2_xxx
|
||
|
||
2005-06-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Larry Baird <lab@gta.com>
|
||
* src/racoon/isakmp.c: consume NAT keepalive data already seen
|
||
with MSG_PEEK
|
||
|
||
2005-06-07 Frederic Senault <fred@lacave.net>
|
||
|
||
* configure.ac src/racoon/{cfparse.y|isakmp_cfg.h|isakmp_cfg.c}
|
||
src/racoon/{handler.c|privsep.c|privsep.h|racoon.conf.5}: Add
|
||
support for system accounting into the utmp files, with the
|
||
"accounting system" directive.
|
||
|
||
* src/privsep.c: Bug fixes in the xauth password handling code.
|
||
|
||
2005-06-06 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_quick.c: endianness bug fix
|
||
|
||
2005-06-05 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Thomas Klausner <wiz@netbsd.org>
|
||
* src/setkey/setkey.8 src/racoon/racoon.conf.5: remove trailing
|
||
spaces, grammar fix
|
||
|
||
2005-05-31 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/ipsec_doi.c: Inserted missing 0th element of
|
||
rm_idtype2doi array. Bug #1199700 fix.
|
||
|
||
2005-05-30 Frederic Senault <fred@lacave.net>
|
||
|
||
* src/racoon/oakley.h: Fix a typo in the RMAUTHMETHOD macro
|
||
definition.
|
||
|
||
* src/racoon/isakmp_cfg.c: Fix the switch so that the phase1 script
|
||
is executed at the end of the mode cfg exchange ; add a debug
|
||
message at the script startup.
|
||
|
||
2005-05-23 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/admin.c: build fix
|
||
|
||
2005-05-20 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Mike Robinson <sundialservices@users.sourceforge.net>
|
||
* src/racoon/isakmp_xauth.c: really delete phase 1 on Xauth failure
|
||
|
||
* src/libipsec/pfkey.c src/racoon/ipsec_doi.c: Fix NAT-T + IPcomp
|
||
|
||
From hgates <hgates.lists@gmail.com>
|
||
* src/racoon/proposal.c: fix SPI size test for IPcomp
|
||
|
||
From Larry Baird <lab@gta.com>
|
||
* src/racoon/{handler.c|ipsec_doi.c}: When altering lifetime,
|
||
duplicate the proposal instead of modifying the configured one.
|
||
|
||
2005-05-19 Frederic Senault <fred@lacave.net>
|
||
|
||
* configure.ac src/racoon/plog.c: Fix the logging functions to work
|
||
around the lack of support of printf %zu in FreeBSD 4 (at least).
|
||
|
||
* src/racoon/{isakmp.c|pfkey.c}: Put sockets in non-blocking mode to
|
||
fix a hangup with FreeBSD 4.
|
||
|
||
* src/racoon/{isakmp_inf.c|isakmp_unity.h|strnames.c}: Recognize a
|
||
unity-specific heartbeat message.
|
||
* src/racoon/isakmp_inf.c: Reorganize switch statement in
|
||
isakmp_check_notify.
|
||
|
||
2005-05-17 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/handler.c: Fixed exchange type check in
|
||
revalidate_ph1().
|
||
* src/racoon/pfkey.c: changed includes order to fix compilation.
|
||
|
||
2005-05-14 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/libipsec/policy_parse.y: Fix parse problem
|
||
|
||
2005-05-14 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/sockmisc.c: Debug message said it will send to
|
||
source address insted of destination.
|
||
|
||
2005-05-13 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_inf.c: fix build problem
|
||
|
||
2005-05-13 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp.c: Fixed a double ph2handler free in
|
||
isakmp_ph2begin_i().
|
||
|
||
2005-05-12 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_quick.c: fix build problem on some platforms
|
||
|
||
* src/racoon/isakmp.c: For acquire messages, when NAT-T is in use,
|
||
consider null port as a wildcard and use IKE ports.
|
||
|
||
2005-05-10 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/samples/roadwarrior/server/{racoon.conf|racoon.conf-radius}
|
||
src/racoon/samples/roadwarrior/server/phase1-down.sh: removed file
|
||
src/racoon/samples/roadwarrior/client/racoon.conf: update config
|
||
files to higher security settings. Remove now useless phase 1 down
|
||
script on server side.
|
||
* Update README to reflect server/phase1-down.sh removal
|
||
|
||
2005-05-09 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{cftoken.l|cfparse.y|isakmp_cfg.c|isakmp_cfg.h}
|
||
src/racoon/{isakmp_unity.c|racoon.conf.5}: Add PFS group and
|
||
save password extensions from Cisco in ISAKMP mode config.
|
||
|
||
2005-05-08 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{handler.c|ipsec_doi.c|proposal.c}: check for lifebyte
|
||
in proposals
|
||
* src/racoon/ipsec_doi.c: fix a bug in proposal_check claim for phase 1
|
||
* src/racoon/handler.c: style
|
||
|
||
* src/racoon/isakmp_xauth.c: fix build with shadow passwords
|
||
|
||
2005-05-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* configure.ac src/racoon/isakmp_xauth.c: support shadow passwords
|
||
* src/racoon/{isakmp_inf.c|isakmp_inf.h}: missing prototype
|
||
* src/racoon/{handler.h|isakmp_inf.c|isakmp_quick.c|isakmp_var.h}
|
||
src/racoon/pfkey.c: Move purge_remote() and delete_spd() prototypes
|
||
to the right header file
|
||
|
||
2005-05-06 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{admin.c|isakmp.c|isakmp_inf.c}: factor various
|
||
ISAKMP SA termination (for DPD timeouts and delete message) to
|
||
use purge_remote() so that SA and generated SPD get correctly flushed
|
||
* src/racoon/{handler.c|handler.h}: Introduce getph1byaddrwop() and
|
||
getph2bysaddr()
|
||
* src/racoon/{isakmp.c|isakmp_var.h|isakmp_inf.c|isakmp_inf.h}: make
|
||
purge_remote(), setcopeid() and delete_spd() public
|
||
* src/racoon/isakmp_quick.c: remove duplicated setscopeid()
|
||
* src/racoon/{sockmisc.c|sockmisc.h} introduce a CMPSADDR() macro
|
||
to compare with ports when ENABLE_NATT and without otherwise
|
||
|
||
2005-05-06 Frederic Senault <fred@lacave.net>
|
||
|
||
* src/racoon/isakmp_inf.c: Only print the contents of an informative
|
||
message if the payload indicates an error ; transmit the return
|
||
values from the DPD functions.
|
||
|
||
2005-05-06 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_inf.c: Fix a bug causing informational message
|
||
payloads to be ignored
|
||
|
||
2005-05-05 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_inf.c: Fixed some potential crashes in
|
||
purge_remote() and purge_ipsec_spi().
|
||
|
||
2005-05-05 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/libipsec/{policy_parse.y|policy_token.l}
|
||
src/setkey/{setkey.8|token.l}: Allow ports to be supplied in SP
|
||
endpoints, for accurate ESP over UDP matching
|
||
* src/racoon/{isakmp.c|racoon.conf.5}: Send IKE local and remote
|
||
ports to the hook scripts
|
||
* src/racoon/remoteconf.c: do not honour ports when looking up
|
||
a remote config, as our remote config have no port information
|
||
* src/racoon/samples/roadwarrior/client/{phase1-up.sh|phase1-down.sh}:
|
||
use the IKE ports supplied by racoon to set up acurate endpoints
|
||
ports in SP endpoints
|
||
|
||
2005-05-04 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_inf.c: code cleanup for SPD remove, generated
|
||
policies are now also removed when DPD purge.
|
||
|
||
2005-05-04 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Manisha Malla <mmanisha@novell.com>
|
||
* src/racoon/isakmp_cfg.c: fix unsigned int checked for being negative
|
||
|
||
From Ludo Stellingwerff <ludo@protactive.nl>
|
||
* src/setkey/{parse.y|token.l}: build on system that do not have
|
||
TCP-MD5 support
|
||
|
||
2005-05-04 Michal Ludvig <michal@logix.cz>
|
||
|
||
* configure.ac: Revert GLIBC_BUGS change from 2005-04-15
|
||
|
||
2005-05-03 Frederic Senault <fred@lacave.net>
|
||
|
||
* src/racoon/{cfparse.y|cftoken.l|isakmp_inf.c|racoon.conf.5}
|
||
src/racoon/{remoteconf.c|remoteconf.h}: Add a weak_phase1_check
|
||
option to enable the handling of unencrypted delete payloads.
|
||
|
||
* src/racoon/plog.c: Use of isgraph in binsanitize.
|
||
|
||
* src/racoon/rfc/rfc3706.txt: new file: Dead Peer Detection RFC.
|
||
|
||
* src/racoon/isakmp_inf.c: Unused code cleanup.
|
||
|
||
2005-04-26 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* bootstrap: Darwin support
|
||
|
||
From Larry Baird <lab@gta.com>
|
||
* src/racoon/nattraversal.c: Fix NAT-T for initiator
|
||
|
||
From Andreas Tobler <toa@pop.agri.ch>:
|
||
* src/racoon/{misc.h|throttle.c|remoteconf.c|sockmisc.c|privsep.c}
|
||
src/racoon/{pfkey.c|isakmp.c|grabmyaddr.c|getcertsbyname.c}
|
||
src/racoon/configure.ac src/libipsec/policy_token.l
|
||
src/setkey/token.l: Build on Darwin
|
||
|
||
2005-04-25 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/handler.h: ifdef DPD and NAT-T data in data structures
|
||
|
||
* src/libipsec/{ipsec_dump_policy.c|pfkey_dump.c|libpfkey.h}
|
||
src/setkey/{setkey.8|setkey.c}: add a -p option to setkey to
|
||
enable the display of ESP over UDP ports in policies.
|
||
|
||
* src/racoon/ipsec_doi.c: fix LP64 bug
|
||
|
||
From Ludo Stellingwerff <ludo@protactive.nl>:
|
||
* src/racoon/isakmp.c: build without NAT-T
|
||
|
||
From F. Senault <fred.letter@lacave.net>
|
||
* src/racoon/{evt.h|isakmp.h|isakmp_inf.c|plog.c|plog.h|racoonctl.c}
|
||
src/racoon/isakmp_xauth.c: Take into account payloads bundled after
|
||
an ISAKMP informationnal message.
|
||
|
||
From Patrick McHardy <kaber@trash.net>
|
||
* src/racoon/{handler.c|handler.h|pfkey.c}: When handling acquire
|
||
message, lookup phase 2 by (src, dst, id) instead of only id.
|
||
|
||
2005-04-23 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/libipsec/ipsec_dump_policy.c: display port numbers in policies
|
||
* src/racoon/{isakmp.c|isakmp_cfg.c|isakmp_inf.c|pfkey.c}: don't
|
||
forget port numbers so that mutiple clients behind the same NAT
|
||
can work.
|
||
|
||
From Larry Baird <lab@gta.com>
|
||
* src/racoon/{isakmp.c|nattraversal.c|isakmp_quick.c|nattraversal.h}:
|
||
NAT-T fixes for interoperability with greenbow VPN client.
|
||
|
||
2005-04-21 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/libipsec/policy.parse.y, src/racoon/cfparse.y,
|
||
src/libipsec/policy_parse.y, src/racoon/cfparse.y,
|
||
src/racoon/cftoken.l, src/racoon/crypto_openssl.c,
|
||
src/racoon/getcertsbyname.c, src/racoon/grabmyaddr.c,
|
||
src/racoon/ipsec_doi.c, src/racoon/isakmp.c,
|
||
src/racoon/isakmp_inf.c, src/racoon/pfkey.c,
|
||
src/racoon/plainrsa-gen.c, src/racoon/sockmisc.c,
|
||
src/racoon/sockmisc.h, src/racoon/racoonctl.c: made compile
|
||
with gcc-4.0 (20050410 prerelease)
|
||
|
||
2005-04-20 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
From: Ganesan Rajagopal <rganesan@users.sourceforge.net>
|
||
* configure.ac: fix --enable-ipv6 logic
|
||
|
||
2005-04-19 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/remoteconf.c: fixed dupisakmpsa() and dhgroup.
|
||
|
||
2005-04-18 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/crypto_openssl.c: fixed single DES support;
|
||
* NEWS: noted fix
|
||
|
||
2005-04-18 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_base.c: DPD support, fix memory leak
|
||
|
||
From Thomas Klausner <wiz@NetBSD.org>
|
||
* src/libipsec/{ipsec_set_policy.3|ipsec_strerror.3}
|
||
src/racoon/{admin.c|plainrsa-gen.8|racoon.8|racoon.conf.5|racoonctl.8}
|
||
src/racoon/samples/{racoon.conf.in|racoon.conf.sample}
|
||
src/racoon/samples/racoon.conf.sample-gssapi
|
||
src/racoon/samples/racoon.conf.sample-inherit
|
||
src/racoon/samples/racoon.conf.sample-natt
|
||
src/racoon/samples/racoon.conf.sample-plainrsa
|
||
src/racoon/samples/roadwarrior/README
|
||
src/racoon/samples/roadwarrior/server/phase1-down.sh
|
||
src/setkey/setkey.8: docmumentation fixes
|
||
|
||
From KAME
|
||
* src/racoon/ipsec_doi.c: wrong check on SA lifebyte
|
||
|
||
From Fred Senault <fred.letter@lacave.net>
|
||
* src/racoon/{cfparse.y|cftoken.l} drop split_net_type directive,
|
||
which is now incoprated into split_net_tunnels
|
||
* src/raccon/{isakmp.c|isakmp_cfg.c|isakmp_cfg.h|isakmp_xauth.c}
|
||
src/racoon/isakmp_xauth.h: support login and password sent
|
||
in different packets during the Xauth exchange. This makes racoon
|
||
interoperable with SecureComputing's sidewinder
|
||
* src/racoon/{strnames.c|strnames.h}: more debug strings for Xauth
|
||
|
||
2005-04-17 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/handler.c: Configuration reload validation code
|
||
* src/racoon/handler.h:revalidate_ph12() function
|
||
* src/racoon/ipsec_doi.c: duplicates iph1->approval in
|
||
get_ph1approval(), some fields sets to NULL when needed
|
||
* src/racoon/isakmp_inf.[ch]: purge_ipsec_spi() is now public
|
||
* src/racoon/localconf.[ch]: save/restore_params() functions
|
||
* src/racoon/main.c: moved restore_params functions to localconf
|
||
* src/racoon/remoteconf.c: save_rmconf() functions, dupisakmpsa()
|
||
function, some values set to NULL when needed
|
||
* src/racoon/remoteconf.h: save_rmconf() functions, dupisakmpsa()
|
||
function
|
||
* src/racoon/sainfo.[ch]: save_sainfotree() functions
|
||
* src/racoon/session.c: Reloads conf on a SIGHUP without loosing
|
||
existing tunnels
|
||
|
||
2005-04-15 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
From Zilvinas Valinskas <zilvinas@gemtek.lt>:
|
||
* configure.ac:
|
||
- cross-compile type fix (patch 1);
|
||
- --enable-{frag|hybrid}=no fixes (patches 6,7);
|
||
- support for --with-flex, --with-flexlib (patch 11);
|
||
- GLIBC_BUGS assignment correction (patch 14 with mods).
|
||
* src/racoon/isakmp.c: fix compilation when hybrid disabled.
|
||
|
||
2005-04-11 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/rfc/{rfc2407.txt|rfc2408.txt: new files
|
||
RFC for IPsec DOI and ISAKMP
|
||
|
||
2005-04-10 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_base.c: resurect RSASIG support
|
||
* src/racoon/isakmp_ident.c: missing support for hybrid auth
|
||
* src/racoon/{isakmp_base.c|oakley.c}: missing bits for hybrid/base mode
|
||
|
||
2005-04-09 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{algorithm.c|algorithm.h|cftoken.l|ipsec_doi.c}
|
||
src/racoon/{isakmp.c|isakmp_agg.c|isakmp_ident.c|isakmp_base.c}
|
||
src/racoon/{isakmp_frag.h|isakmp_xauth.c|oakley.c|racoon.conf.5}:
|
||
Add Xauth + RSASIG, for client and server. Add all Xauth and
|
||
IKE fragmentation logic to base and ident mode.
|
||
* src/libipsec/{pfkey.c|pfkey_dump.c}
|
||
src/setkey/parse.y: more missing TCP_MD5 bits from KAME
|
||
|
||
2005-04-08 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/cfparse.y: a list of network can be specified for split
|
||
tunnelling
|
||
* src/racoon/{isakmp_cfg.c|racoon.conf.5}: add INTERNAL_CIDR4, the
|
||
netmask in CIDR notation, to the hook script environement.
|
||
* src/setkey/{token.l|parse.y|setkey.8}: KAME backport of missing
|
||
bits for TCP_MD5 support.
|
||
|
||
From Fred Senault <fred.letter@lacave.net>
|
||
* src/racoon/{cfparse.y|cftoken.l|ipsec_doi.c|ipsec_doi.h}
|
||
src/racoon/racoon.conf.5: KEYID identifier can be taken from
|
||
a file or from a quoted string
|
||
|
||
2005-04-05 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Fred Senault <fred.letter@lacave.net>
|
||
* src/racoon/admin.c: fix the admin interface that was left behind
|
||
after recent Xauth changes
|
||
* src/racoon/{cfparse.y|isakmp_xauth.c|isakmp_xauth.h|oakley.c}
|
||
src/racoon/{remoteconf.c|remoteconf.h}: factor Xauth info in
|
||
remote conf within a single structure.
|
||
* src/racoon/{isakmp.c|isakmp_cfg.c}: on client side, do not run
|
||
phase1-up script before ISAKMP mode config is done
|
||
* src/racoon/isakmp_inf.c: log a buggy condition
|
||
* src/racoon/{isakmp.c|isakmp_agg.c|isakmp_base.c|isakmp_ident.c}
|
||
src/racoon/{oakley.c|oakley.h}: Use the AUTHMETHOD macro to
|
||
distinguish between XAUTH PSK and Kerberos authentications
|
||
* src/racoon/{oakley.c|remoteconf.c}: set a default for certificate
|
||
requests
|
||
* src/racoon/isakmp_xauth.c: Fix serious security bug introduced
|
||
on 2005-03-09: Xauth validation was required for phase 2 on the
|
||
client (thus blocking phase 2), but not on the server (thus
|
||
making it open regardless of Xauth exchange).
|
||
* src/racoon/vendorid.c: dump unknown VIDs
|
||
|
||
|
||
2005-04-06 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/crypto_openssl.c: Disable OpenSSL padding in
|
||
evp_crypt(), because it may cause some interoperability problems.
|
||
Solution reported by Ganesan Rajagopal.
|
||
|
||
2005-04-05 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/main.c: build with hybrid but without libradius
|
||
|
||
2005-04-05 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/handler.h: added a flag to identify generated policies
|
||
* src/racoon/isakmp.c: changed logging in isakmp_ph1expire()
|
||
* src/racoon/isakmp_inf.c: use iph2->generated_spidx to check if
|
||
policy have been generated in purge_remote_spi()
|
||
* src/racoon/isakmp_quick.c: sets iph2->generated_spidx for
|
||
generated policies
|
||
* src/racoon/pfkey.c: reactivated the unbindph12() in pk_recvupdate()
|
||
|
||
2005-04-04 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_cfg.c: fix a buffer overrun in mode config SET
|
||
|
||
2005-03-30 Michal Ludvig <michal@logix.cz>
|
||
|
||
* configure.ac: Don't compile with NAT-T by default (according to
|
||
documentation, finally :-)
|
||
|
||
2005-03-27 Michal Ludvig <michal@logix.cz>
|
||
|
||
From Zilvinas Valinskas <zilvinas@gemtek.lt>:
|
||
* configure.ac:
|
||
- Use AC_CHECK_HEADER for kernel headers instead of AC_CHECK_FILE.
|
||
- Fix OpenSSL check for cross-compilation.
|
||
* acracoon.m4(RACOON_CHECK_VA_COPY): Allow cross-compilation.
|
||
(RACOON_CHECK_BUGGY_GETADDRINFO): Ditto.
|
||
|
||
2005-03-16 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/privsep.c: check for NULL path in unsafe_path()
|
||
* src/racoon/privsep.c: missing space
|
||
|
||
2005-03-15 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{cfparse.y|cftoken.l|isakmp.c|isakmp_cfg.c|isakmp_cfg.h}
|
||
src/racoon/{isakmp_var.h|isakmp_xauth.c|localconf.h|privsep.c}
|
||
src/racoon/{privsep.h|racoon.conf.5|remoteconf.c|remoteconf.h}
|
||
src/racoon/main.c: Remove most of config dependency from
|
||
privilegied instance for upcoming config reload patch.
|
||
* src/racoon/isakmp_cfg.h: fix the application version for Xauth
|
||
* src/racoon/isakmp_cfg.c: only call cleanup_pam when PAM is used
|
||
|
||
2005-03-14 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* configure.ac: handle correctly dynamic libradius
|
||
* src/racoon/cfparse.y: correctly initialize address pool
|
||
|
||
2005-03-13 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp.c: Fixed a buffer underrun (CAN-2005-0398)
|
||
|
||
2005-03-09 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Fred Senault <fred.letter@lacave.net>
|
||
* src/racoon/cfparse.y: endainness bugfix
|
||
* src/racoon/isakmp_xauth.c: off by one bugs in strings
|
||
* src/racoon/oakley.h: missing parenthesis causing bugs
|
||
|
||
2005-03-09 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_xauth.c: fix a crash when using RADIUS auth
|
||
|
||
2005-03-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Fred Senault <fred.letter@lacave.net>
|
||
* src/racoon/{algorithm.c|algorithm.h|cfparse.y|cftoken.l}
|
||
src/racoon/{handler.c|ipsec_doi.c|ipsec_doi.h|isakmp.c}
|
||
src/racoon/{isakmp_agg.c|isakmp_base.c|isakmp_cfg.c|isakmp_cfg.h}
|
||
src/racoon/{isakmp_ident.c|isakmp_inf.c|isakmp_quick.c}
|
||
src/racoon/{isakmp_unity.c|isakmp_xauth.c|kmpstat.c|oakley.c}
|
||
src/racoon/{oakley.h|plainrsa-gen.8|privsep.c|racoon.conf.5}
|
||
src/racoon/{racoonctl.c|remoteconf.c|remoteconf.h|strnames.c}
|
||
src/racoon/{strnames.h|throttle.c}: Support plain Xauth, split
|
||
tunnelling, multiple DNS & WINS in ISAKMP mode config.
|
||
|
||
2005-03-02 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_quick.c: tunnel_mode_prop() is now public
|
||
* src/racoon/isakmp_inf.c: fixed compilation if HAVE_POLICY_FWD.
|
||
|
||
2005-03-01 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/oakley.c: fixed oakley_newiv2() when errors
|
||
|
||
2005-02-24 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/privsep.c: safety check port numbers given by the
|
||
unprivilegied instance.
|
||
* src/racoon/racoonctl.8: display fixes in racoonctl(8)
|
||
|
||
2005-02-23 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* configure.ac, src/racoon/{Makefile.am|crypto_openssl.c}: optionnal
|
||
support for patented algorithms: IDEA and RC5.
|
||
* src/racoon/{isakmp_xauth.c|main.c}: don't initialize RADIUS if it
|
||
is not required in the configuration
|
||
* src/racoon/isakmp.c: do not reject addresses for which kernel
|
||
refused UDP encapsulation, they can still be used for non NAT-T
|
||
traffic (eg: NAT-T enabled racoon on non NAT-T enabled kernel)
|
||
* src/libipsec/libpfkey.h: prefer __inline to inline
|
||
* src/racoon/{cfparse.y|cftoken.l|localconf.c|localconf.h|privsep.c}
|
||
src/racoon/racoon.conf.5: Add chroot capability
|
||
|
||
2005-02-18 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{main.c|eaytest.c|plairsa-gen.c}
|
||
src/setkey/setkey.c: don't use fuzzy paths for package_version.h
|
||
|
||
2005-02-18 Michal Ludvig <michal@logix.cz>
|
||
|
||
* configure.ac, rpm/suse/ipsec-tools.spec.in,
|
||
rpm/suse/Makefile.am: Distribute .spec file with
|
||
resolved version string.
|
||
* src/racoon/Makefile.am: Allow parallel cluster build.
|
||
|
||
2005-02-17 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Fred Senault <fred.letter@lacave.net>
|
||
* src/racoon/remoteconf.c: Fix a bug in script init
|
||
|
||
2005-02-17 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/ipsec_doi.c: Workaround for phase1 lifetime checks
|
||
|
||
2005-02-16 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_inf.c: Purge generated SPDs when getting a
|
||
related DELETE_SA
|
||
* src/racoon/pfkey.c: do NOT unbindph12() when SA acquire
|
||
|
||
2005-02-15 Michal Ludvig <michal@logix.cz>
|
||
|
||
* configure.ac: Changed --enable-natt_NN to --enable-natt-versions=NN,NN
|
||
|
||
---------------------------------------------
|
||
|
||
Branch for 0.6 created (ipsec-tools-0_6-branch)
|
||
|
||
2005-02-11 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Jason Thorpe <thorpej@netbsd.org>
|
||
* src/raccon/samples/racoon.conf.sample-gssapi
|
||
src/racoon/{cfparse.y|cftoken.l|gssapi.c|gssapi.h|ipsec_doi.c}
|
||
src/racoon/{localconf.c|localconf.h|racoon.conf.5}
|
||
configure.ac: Multiple GSSAPI fixes to get interoperability
|
||
with Microsoft IKE.
|
||
|
||
2005-02-09 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{cfparse.y|isakmp_cfg.c|isakmp_cfg.h|isakmp_xauth.c}
|
||
src/racoon/{isakmp_xauth.h|main.c|privsep.c|privsep.h}
|
||
src/racoon/racoon.conf.5: Make PAM work with privilege separation
|
||
|
||
2005-02-07 Michal Ludvig <michal@logix.cz>
|
||
|
||
From Krisztian Kovacs:
|
||
* src/racoon/cfparse.y: Allocate correct space for "struct sockaddr".
|
||
|
||
2005-01-30 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/vmbuf.c: bugfix in vrealloc()
|
||
* src/racoon/oakley.c: mem leak fix in INITDHVAL()
|
||
* src/racoon/session.c: mem leak fix in check_flushsa()
|
||
|
||
2005-01-29 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_{ident|agg}.c: NAT-T cleanup
|
||
* src/racoon/pfkey.c: Uses NATT encaps_type in pk_sendupdate()
|
||
* src/racoon/vendorid.[ch]: NAT-T cleanup, NATT_01 VID
|
||
* src/racoon/nattraversal.[ch]: NATT cleanup, support for all
|
||
drafts (disabled by default) / RFC.
|
||
* src/racoon/isakmp.h: NATT cleanup for NATT RFC support
|
||
* src/racoon/ipsec_doi.h: updated comments about NATT
|
||
* configure.ac: enable-natt_XX options
|
||
* src/racoon/isakmp.c: set UDP_ENCAPS_ESPINUDP_NON_IKE option when needed
|
||
|
||
|
||
2005-01-29 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Fred Senault <fred@lacave.net>
|
||
* src/racoon/pfkey.c: Update SAD even if NAT-T is disabled, so that
|
||
phase2 can start.
|
||
|
||
2005-01-23 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/setkey/{sekkey.8|setkey.c|token.l|parse.y}: implement NetBSD's
|
||
SADB_X_AALG_TCP_MD5. Resurrect setkey -h meaning on NetBSD.
|
||
|
||
2005-01-22 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Fred Senault <fred@lacave.net>
|
||
* src/racoon/{cftoken.l|cfparse.y|raccon.conf.5}
|
||
src/racoon/samples/roadwarrior/README: change "my_identifier login"
|
||
into "xauth_login" in the config file so that we can introduce Xauth
|
||
with a pre-shared key later.
|
||
|
||
2005-01-21 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/samples/roadwarrior/client/{phase1-up.sh|phase1-down.sh}:
|
||
workaround Linux problems. This needs a better fix.
|
||
|
||
2005-01-18 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/privsep.c: build without ENABLE_HYBRID
|
||
|
||
2005-01-14 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/raccon/rfc/{rfc3947.txt|rfc3948.txt}: new files (NAT-T)
|
||
|
||
2005-01-13 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/ipsec_doi.c: Uses proposal_check value to check phase
|
||
1 lifetime.
|
||
* src/racoon/racoon.conf.5: Updated racoon man page for phase 1
|
||
lifetime check / proposal_check.
|
||
|
||
2005-01-11 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakjmp_quick.c: endianness bugfix from KAME
|
||
|
||
2005-01-07 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{cfparse.y|cftoken.l|nattraversal.h|pfkey.c}
|
||
src/racoon/{racoon.conf.5|remoteconf.c|remoteconf.h}
|
||
src/libipsec/{libpfkey.h|pfkey.c}: ESP fragmentation size is
|
||
now configurable (supported only on NetBSD so far).
|
||
|
||
2005-01-05 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/privsep.c: Build again on Linux with privsep
|
||
|
||
2005-01-03 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{isakmp_cfg.c|isakmp_cfg.h|isakmp_xauth.c|isakmp_xauth.h}
|
||
src/racoon/{cfparse.y|cftoken.l|racoon.conf.5}
|
||
src/racoon/doc/FAQ
|
||
configure.ac: PAM support for authentication and accounting in
|
||
hybrid auth
|
||
|
||
2005-01-02 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/admin.c: never fork, it buys nothing an break on some
|
||
operations
|
||
|
||
2004-12-30 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{Makefile.am|admin.h|cfparse.y|cftoken.l|isakmp.c}
|
||
src/racoon/{isakmp_cfg.c|isakmp_cfg.h|isakmp_var.h| isakmp_xauth.c}
|
||
src/racoon/{localconf.c|localconf.h|main.c|oakley.c|pfkey.c}
|
||
src/racoon/{racoon.conf.5|remoteconf.c|remoteconf.h|session.c}
|
||
src/racoon/{privsep.c|privsep.h}: new files
|
||
Privilege separation
|
||
|
||
* src/racoon/{Makefile.am|admin.h|admin_var.h|kmpstat.c}
|
||
src/racoon/{racoonctl.c|racoonctl.h}: new files
|
||
configure.ac: publically export the adminport interface so that
|
||
external program can control racoon
|
||
|
||
* src/racoon/{racoonctl.c|racoonctl.h|kmpstat.c}: Add interface
|
||
versionning
|
||
|
||
* src/racoon/admin.h: make sure no / will be missing in adminsock path
|
||
|
||
---------------------------------------------
|
||
|
||
Branch for 0.5 created (ipsec-tools-0_5-branch)
|
||
|
||
2004-12-23 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/crypto_openssl.c: Indentation
|
||
|
||
2004-12-28 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/crypto_openssl.c: Fixed eay_get_x509subjectaltname()
|
||
when getting an IP (Bug # 1092095)
|
||
|
||
|
||
2004-12-26 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/session.c: remove outdated comment
|
||
|
||
---------------------------------------------
|
||
|
||
0.5.beta2 released
|
||
|
||
2004-12-21 Michal Ludvig <michal@logix.cz>
|
||
|
||
* src/racoon/pfkey.c: Fix AES vs Rijndael defines.
|
||
|
||
2004-12-20 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* configure.ac, src/racoon/isakmp.c, src/racoon/pfkey.c:
|
||
Some FreeBSD / NATT support.
|
||
|
||
2004-12-17 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp.c: only IPv4 NAT-T is supported, so skip IPv6 here.
|
||
* src/racoon/pfkey.c: Restore AES support on NetBSD.
|
||
|
||
2004-12-17 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/crypto_openssl.c: Uses sprintf() instead of
|
||
asprintf() in eay_get_x509subjectaltname(), because of some
|
||
compilation problems reported with asprintf() on some platforms.
|
||
* src/racoon/oakley.c: just take the first cert in
|
||
oakley_savecert() if cert ID check is disabled.
|
||
|
||
2004-12-16 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/crypto_openssl.c: Build again on NetBSD
|
||
* src/racoon/samples/roadwarrior/server/racoon
|
||
src/racoon/samples/roadwarrior/server/racoon.conf-radius
|
||
src/racoon/samples/roadwarrior/README: Use DPD in sample files.
|
||
|
||
2004-12-16 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/crypto_openssl.c: Fixed eay_get_x509subjectaltname()
|
||
when SubjectAltName contains an IP. OpenSSL code from Ludovic
|
||
Flament (ludovic.flament@free.fr).
|
||
|
||
---------------------------------------------
|
||
|
||
0.5.beta1 released
|
||
|
||
2004-12-13 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
From Ganesan R <rganesan@users.sourceforge.net>:
|
||
* src/racoon/Makefile.am, src/setkey/Makefile.am: Fix compilation
|
||
with shared libraries.
|
||
|
||
2004-12-10 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/oakley.c: takes the first certificate which matches
|
||
the Identity, instead of just taking the first certificate.
|
||
|
||
2004-12-07 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_inf.c: Set spi_size for R-U-THERE/R-U-THERE-ACK.
|
||
|
||
2004-12-04 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/libipsec/pfkey_dump.c: distinguish per-socket policies from
|
||
general ones (Linux case);
|
||
* src/racoon/pfkey.c: dito, do not negotiate policies if racoon
|
||
do not listen on out tunnel's source address.
|
||
|
||
2004-12-01 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/isakmp_agg.c: code cleanup in NATT / DPD VIDs
|
||
generation in r1send()
|
||
|
||
2004-12-01 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/remoteconf.{c|h}: DPD support option (enabled by default)
|
||
* src/racoon/{cfparse.y|cftoken.l}: DPD token, yyerror if DPD
|
||
parameters but compiled without ENABLE_DPD
|
||
* src/racoon/isakmp_{agg|ident}.c: Send DPD VID only if DPD
|
||
support activated in configuration
|
||
|
||
2004-11-30 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon{evt.c|evt.h|admin.c}: init event queue at compile time,
|
||
to avoid garbage pointer if admin port is disabled.
|
||
* src/racoon/{throttle.c|throttle.h}: new files
|
||
src/racoon/{Makefile.am|isakmp_cfg.c|isakmp_xauth.c|racoon.conf.5}
|
||
configure.ac: Add a per-host throttling count. When throttling,
|
||
don't sleep, schedule the answer for later instead.
|
||
* src/racoon/kmpstat.c: default with no hexdump of the packet
|
||
* src/racoon/admin.c: don't remove admin socket after first request,
|
||
on the other hand remove on startup stale sockets left by
|
||
crashed racoon.
|
||
* src/racoon/samples/roadwarrior/README
|
||
src/racoon/kmpstat.c: fix option parsing problem on Linux
|
||
|
||
2004-11-29 Yvan Vanhullebus <vanhu@free.fr>
|
||
|
||
* src/racoon/session.c: Only listen on pfkey socket when received
|
||
shutdown signal
|
||
|
||
2004-11-28 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{cfparse.y|cftoken.l|isakmp_cfg.c|isakmp_cfg.h}
|
||
src/racoon/{isakmp_xauth.c|racoon.conf.5}: Add a one second throttle
|
||
on each Xauth authentication to avoid brute force attacks
|
||
|
||
2004-11-24 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/samples/roadwarrior/README
|
||
src/racoon/samples/roadwarrior/client{phase1-up.sh|phase1-down.sh}
|
||
src/racoon/samples/roadwarrior/client/{racoon.conf|racoon.conf-radius}
|
||
src/racoon/samples/roadwarrior/server/{racoon.conf|phase1-down.sh}:
|
||
Fill Linux gaps for hybrid auth client, Replace public IP by
|
||
private and example IP in the sample config files.
|
||
|
||
2004-11-24 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
DPD patch from Yvan Vanhullebus <vanhu@free.fr>
|
||
* src/racoon/cfparse.y: missing bits for DPD support
|
||
|
||
2004-11-23 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/setkey/parse.y: generate require fwd policies for unique in
|
||
policies.
|
||
* src/setkey/setkey.c: made -r/-k options awailable only when
|
||
system has FWD policies.
|
||
* src/setkey/setkey.8: updated docs about change above.
|
||
|
||
2004-11-22 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/{admin.c,pfkey.c}: Wrap adminport-parts to
|
||
#ifdef ENABLE_ADMINPORT/#endif.
|
||
|
||
2004-11-22 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
Revert these changes (ludvigm, 2004-11-18):
|
||
* src/racoon/Makefile.am: install sample racoon.conf and psk.txt.
|
||
* src/setkey/Makefile.am: Install setkey.conf.
|
||
|
||
2004-11-22 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/raccon/{isakmp_cfg.c|isakmp_cfg.h|isakmp_xauth.c}: defer phase 1
|
||
removal so that it's not used after been deleted.
|
||
* src/racoon/{evt.h|isakmp.c|isakmp_agg.c|isakmp_base.c|session.c}
|
||
src/racoon/{isakmp_ident.c|isakmp_inf.c|kmpstat.c}: report more
|
||
errors to racoonctl
|
||
|
||
2004-11-21 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/doc/FAQ: NAT-T kernel patch for NetBSD is now on
|
||
the ipsec-tools web site
|
||
* src/racoon/{kmpstat.c|racoonctl.8}: New racoonctl command to
|
||
display all events reported by racoon: show-event
|
||
* src/racoon/isakmp_cfg.c: don't send ISAKMP mode config message
|
||
with immature or dying phase 1
|
||
* src/racoon/kmpstat.c: racoonctl vd awaits phase 1 to get down
|
||
|
||
2004-11-20 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_agg.c: for hybrid auth client, advertise ourself
|
||
as Unity compliant.
|
||
* src/racoon/{evt.c|evt.h}: new files
|
||
src/racoon/{Makefile.am|admin.c|admin.h|isakmp.c|isakmp_cfg.c}
|
||
src/racoon/{isakmp_xauth.c|kmpstat.c|pfkey.c}: framework for
|
||
event reporting from racoon to racoonctl
|
||
|
||
2004-11-20 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/grabmyaddr.c: Prevent doubling addresses and error messages
|
||
when racoon is compiled with INET6 support and kernel is not.
|
||
Fixed with help of Zilvinas Valinskas.
|
||
* src/racoon/{var.h|sockmisc.c}: Fixed compilation with gcc-3.4.2+
|
||
problem.
|
||
|
||
2004-11-19 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/doc/FAQ: more options and warn about software patents.
|
||
|
||
2004-11-18 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/vmbuf.c: don't allocate zero-length buffer
|
||
* src/racoon/samples/roadwarrior/client/phase1-down.sh
|
||
src/racoon/samples/roadwarrior/server/phase1-down.sh: Also
|
||
flush SAD when disconnecting.
|
||
* src/racoon/admin.c: Send a notification when deleting ISAKMP SA
|
||
* src/racoon/samples/roadwarrior/README: accomodate the recent
|
||
sysconfdir change
|
||
|
||
2004-11-18 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/Makefile.am: Fix adminsocket dir, install sample
|
||
racoon.conf and psk.txt.
|
||
* src/racoon/localconf.h: Look for racoon.conf in $(SYSCONFDIR),
|
||
not $(SYSCONFDIR)/racoon.
|
||
* src/racoon/algorithm.h, src/racoon/eaytest.c,
|
||
src/racoon/schedule.h, src/racoon/gnuc.h: Build fixes for really
|
||
strict environments.
|
||
* src/setkey/setkey.conf: Yet another sample config file.
|
||
* src/setkey/Makefile.am: Install setkey.conf.
|
||
* rpm/suse/{ipsec-tools.spec.in,sysconfig.racoon,racoon.init}: New
|
||
files.
|
||
* rpm/suse/{Makefile.am,.cvsignore}: New files.
|
||
* configure.ac, rpm/Makefile.am: Build in rpm/suse.
|
||
|
||
2004-11-17 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* configure.ac: paste bugfix by Zilvinas Valinskas
|
||
* src/racon/{isakmp_quick.c|policy.c|strnames.c}: fwd policy support
|
||
for generated policies. Path by Patrick McHardy.
|
||
|
||
2004-11-16 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/racoonctl.8: racoonctl man page (new file)
|
||
|
||
2004-11-16 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
From Ganesan <rganesan@users.sourceforge.net>
|
||
* src/racoon/ipsec_doi.c: fix free'd memory access
|
||
|
||
2004-11-16 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
DPD patch from Yvan Vanhullebus <vanhu@free.fr>
|
||
* configure.ac, src/racoon/cfparse.y, src/racoon/cftoken.l,
|
||
src/racoon/handler.c, src/racoon/handler.h,
|
||
src/racoon/isakmp.c, src/racoon/isakmp.h,
|
||
src/racoon/isakmp_agg.c, src/racoon/isakmp_ident.c,
|
||
src/racoon/isakmp_inf.c, src/racoon/isakmp_inf.h,
|
||
src/racoon/racoon.conf.5 src/racoon/remoteconf.c,
|
||
src/racoon/remoteconf.h, src/racoon/vendorid.c,
|
||
src/racoon/vendorid.h: Dead Peer Detection (DPD) support.
|
||
|
||
2004-11-16 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Remove a bash-specific construction, take II.
|
||
* src/racoon/grabmyaddr.c: FreeBSD fix for headers.
|
||
|
||
2004-11-15 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Use correct include paths during ./configure run.
|
||
* src/racoon/Makefile.am: Compile cftoken.l from $(srcdir),
|
||
remove samples/racoon.conf.sample-cvpn, added samples/roadwarrior
|
||
(hint, hint, manu :-))
|
||
|
||
2004-11-15 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* README: update the docs
|
||
* src/racoon/doc/FAQ: update the docs
|
||
* configure.ac: Remove a bash-specific construction
|
||
|
||
2004-11-14 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/cfparse.y: ensure that returns from rules are
|
||
initialized even on erroneous config file.
|
||
* src/racoon/admin_var.h: changed management socket location
|
||
* src/racoon/Makefile.am: ditto, added rule to install directory
|
||
for management socket.
|
||
* src/setkey/{setkey.c|parse.y}: introduced rfc/kernel modes,
|
||
added generation of fwd policies for every in policy spdadd'ed.
|
||
* src/setkey/setkey.8,src/libipsec/ipsec_set_policy.3: updated docs
|
||
* src/setkey/policy_token.l: return something reasonable when
|
||
fwd direction is parsed on systems with no forward policy
|
||
support.
|
||
|
||
2004-11-14 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp.c: avoid a double free when using IKE fragmentation
|
||
* src/racoon/{backupsa.c|ipsec_doi.c|localconf.c|str2val.c}
|
||
src/{libipsec/key_debug.c|setkey/parse.y}: fix build warnings
|
||
* configure.ac src/racoon/{admin.c|admin_var.h}
|
||
src/racoon/racoon.conf.5 src/racoon/samples/roadwarrior/README
|
||
src/racoon/samples/roadwarrior/client/racoon.conf: make the default
|
||
mode for the admin socket more secure.
|
||
|
||
2004-11-13 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{cfparse.y|remoteconf.c|crypto_openssl.c|crypto_openssl.h}
|
||
src/racoon/{eaytest.c|oakley.c|racoon.conf.5|cftoken.l|remoteconf.h}
|
||
src/racoon/samples/roadwarrior/README
|
||
src/racoon/samples/roadwarrior/client/racoon.conf: Make the root
|
||
certificate authority location per-peer and configurable.
|
||
* src/racoon/isakmp_frag.c: fix unallocated memory access
|
||
* src/racoon/isakmp_agg.c: fix incorrect queue deallocation
|
||
* src/racoon/remoteconf.c: fix uninitialized data
|
||
* src/racoon/{admin.c|isakmp_xauth.c}: fix free'ed memory access
|
||
|
||
2004-11-12 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{Makefile.am|kmpstat.c}: Make racoonctl vc and vd
|
||
commands IPv6 friendly.
|
||
* src/racoon/{admin.c|admin.h|handler.c|handler.h|kmpstat.c}:
|
||
Add an admin message to flush all the SA for a given peer.
|
||
Convert racoonctl vd to use it.
|
||
* src/racoon/{admin.c|kmpstat.c|cftoken.l|cfparse.y}
|
||
src/racoon/{admin_var.h|admin.h|raccon.conf.5}: Enable the
|
||
administrator to choose the admin socket path, ownership and mode.
|
||
* src/racoon/sample/roadwarrior: complete config files for
|
||
road warriors using hybrid authentication.
|
||
|
||
2004-11-12 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Config option --enable-natt=kernel
|
||
* src/racoon/Makefile.am: Distribute only yacc/lex source files,
|
||
not the preprocessed .c files.
|
||
|
||
2004-11-11 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/samples/racoon.conf.sample-cvpn: more complete setup
|
||
and comments in the VPN concentrator setup for the Cisco VPN client
|
||
* src/racoon/racoon.conf.5: fix documentation
|
||
* src/racoon/isakmp_cfg.c: get the internal IPv4 address in script
|
||
hooks event if we are a server.
|
||
|
||
2004-11-10 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{ipsec_doi.c|remoteconf.c}: fix LP64 problems
|
||
|
||
2004-11-09 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* Makefile.am: Remove aclocal-related lines.
|
||
* src/racoon/Makefile.am: Add isakmp_frag.h into noints_HEADERS
|
||
* configure.ac: Cleanup, define INET6 if IPv6 shoud be supported,
|
||
better handling of KRB5 and NAT-T.
|
||
* src/racoon/{isakmp_cfg.c,isakmp_frag.c,isakmp_unity.c}: Make
|
||
FreeBSD happy with includes (Arrgh...&^#$^@!!!)
|
||
|
||
2004-11-08 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/libipsec/policy_parse.y: Define INT32_MAX/INT32_MIN.
|
||
* src/libipsec/policy_token.l, src/racoon/kmpstat.c,
|
||
src/racoon/{pfkey.c,prsa_par.y,rsalist.c,token.l}: Small
|
||
fixes to support FreeBSD (tested with 4.10).
|
||
|
||
2004-11-05 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Add --with-readline switch.
|
||
* src/setkey/setkey.c(stdin_loop): Fix newlines and comments
|
||
when compiled without readline.
|
||
|
||
2004-11-01 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/isakmp_quick.c: generated policy refresh patch
|
||
by Yvan Vanhullebus
|
||
|
||
2004-10-29 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Check for IPSEC_DIR_FWD and eventually define
|
||
HAVE_POLICY_FWD.
|
||
* src/libipsec/{ipsec_dump_policy.c,policy_token.l}: Use
|
||
HAVE_POLICY_FWD in ifdefs.
|
||
* NEWS: Mention the fix.
|
||
* src/racoon/kmpstat.c: Fix compilation on Linux.
|
||
* src/racoon/ipsec_doi.h: Ditto.
|
||
* src/racoon/Makefile.am, src/setkey/Makefile.am: Update
|
||
explicit dependencies.
|
||
|
||
2004-10-29 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{isakmp_cfg.h,grabmyaddr.c,handler.c,handler.h}:
|
||
do not reconfigure internal addresses obtained through ISAKMP
|
||
mode config.
|
||
* src/racoon/{isakmp.c,isakmp_cfg.c,isakmp_xauth.c}: On authentication
|
||
failure, kill the phase 1 and log the failure. Do not run the sa_up
|
||
script in this case.
|
||
* src/racoon/{admin.c,admin.h,isakmp_xauth.c,kmpstat.c,remoteconf.h}:
|
||
Add -u user to racoonctl establish-sa, prompt for the PSK from
|
||
the terminal, and add a vpn-connect target with simplified syntax
|
||
for establishing a SA in the road warrior case.
|
||
* src/racoon/{admin.c,kmpstat.c}: implement delete-sa and
|
||
vpn-disconnect commands of racoonctl
|
||
* src/racoon/{cfparse.y,cftoken.l,handler.c,isakmp.c,isakmp_cfg.c}
|
||
src/racoon/{isakmp_var.h,racoon.conf.5,remoteconf.c,remoteconf.h}:
|
||
Remove sa_up and sa_down and replace them by a more general
|
||
script hook framework.
|
||
|
||
2004-10-27 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/nattraversal.c: Use macros instead of magic numbers
|
||
* src/racoon/kmpstat.c: pull up fixes from KAME so that racoonctl
|
||
can actually establish a SA
|
||
* src/racoon/{cfparse.y,cftoken.l,handler.c,isakmp.c,isakmp_cfg.c}
|
||
src/racoon/{isakmp_var.h,racoon.conf.5,remoteconf.c,remoteconf.h}:
|
||
Shell script hooks for ISAKMP SA creation and removal
|
||
|
||
2004-10-26 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/rfc/draft-ietf-ipsec-isakmp-hybrid-auth-05.txt: removed
|
||
src/racoon/rfc/draft-ietf-ipsec-isakmp-mode-cfg-04.txt: removed
|
||
src/racoon/rfc/draft-beaulieu-ike-xauth-02.txt: new file
|
||
src/racoon/rfc/draft-dukes-ike-mode-cfg-02.txt: new file
|
||
Update to the latest drafts
|
||
|
||
2004-10-25 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/rfc/draft-ietf-ipsec-isakmp-hybrid-auth-05.txt: new file
|
||
src/racoon/rfc/draft-ietf-ipsec-isakmp-mode-cfg-04.txt: new file
|
||
src/racoon/rfc/draft-ietf-ipsec-isakmp-xauth-07.txt: new file
|
||
drafts documenting ISAKMP mode config, Xauth and hybrid auth
|
||
* src/racoon/cftoken.l: fix build problem, add an error message
|
||
when using hybrid auth options while hybrid auth is not built
|
||
* src/racoon/isakmp_cfg.c: build without RADIUS support too
|
||
|
||
2004-10-24 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{algorithm.c,algorithm.h,cfparse.y,cftoken.l}
|
||
src/racoon/{ipsec_doi.c,ipsec_doi.h,isakmp.c,isakmp_agg.c}
|
||
src/racoon/{isakmp_cfg.c,isakmp_cfg.h,isakmp_xauth.c,isakmp_xauth.h}
|
||
src/racoon/{oakley.c,oakley.h,racoon.conf.5}
|
||
src/racoon/{remoteconf.c,remoteconf.h,strnames.c}: Client side
|
||
of hybrid auth and ISAKMP mode config
|
||
|
||
2004-10-24 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/{cfparse.y,cftoken.l,handler.h,isakmp.c}
|
||
src/racoon/{isakmp_agg.c,isakmp_base.c,isakmp_frag.c,isakmp_frag.h}
|
||
src/racoon/{isakmp_inf.c,racoon.conf.5,remoteconf.c,remoteconf.h}:
|
||
Receiver-side of IKE fragmentation
|
||
|
||
2004-10-24 Emmanuel Dreyfus <manu@netbsd.org>
|
||
|
||
* src/racoon/isakmp_cfg.c: Fix read buffer overflow
|
||
* src/racoon/isakmp_xauth.c: Fix weak authentication
|
||
* src/racoon/{oakley.c,oakley.h}: Fix weak authentication
|
||
|
||
2004-10-21 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
From Emmanuel Dreyfus:
|
||
* src/racoon/{isakmp_frag.c,isakmp_frag.h}: New files.
|
||
* src/racoon/isakmp_cfg.c: Fix endianness.
|
||
|
||
2004-10-20 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
From Emmanuel Dreyfus:
|
||
* src/racoon/{cfparse.y,cftoken.l,handler.c},
|
||
src/racoon/{isakmp_cfg.c,isakmp_cfg.h,isakmp_xauth.c},
|
||
src/racoon/racoon.conf.5: RADIUS IP addresses allocation
|
||
and RADIUS accounting.
|
||
* configure.ac,
|
||
src/racoon/{Makefile.am,handler.h,isakmp.c,isakmp.h},
|
||
src/racoon/{isakmp_agg.c,isakmp_base.c,isakmp_inf.c},
|
||
src/racoon/{vendorid.c,vendorid.h}: IKE Fragmentation patch.
|
||
|
||
2004-10-08 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/isakmp_cfg.c: Fixes from Emmanuel Dreyfus.
|
||
|
||
2004-10-06 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/remoteconf.c: dupidvl(), dupetypes() - new functions
|
||
to duplicate dynamically allocatd structures; duprmconf() - call
|
||
these functions to produce private copy of inherited id and etype
|
||
structures.
|
||
* src/racoon/remoteconf.c: declaration for dupetypes().
|
||
|
||
2004-10-04 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/cfparse.y: check inherited_from dereferencing
|
||
* src/racoon/crypto_openssl.c: prevent crash on incorect DNs
|
||
|
||
2004-09-27 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
From KOVACS Krisztian <hidden@balabit.hu>:
|
||
* src/racoon/sockmisc.c(sendfromto): Set src address.
|
||
|
||
2004-09-24 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* configure.ac: added check for linux-gnu, as my box reports
|
||
* src/racoon/grabmyaddr.c: added missing <linux/types.h> include
|
||
|
||
2004-09-21 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
Merged 'autoconf' branch to mainline:
|
||
* .cvsignore, ChangeLog, Makefile.am, bootstrap, configure.ac,
|
||
src/racoon/.cvsignore, src/racoon/cfparse.y,
|
||
src/racoon/crypto_openssl.c, src/racoon/crypto_openssl.h,
|
||
src/racoon/ipsec_doi.c, src/racoon/isakmp.c,
|
||
src/racoon/isakmp_agg.c, src/racoon/isakmp_base.c,
|
||
src/racoon/isakmp_cfg.c, src/racoon/isakmp_ident.c,
|
||
src/racoon/isakmp_unity.c, src/racoon/main.c,
|
||
src/racoon/nattraversal.c, src/racoon/oakley.c,
|
||
src/racoon/oakley.h, src/racoon/sockmisc.c,
|
||
src/racoon/missing/crypto/sha2/sha2.c: Modified (see ChangeLog
|
||
in 'autoconf' branch for details).
|
||
* acracoon.m4, src/racoon/Makefile.am: New files.
|
||
* src/racoon/Makefile.in, src/racoon/aclocal.m4,
|
||
src/racoon/client-puzzle.c, src/racoon/config.guess,
|
||
src/racoon/config.sub, src/racoon/configure.in,
|
||
src/racoon/install-sh, src/racoon/doc/SantaBarbara-result.jp,
|
||
src/racoon/doc/helsinki-result.jp, src/racoon/doc/ibm-result.jp,
|
||
src/racoon/doc/pattern, src/racoon/doc/question,
|
||
src/racoon/doc/racoonquestion.sh, src/racoon/doc/redmond.txt,
|
||
src/racoon/doc/rules.jp, src/racoon/doc/sandiego-result.en,
|
||
src/racoon/doc/sandiego-result.jp,
|
||
src/racoon/doc/sandiego0009-result.en,
|
||
src/racoon/missing/addrinfo.h, src/racoon/missing/getaddrinfo.c,
|
||
src/racoon/missing/getnameinfo.c, src/racoon/samples/Makefile,
|
||
src/racoon/samples/sandiego.pl: Removed.
|
||
|
||
2004-09-17 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/vendorid.[ch]: Rewrote the VendorID handling.
|
||
We don't use the array with fixed offsets anymore, instead
|
||
a generally unordered structure with ID, string and
|
||
precomputed MD5 hashes.
|
||
* src/racoon/{isakmp_agg.c,isakmp_base.c,isakmp_ident.c},
|
||
src/racoon/nattraversal.c: Updated to the new VID model.
|
||
* src/racoon/main.c(main): Precompute VendorIDs.
|
||
* src/racoon/arc4random.h, src/racoon/missing/arc4random.c:
|
||
Files removed. Function arc4random() renamed to eay_random()
|
||
and moved to crypto_openssl.c.
|
||
* src/racoon/pfkey.c, src/racoon/oakley.c, src/racoon/main.c,
|
||
src/racoon/isakmp.c: Updated to the above change.
|
||
* src/racoon/Makefile.in, src/racoon/configure.in: Remove
|
||
arc4random() from building.
|
||
* src/racoon/crypto_openssl.[ch](eay_random): New function.
|
||
* src/racoon/isakmp_cfg.c, src/racoon/isakmp_unity.c,
|
||
src/racoon/isakmp_xauth.c: Cleaned up headers.
|
||
|
||
2004-09-16 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/crypto_openssl.c (base64_encode): Terminate
|
||
the result with '\0'.
|
||
|
||
2004-09-15 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: How about calling the next version 0.5?
|
||
* src/include-glibc/glibc-bugs.h: Define _XOPEN_SOURCE
|
||
_BSD_SOURCE and don't require <linux/types.h>
|
||
* src/racoon/isakmp_cfg.c, src/racoon/isakmp_unity.c,
|
||
src/racoon/isakmp_xauth.c: Don't include <netkey/key_var.h>
|
||
* src/racoon/Makefile.in: Add new files to distribution.
|
||
* src/racoon/configure.in: Fix linux kernel NATT detection.
|
||
* src/setkey/parse.y: Fix types.
|
||
* src/racoon/backupsa.c, src/racoon/ipsec_doi.c,
|
||
src/racoon/isakmp_inf.c, src/racoon/isakmp_quick.c,
|
||
src/racoon/pfkey.c, src/racoon/remoteconf.c,
|
||
src/racoon/session.c, src/racoon/sockmisc.c: Fix headers
|
||
ordering, use HAVE_NETINET6_IPSEC.
|
||
* src/racoon/isakmp_cfg.c: Use %z for size_t.
|
||
* src/racoon/configure.in: Clean up IPv6 stack check.
|
||
|
||
2004-09-15 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
Merged "Hybrid XAUTH" support from Emmanuel Dreyfus:
|
||
* src/racoon/isakmp_cfg.h, src/racoon/isakmp_cfg.c,
|
||
src/racoon/isakmp_unity.c, src/racoon/isakmp_unity.h,
|
||
src/racoon/isakmp_xauth.c, src/racoon/isakmp_xauth.h,
|
||
src/racoon/samples/racoon.conf.sample-cvpn: New files.
|
||
* src/racoon/algorithm.c, src/racoon/algorithm.h,
|
||
src/racoon/cfparse.y, src/racoon/cftoken.l,
|
||
src/racoon/handler.c, src/racoon/handler.h,
|
||
src/racoon/ipsec_doi.c, src/racoon/isakmp.c,
|
||
src/racoon/isakmp.h, src/racoon/isakmp_agg.c,
|
||
src/racoon/isakmp_inf.c, src/racoon/oakley.c,
|
||
src/racoon/oakley.h, src/racoon/strnames.c,
|
||
src/racoon/vendorid.c, src/racoon/vendorid.h: Added
|
||
code for XAUTH support.
|
||
* src/racoon/racoon.conf.5: Documentation for XAUTH.
|
||
* src/racoon/isakmp_base.c, src/racoon/isakmp_ident.c,
|
||
src/racoon/nattraversal.c: Added NATT VID "02\n"
|
||
* src/racoon/configure.in: New config option --enable-hybrid
|
||
|
||
2004-09-14 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Preset CFLAGS
|
||
* src/racoon/configure.in: Preset LDFLAGS instead of CFLAGS on NetBSD,
|
||
Check if printf() accepts "%z" modifiers.
|
||
* src/racoon/isakmp_agg.c(agg_i1send): Place #endif correctly.
|
||
* src/setkey/parse.y(fix_portstr): Init 'p2'.
|
||
* src/setkey/setkey.c: Add required prototypes.
|
||
|
||
2004-09-14 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/gssapi.c: sa_len -> sysdep_sa_len. Patch by Andreas.
|
||
|
||
2004-09-14 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/configure.in: Check for NetBSD NAT-T kernel support.
|
||
|
||
2004-09-13 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/configure.in: Check for <openssl/engine.h>
|
||
* src/racoon/crypto_openssl.c: Only use OpenSSL engines if available.
|
||
* src/racoon/plainrsa-gen.c: Ditto.
|
||
|
||
2004-09-13 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
NetBSD fixes from Emmanuel Dreyfus <manu@netbsd.org>:
|
||
* Makefile.am: build in rpm/ only on Linux
|
||
* configure.ac: Check for netinet6/ipsec.h instead of netinet/ipsec.h
|
||
* src/Makefile.am: Build include-glibc only on Linux
|
||
* src/libipsec/{ipsec_dump_policy.c,ipsec_get_policylen.c,
|
||
ipsec_strerror.c,key_debug.c,pfkey.c,pfkey_dump.c,
|
||
policy_parse.y,policy_token.l,test-policy-priority.c},
|
||
src/racoon/{cfparse.y,cftoken.l,grabmyaddr.c,isakmp.c,
|
||
nattraversal.c,pfkey.c,plainrsa-gen.c,policy.c,
|
||
proposal.c,sainfo.c,schedule.c,strnames.c},
|
||
src/setkey/{parse.y,setkey.c,token.l}: Fix headers and some
|
||
ifdefs.
|
||
* src/racoon/sockmisc.c(sendfromto): Wrap for Linux only.
|
||
* src/racoon/configure.in: Check for kernel NAT-T support,
|
||
fix libipsec.a linkage path.
|
||
* src/racoon/eaytest.c(certtest): Use %z for size_t.
|
||
|
||
2004-09-12 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/grabmyaddr.c: improoved socket selection algorithm for
|
||
case when link-local addresses comes w/o sin6_scope_id set.
|
||
|
||
2004-09-07 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/session.c: fix for SIGHUP handler for case when config
|
||
file contains listen directives.
|
||
|
||
2004-09-01 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/grabmyaddr.c: added scope id handling for link-local
|
||
IPv6 addresses. Now racoon will not err on such addresses.
|
||
|
||
2004-08-19 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/crypto_openssl.c: hmac memory leak fix by R. Ganesan
|
||
* src/racoon/eaytest.c: eay_init_error() -> eay_init() due to
|
||
2004-06-01 changes in src/racoon/crypto_openssl.c
|
||
|
||
2004-08-15 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/cfparse.y src/racoon/crypto_openssl.c
|
||
src/racoon/eaytest.c src/racoon/genlist.h src/racoon/ipsec_doi.c
|
||
src/racoon/racoon.conf.5 src/racoon/remoteconf.c
|
||
src/racoon/remoteconf.h: peers_identifier wildcard and
|
||
list patch by James Matheson
|
||
|
||
---------------------------------------------
|
||
|
||
0.4rc1 released
|
||
|
||
2004-08-09 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* NEWS: Notes for release 0.4rc1
|
||
* configure.ac: Bump up version to 0.4rc1
|
||
|
||
2004-07-12 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
PlainRSA support.
|
||
See ChangeLog.prsa from the 'plainrsa' branch for details.
|
||
* src/racoon/stringlist.c src/racoon/stringlist.h: Removed.
|
||
* src/racoon/genlist.c src/racoon/genlist.h
|
||
src/racoon/plainrsa-gen.8 src/racoon/plainrsa-gen.c
|
||
src/racoon/prsa_par.y src/racoon/prsa_tok.l
|
||
src/racoon/rsalist.c src/racoon/rsalist.h
|
||
src/racoon/samples/racoon.conf.sample-plainrsa: New files.
|
||
* src/racoon/Makefile.in src/racoon/configure.in
|
||
src/racoon/cfparse.y src/racoon/cftoken.l
|
||
src/racoon/crypto_openssl.c src/racoon/crypto_openssl.h
|
||
src/racoon/handler.h src/racoon/ipsec_doi.c
|
||
src/racoon/ipsec_doi.h src/racoon/isakmp.h src/racoon/main.c
|
||
src/racoon/oakley.c src/racoon/plog.c src/racoon/remoteconf.c
|
||
src/racoon/remoteconf.h src/racoon/sockmisc.c
|
||
src/racoon/sockmisc.h src/racoon/eaytest.c: Updated.
|
||
|
||
2004-07-12 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/main.c, src/racoon/eaytest.c, src/racoon/plog.c: Move
|
||
f_foreground to plog.c.
|
||
* src/racoon/proposal.c (cmpsaprop_alloc): Fix printing of encmode
|
||
adjusting.
|
||
* src/racoon/ipsec_doi.c, src/racoon/isakmp.c, src/racoon/isakmp_quick.c,
|
||
src/racoon/oakley.c: Fix typos, newlines and printf() format strings.
|
||
|
||
2004-06-16 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/crypto_openssl.c (eay_get_x509cert): small memory
|
||
leak fix. Noticed B.Buesker, patch L.Stellingwerff
|
||
* src/racoon/crypto_openssl.c (eay_aes_{en|de}crypt, evp_crypt):
|
||
small memory leaks fixed.
|
||
|
||
2004-06-15 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
SECURITY
|
||
* src/racoon/crypto_openssl.[ch] (cb_check_cert_local,
|
||
cb_check_cert_remote): split cb_check_cert() due to stricter
|
||
requirements for certificates received from network.
|
||
* src/racoon/crypto_openssl.[ch] (eay_check_x509cert): new parameter
|
||
local to specify how strict cert check should be
|
||
* src/racoon/oakley.c, src/racoon/eaytest.c: adjust to use above
|
||
|
||
2004-06-11 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/nattraversal.c (natt_vendorid, natt_fill_options): Support
|
||
for all known NAT-T versions.
|
||
* vendorid.h: Ditto.
|
||
|
||
2004-06-08 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/stringlist.c, src/racoon/stringlist.h: New files.
|
||
* src/racoon/Makefile.in: Compile stringlist.o.
|
||
|
||
2004-06-07 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Set version to 'cvs'.
|
||
* src/{racoon,setkey,libipsec}/*.h: Wrap headers between
|
||
#ifndef/#define/#endif to allow multiple inclusions of the
|
||
same file.
|
||
* plog.h (plog): Attribute __printf__ for automatic checking
|
||
of the parameters' validity.
|
||
* cftoken.l, crypto_openssl.c, grabmyaddr.c, ipsec_doi.c,
|
||
isakmp.c, isakmp_quick.c, oakley.c, pfkey.c, proposal.c,
|
||
sockmisc.c: Fix warnings/errors in the plog() parameters with
|
||
the above change.
|
||
|
||
2004-06-05 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/setkey/setkey.c: -n (no action) support.
|
||
Thanks Thomas Habets.
|
||
* src/setkey/setkey.8: Documentation for above.
|
||
* src/racoon/doc/README.certificate: updated link to more recent
|
||
version of document. Debian bug #252513 by Jose Luis Domingo Lopez
|
||
|
||
2004-06-01 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/algorithm.c: Enable compilation without SHA2 support.
|
||
* src/racoon/crypto_openssl.c: Ditto.
|
||
|
||
2004-06-01 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/crypto_openssl.c: Remove unneeded workarounds for older
|
||
OpenSSLs.
|
||
(eay_init): New function.
|
||
(eay_init_error, eay_check_pkcs7sign): Removed.
|
||
* src/racoon/crypto_openssl.h: Reflect the above changes.
|
||
* src/racoon/main.c: Call eay_init() instead of eay_init_error().
|
||
|
||
2004-05-27 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
Support for inheritance of 'remote' statements:
|
||
* src/racoon/cftoken.l: New keyword 'inherit'.
|
||
* src/racoon/cfparse.y: Support for 'inherit', remove
|
||
global 'prhead', use cur_rmconf->prhead instead.
|
||
* src/racoon/remoteconf.c (rmtree): Changed from
|
||
LIST queue to TAILQ queue.
|
||
(getrmconf): Renamed to getrmconf_strict().
|
||
(copyrmconf, duprmconf)
|
||
(dump_rmconf_single, dumprmconf): New functions.
|
||
(rm2str): Deleted.
|
||
* src/racoon/remoteconf.h: Prototypes for the above.
|
||
(struct remoteconf): New fields 'inherited_from' and 'prhead'.
|
||
* src/racoon/sockmisc.c (saddr2str): Can print anonymous entries.
|
||
* src/racoon/algorithm.c (alg_oakley_encdef_name)
|
||
(alg_oakley_hashdef_name, alg_oakley_dhdef_name)
|
||
(alg_oakley_authdef_name): New functions.
|
||
* src/racoon/algorithm.h: Prototpes for the above.
|
||
* src/racoon/strnames.c (num2str): Make extern.
|
||
(s_doi, s_etype, s_idtype, s_switch): New functions.
|
||
* src/racoon/strnames.h: Prototpes for the above.
|
||
* src/racoon/main.c: New parameter -C for dumping the parsed config.
|
||
* src/racoon/racoon.conf.5: Document inheritance.
|
||
* src/racoon/samples/racoon.conf.sample-inherit: Sample config file.
|
||
* src/racoon/Makefile.in: Distribute racoon.conf.sample-inherit
|
||
|
||
2004-05-24 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.in, backupsa.c, ipsec_doi.c, isakmp_inf.c,
|
||
isakmp_quick.c, pfkey.c, remoteconf.c, session.c,
|
||
sockmisc.c: Allow compilation with --disable-ipv6
|
||
|
||
2004-05-21 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/crypto_openssl.[ch]: Use EVP_*() instead of
|
||
algorithm specific functions.
|
||
|
||
2004-05-20 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
Manual page updates. Thanks Brian
|
||
* src/libipsec/ipsec_set_policy.3
|
||
* src/setkey/setkey.8
|
||
* src/libipsec/test-policy-priority.c: new file from policy
|
||
priority patch, which I forgot to add
|
||
|
||
2004-05-18 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
Policy priority integer handling fixes by Brian Buesker.
|
||
* src/libipsec/ipsec_strerror.c
|
||
* src/libipsec/ipsec_strerror.h
|
||
* src/libipsec/libpfkey.h
|
||
* src/libipsec/policy_parse.y
|
||
* src/libipsec/test-policy-priority.c
|
||
Manual page corrections by me
|
||
* src/libipsec/ipsec_set_policy.3
|
||
* src/setkey/setkey.8
|
||
|
||
2004-05-15 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
Policy priority support patch from Brian Buesker. Applied as is
|
||
except src/libipsec/Makefile.am is modified instead of
|
||
src/libipsec/Makefile.in as found in the patch.
|
||
|
||
2004-05-10 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
From Heiko Hund, approved by the copyright holder:
|
||
* src/racoon/gssapi.[ch]: Update to 3-clause BSD license.
|
||
|
||
2004-04-27 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
From Heiko Hund:
|
||
* src/include-glibc/sys/queue.h: Update to 3-clause BSD license.
|
||
|
||
2004-04-26 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/grabmyaddr.c (update_myaddrs): Only trust kernel to
|
||
send notifications about changed interfaces.
|
||
|
||
2004-04-24 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/grabmyaddr.c (recvaddrs): Only trust kernel to send
|
||
information about interfaces. Thanks Steve Grubb and Bill
|
||
Nottingham. Affects users with glibc w/o getifaddrs(). Users
|
||
with glibc earlier than 2003-11-14 should upgrade their glibc.
|
||
|
||
2004-04-19 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/isakmp.c (isakmp_handler): Reject too big
|
||
packets (CAN-2004-0403).
|
||
|
||
---------------------------------------------
|
||
|
||
0.3 released
|
||
|
||
2004-04-14 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* NEWS: Notes for release 0.3
|
||
* configure.ac: Bump up version to 0.3
|
||
* src/racoon/Makefile.in: Use install-sh instead of mkinstalldirs.
|
||
* src/racoon/remoteconf.c (foreachrmconf): Avoid warning about
|
||
uninitialised variable.
|
||
* src/racoon/samples/racoon.conf.in: Cleaned up to work with Linux
|
||
and FreeSWAN.
|
||
|
||
2004-04-13 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/grabmyaddr.c (suitable_ifaddr6): Anycast addresses are
|
||
not suitable.
|
||
|
||
2004-04-09 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/crypto_openssl.c (cb_check_cert): Warn if no CRL is found.
|
||
* src/racoon/isakmp_ident.c (ident_r2recv): Removed debug plog().
|
||
* src/racoon/proposal.c (cmpsatrns): Downgrade severity of trns_id
|
||
mismatch to LLV_WARNING.
|
||
* src/libipsec/pfkey_dump.c, src/racoon/algorithm.c
|
||
src/racoon/algorithm.h src/racoon/cftoken.l
|
||
src/racoon/ipsec_doi.c src/racoon/ipsec_doi.h
|
||
src/racoon/oakley.h src/racoon/pfkey.c src/racoon/strnames.c
|
||
src/setkey/token.l: Renamed Rijndael to AES.
|
||
* src/setkey/token.l: Recognize exit/quit/bye tokens.
|
||
* src/setkey/parse.y (exit_command): New.
|
||
* src/setkey/setkey.c (stdin_loop): Exit when exit_now is set
|
||
in exit_command.
|
||
|
||
2004-04-08 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/setkey/setkey.c (main): Call get_supported() in interactive mode.
|
||
(stdin_loop): Concat multiline input into a single line before parsing.
|
||
|
||
2004-04-07 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/nattraversal.c (natt_keepalive_send): Log sending KA
|
||
with level DEBUG. Having it with level INFO only pollutes logfiles.
|
||
|
||
2004-04-06 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/Makefile.in: eaytest now links plog.o
|
||
* src/racoon/crypto_openssl.c: Remove all #ifdef EAYDEBUG/#endif
|
||
surrounding plog().
|
||
* src/racoon/eaytest.c (rsatest): Enabled RSA tests again, now
|
||
verifying both good and bad signatures.
|
||
|
||
---------------------------------------------
|
||
|
||
0.3rc5 released
|
||
|
||
2004-04-05 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* NEWS: Notes for release 0.3rc5
|
||
* configure.ac: Bump up version to 0.3rc5
|
||
|
||
2004-04-05 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
Fix for a security bug found by Ralf Spenneberg:
|
||
* src/racoon/crypto_openssl.c (eay_check_x509sign): Directly generate
|
||
'evp' instead of 'pubkey'.
|
||
(eay_rsa_sign): Use the above.
|
||
* src/racoon/crypto_openssl.h: Update prototypes for the above.
|
||
* src/racoon/eaytest.c: Disabled RSA tests because of the API change.
|
||
|
||
2004-04-05 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/pfkey.c (pfkey_handler): Safety check before accessing
|
||
the array (thx to Ren.J.Y for report).
|
||
(pkrecvf): Added entry for SADB_X_NAT_T_NEW_MAPPING (NULL for now).
|
||
* src/racoon/strnames.c (name_pfkey_type): Ditto.
|
||
|
||
2004-04-02 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/eaytest.c (ciphertest_1): Correct padlen.
|
||
|
||
2004-04-01 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/ipsec_doi.c (setph2proposal0): Move proposal encmode
|
||
update from here ...
|
||
(ipsecdoi_setph2proposal): ... to here. Hopefully this is a
|
||
better place to do the update.
|
||
|
||
2004-03-30 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/crypto_openssl.c (eay_3des_expand_key): New function.
|
||
(eay_3des_encrypt, eay_3des_decrypt): Expand key if necessary.
|
||
* src/racoon/eaytest.c (ciphertest_1): New function.
|
||
(ciphertest): Simplified to simple calls of ciphertest_1().
|
||
|
||
2004-03-29 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* README: Rewritten. Mentioned where to report bugs.
|
||
|
||
2004-03-26 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Check for readline.h and libreadline.
|
||
* src/setkey/setkey.c: Call stdin_loop() when '-c' was given.
|
||
(stdin_loop): Read user input and parse it line-by-line.
|
||
* src/setkey/token.l (parse_string): New function.
|
||
|
||
---------------------------------------------
|
||
|
||
0.3rc4 released
|
||
|
||
2004-03-25 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Bump up version to 0.3rc4
|
||
* NEWS: Notes for release 0.3rc4
|
||
* src/racoon/cfparse.y (algorithm): Hint about missing module.
|
||
* src/racoon/crypto_openssl.c (eay_3des_*): Check for strict key
|
||
length only with old API.
|
||
(eay_des_encrypt): Ditto.
|
||
* src/racoon/eaytest.c: Make the testsuite usefull, i.e. exit with
|
||
non-zero error code if any of the tests fail.
|
||
(main): Print banner with version.
|
||
* src/racoon/Makefile.in: Run eaytest in 'make check'.
|
||
|
||
2004-03-23 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/isakmp_agg.c (agg_i2recv): Copy remote cookie before
|
||
comparing NAT-D payloads. (thx to Gaurav Kansal for report).
|
||
* src/racoon/crypto_openssl.c: Avoid type-punned warnings.
|
||
* src/racoon/eaytest.c: Disable 'cert' tests.
|
||
* src/racoon/crypto_openssl.c (eay_des_encrypt): No need to check
|
||
for strict length.
|
||
(eay_aes_encrypt): Keylength is in bits, not bytes.
|
||
|
||
2004-03-22 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/setkey/parse.y (ALG_ENC_NOKEY, ALG_ENC_OLD): Use "" for key
|
||
instead of NULL and check for availability.
|
||
|
||
---------------------------------------------
|
||
|
||
0.3rc3 released
|
||
|
||
2004-03-19 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Bump up version to 0.3rc3
|
||
* NEWS: Notes for release 0.3rc3
|
||
* src/racoon/cftoken.l: Add 'null' as an alias for 'null_enc'.
|
||
* src/racoon/proposal.c (cmpsatrns): New parameter proto_id,
|
||
better diagnostic output when trns_id don't match.
|
||
* src/racoon/proposal.h (cmpsatrns): Update prototype.
|
||
* src/setkey/setkey.c: Change option -h to -H (for hexdump), new
|
||
options -h (help) and -V (version).
|
||
* src/setkey/setkey.8: Document the above changes.
|
||
* src/racoon/rfc/*: Many standards related to IPsec/IKE/NAT-T/...
|
||
|
||
2004-03-15 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/configure.in: Prevent compilation error with
|
||
--enable-yydebug.
|
||
|
||
---------------------------------------------
|
||
|
||
0.3rc2 released
|
||
|
||
2004-03-11 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Bump up version to 0.3rc2
|
||
* NEWS: Notes for release 0.3rc2
|
||
* src/racoon/aclocal.m4 (RACOON_CHECK_VA_COPY): New test.
|
||
* src/racoon/configure.in: Call RACOON_CHECK_VA_COPY
|
||
* src/racoon/plog.c (plogv): Replace va_copy() with VA_COPY.
|
||
* src/racoon/racoon.conf.5: Note that NAT-T support is a compile
|
||
time option.
|
||
|
||
2004-03-10 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/racoon.conf.5: Document nat_traversal option.
|
||
* src/racoon/racoon.8: DOcument new options (-L and -P).
|
||
|
||
2004-03-09 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/grabmyaddr.c (autoconf_myaddrsport): Prepare addrs for
|
||
UDP-Encap ports if NAT-T is enabled.
|
||
(dupmyaddr): New function.
|
||
* src/racoon/grabmyaddr.h: Prototype for dupmyaddr().
|
||
* src/racoon/isakmp.c (isakmp_open): Complain if NAT-T is enabled, but
|
||
no port for UDP-Encap was open.
|
||
* src/racoon/isakmp_var.h (PORT_ISAKMP_NATT): New define.
|
||
* src/racoon/localconf.c, src/racoon/localconf.h: Define and setup
|
||
lcconf->port_isakmp_natt.
|
||
* src/racoon/main.c (main): Print nicer banner,
|
||
(usage): Document new options (-L and -P).
|
||
(parse): Recognise the above.
|
||
* src/racoon/nattraversal.c (natt_fill_options): Don't use hardcoded
|
||
constants for float_port.
|
||
(natt_enabled_in_rmconf, natt_enabled_in_rmconf_stub): New functions.
|
||
* src/racoon/nattraversal.h: Prototype for natt_enabled_in_rmconf().
|
||
* src/racoon/plog.c: Don't print source:line:function by default.
|
||
* src/racoon/remoteconf.c (foreachrmconf): New helper function.
|
||
* src/racoon/remoteconf.h: Prototype for the above.
|
||
* package_version.h: Define strings for use in banners.
|
||
* configure.ac: Fill up the above header.
|
||
|
||
2004-03-09 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/configure.in: Don't put -O into OPTFLAGS,
|
||
add new option --disable-natt.
|
||
* src/racoon/cfparse.y, src/racoon/handler.c,
|
||
src/racoon/ipsec_doi.c, src/racoon/isakmp.c,
|
||
src/racoon/isakmp_agg.c, src/racoon/isakmp_base.c,
|
||
src/racoon/isakmp_ident.c, src/racoon/pfkey.c,
|
||
src/racoon/proposal.c, src/racoon/session.c: Replace WITH_NATT
|
||
with ENABLE_NATT.
|
||
* src/racoon/crypto_openssl.c: Replace %d with %zd for size_t arguments.
|
||
|
||
2004-03-06 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* configure.ac: Refuse to continue if lexer library (yywrap()
|
||
function) is missing. Should prevent bugs like #892067, #908758
|
||
* src/racoon/configure.in: renamed --with-ssleay to --with-openssl.
|
||
Users should not be given false idea that they require both OpenSSL
|
||
and SSLeay to compile racoon. (See bug #902197)
|
||
|
||
---------------------------------------------
|
||
|
||
0.3rc1 released
|
||
|
||
2004-03-04 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* configure.ac: Bump up version to 0.3rc1
|
||
* NEWS: Mention release 0.3rc1 (and copy 0.2.3 and 0.2.4 notes
|
||
from 0.2 branch).
|
||
* src/racoon/samples/racoon.conf.sample-natt: New sample config file.
|
||
* src/racoon/Makefile.in: Tweak file lists to make 'distcheck' happy,
|
||
enabled NATT by default (will become a config option later).
|
||
|
||
2004-03-04 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
Merge with 'nat-t_branch' to bring NAT-T (NAT traversal) support
|
||
to racoon.
|
||
* src/racoon/Makefile.in, src/racoon/cfparse.y,
|
||
src/racoon/cftoken.l, src/racoon/grabmyaddr.c,
|
||
src/racoon/grabmyaddr.h, src/racoon/handler.c,
|
||
src/racoon/handler.h, src/racoon/ipsec_doi.c,
|
||
src/racoon/ipsec_doi.h, src/racoon/isakmp.c, src/racoon/isakmp.h,
|
||
src/racoon/isakmp_agg.c, src/racoon/isakmp_base.c,
|
||
src/racoon/isakmp_ident.c, src/racoon/isakmp_quick.c,
|
||
src/racoon/localconf.c, src/racoon/localconf.h,
|
||
src/racoon/pfkey.c, src/racoon/proposal.c, src/racoon/proposal.h,
|
||
src/racoon/racoon.conf.5, src/racoon/remoteconf.c,
|
||
src/racoon/remoteconf.h, src/racoon/session.c,
|
||
src/racoon/strnames.c, src/racoon/vendorid.h
|
||
src/libipsec/pfkey.c,
|
||
src/racoon/nattraversal.c, src/racoon/nattraversal.h,
|
||
src/racoon/sockmisc.c: Affected files.
|
||
|
||
2004-02-27 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/isakmp.c (set_isakmp_header1): Renamed from
|
||
set_isakmp_header().
|
||
(set_isakmp_header): New function common for set_isakmp_header1()
|
||
and set_isakmp_header2().
|
||
(copy_ph1addresses): Obey original port.
|
||
(isakmp_plist_append, isakmp_plist_set_all): New helper functions.
|
||
* src/racoon/isakmp_var.h: Prototypes for the above.
|
||
* src/racoon/isakmp.h (struct payload_list): New structure.
|
||
* src/racoon/isakmp_agg.c, src/racoon/isakmp_base.c,
|
||
src/racoon/isakmp_ident.c: Use isakmp_plist_* functions.
|
||
|
||
2004-02-03 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/Makefile.in: Fix install to $(sbindir)
|
||
* src/setkey/parse.y: Avoid GCC 3.3 warning (type-punned pointer).
|
||
|
||
2004-01-19 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* rpm/ipsec-tools.FC1: Startup script for Fedora Core 1
|
||
(thanks to Kimmo Koivisto <kimmo.koivisto@surfeu.fi>)
|
||
|
||
2004-01-17 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
* src/racoon/isakmp_inf.c: endian mismatch fix. From iij seil team
|
||
|
||
2004-01-15 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/isakmp_inf.c: Prevent unauthorized deletion of SA
|
||
(reported on bugtraq, fixed by iij seil team).
|
||
* src/racoon/isakmp.c: Don't try to bind to IPv6 multicast addresses.
|
||
|
||
2004-01-14 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/plog.c: Fix segfault on AMD64 (va_list can be used
|
||
only once).
|
||
* configure.ac: Don't build shared libipsec by default (can be
|
||
enabled by --enable-shared).
|
||
* bootstrap: Don't run automake for racoon.
|
||
|
||
2004-01-12 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/configure.in: Fix AC_DEFINEs to make autoheader happy,
|
||
use config.h for defines instead of -DHAVE_* gcc options,
|
||
fix CRYPTOBJS to include missing rijndael libraries only once,
|
||
checking for AES support in OpenSSL now (hopefully) finally
|
||
works on both OpenSSL 0.9.6 and 0.9.7.
|
||
* src/racoon/*.[cyl]: Include autogenerated "config.h"
|
||
* src/racoon/missing/crypto/*/*.c: Ditto.
|
||
* src/racoon/.cvsignore: Add config.h, config.h.in
|
||
|
||
2004-01-09 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/.cvsignore: Add "autom4te.cache" and "configure".
|
||
|
||
2004-01-09 Aidas Kasparas <a.kasparas@gmc.lt>
|
||
|
||
Sync with KAME 2004-01-07
|
||
* src/libipsec/pfkey.c: memory leak fix; comment typo fixes
|
||
* src/libipsec/{pfkey.c,pfkey_dump.c}: allow compilation even
|
||
no SADB_X_EXT_TAG defined
|
||
* src/libipsec/pfkey_dump.c: information about algorithms
|
||
ripemd160, aes-xcbc, aes-ctr; bigger buffers; <tag> support
|
||
* src/libipsec/policy_parse.y: memory leak
|
||
* src/libipsec/policy_token.l: memory leak
|
||
* src/libipsec/test-policy.c: unneeded \n removed
|
||
* src/racoon/Makefile.in: $(sbindir) support
|
||
* src/racoon/admin.c: interface changes due to proxy support
|
||
* src/racoon/algorithm.c: SHA2 #ifdefs
|
||
* src/racoon/{cfparse.y,cftoken.l}: license text added
|
||
* src/racoon/cfparse.y: mip6 obsoleted by proxy support
|
||
* src/racoon/cfparse.y: from directive support; new algorithms
|
||
* src/racoon/cftoken.l: support for globbing of include files
|
||
* src/racoon/configure.in: more verbose information about problems
|
||
with SHA2
|
||
* src/racoon/crypto_openssl.c: use new DES API if supported; algorithm
|
||
key size fixes
|
||
* src/racoon/eaytest.c: SHA2 #ifdefs; keysize len check
|
||
* src/racoon/ipsec_doi.c: use VPTRINIT; ESP parameter validity checks;
|
||
style change
|
||
* src/racoon/isakmp.c: use VPTRINIT; interface changes due to
|
||
mip6->proxy; typo
|
||
* src/racoon/isakmp_inf.c: use VPTRINIT
|
||
* src/racoon/isakmp_quick.c: mip6->proxy
|
||
* src/racoon/kmpstat.c: not used variables removed
|
||
* src/racoon/pfkey.c: mip6->proxy; schedule leak
|
||
* src/racoon/proposal.c: style
|
||
* src/racoon/remoteconf.c: mip6->proxy
|
||
* src/racoon/sainfo.c: from directive support
|
||
* src/racoon/sockmisc.c: side correction; addrinfo leak
|
||
* src/racoon/strnames.c: typo in descriptions; wrong upper bound check
|
||
* src/racoon/missing/crypto/sha2/sha2.c: wrong size
|
||
* src/setkey/parse.y: extra algorithms; tagged; not needed periods
|
||
removed; memory shortage checks
|
||
* src/setkey/setkey.8: typos; tagged; new algorithms
|
||
* src/setkey/setkey.c: standard argument names for main(); hexdump
|
||
support; info in file support
|
||
* src/setkey/token.l: new algorithms; memory shortage checks
|
||
Parts not taken from KAME:
|
||
* kernelfs stuff;
|
||
* sysctl stuff
|
||
|
||
2004-01-08 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/config.{sub,guess}: Update from automake 1.7.
|
||
|
||
2004-01-08 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
Patch from Kostadin Karaivanov <larry@minfin.bg>:
|
||
* src/racoon/configure.in: Check for openssl/aes.h.
|
||
* src/racoon/crypto_openssl.c: Use OpenSSL AES functions if available.
|
||
|
||
2004-01-08 Michal Ludvig <mludvig@suse.cz>
|
||
|
||
* src/racoon/configure: Remove, should be regenerated by bootstrap.
|
||
|
||
2004-01-02 Michal Ludvig <michal@logix.cz>
|
||
|
||
* src/racoon/crypto_openssl.c: Update to work with OpenSSL 0.9.7
|
||
(by Brian Buesker <bbuesker@qualcomm.com>
|
||
and Christophe Saout <christophe@saout.de>)
|
||
* src/racoon/proposal.c: Be more verbose. (Michal Ludvig)
|
||
* src/libipsec/ipsec_dump_policy.c: Dump FWD policies correctly
|
||
(by Michal Ludvig).
|
||
* src/setkey/token.l, src/setkey/parse.y: Add support for lifetime
|
||
specified in bytes (by Michal Ludvig).
|
||
* src/setkey/setkey.8: Document -bh/-bs options for the above feature.
|
||
* src/libipsec/pfkey.c: Don't include 'sadb_key' in SADB_UPDATE
|
||
message for IPcomp SA. (by Brian Buesker <bbuesker@qualcomm.com>)
|
||
* src/racoon/cfparse.y: Flush SA on SIGHUP
|
||
(by Brian Buesker <bbuesker@qualcomm.com>)
|
||
* src/racoon/pfkey.c: IPcomp fixes
|
||
(by Brian Buesker <bbuesker@qualcomm.com>)
|
||
* src/racoon/proposal.c: Fix typo lifebyte -> lifetime.
|
||
* src/racoon/grabmyaddr.c: Prevent segfault if getifaddrs() returns
|
||
an entry with NULL ifa_addr (Michal Ludvig).
|
||
* configure.ac: Change path to kernel headers
|
||
from /usr/src/devel-2.5/devel to /usr/src/linux
|
||
* bootstrap: Use default tools, reconfigure src/racoon
|
||
* src/racoon/configure.in: Change LIBOBJS -> AC_LIBOBJ,
|
||
changed comments from 'dnl' to '#'.
|
||
|
||
2003-06-20 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* src/racoon/aclocal.m4:
|
||
* src/racoon/configure:
|
||
Don't execute "for i in $3" if "$3" doesn't exist.
|
||
Fixes bug #721296.
|
||
|
||
2003-03-31 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* src/setkey/parse.y: change the NAT-T Type to use UDP_ENCAP_ESPINUDP
|
||
(which is value '2')
|
||
|
||
2003-03-27 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* src/libipsec/key_debug.c: use ntohs() before printing port
|
||
* src/libipsec/pfkey.c: convert port# to network byte order
|
||
* src/libipsec/pfkey_dump.c: use ntohs() before printing ports
|
||
* src/setkey/parse.y: convert port#'s to network byte order
|
||
|
||
2003-03-24 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* src/libipsec/pfkey.c: Don't switch off NAT-T extensions
|
||
if they don't exist in the kernel.
|
||
|
||
* src/racoon/sockmisc.c: use '34' for IPV6_IPSEC_POLICY,
|
||
as per Tom Lendacky <toml@us.ibm.com>. Also move the
|
||
setting of IPV6_IPSEC_POLICY to the top of the file.
|
||
|
||
2003-03-13 Derek Atkins <derek@ihtfp.com>
|
||
|
||
Add initial support for NAT-T PFKey Extensions:
|
||
* src/libipsec/key_debug.c: add support to print information
|
||
about NAT-T extension packets.
|
||
* src/libipsec/libpfkey.h: add two new APIs to support NAT-T
|
||
for add and update as part of the SADB.
|
||
* src/libipsec/pfkey.c:
|
||
- Implement extended APIs to support NAT-T for add and update
|
||
of the SADB.
|
||
- Add APIs to fill a buffer with NAT-T packet types
|
||
* src/libipsec/pfkey_dump.c: Extend the SADB output to include
|
||
PFKey packets. Put port numbers with the source and dest
|
||
addresses, add an 'esp-udp' SA-type, and add a printout for
|
||
the NAT-OA.
|
||
* src/setkey/parse.y:
|
||
- Extend setkey to create an ESP-UDP SA.
|
||
- default UDP port is 4500
|
||
- extend 'add' to allow <ip-addr>[<portnum>] for source and dest
|
||
(the portnum specification requires the [] characters)
|
||
- add an ESPUDP "protocol" from the lexer. This will use
|
||
ESP and allow an optional Original Address setting.
|
||
- add a function to get a udp port from a struct sockaddr *
|
||
- pass the NAT-T extentions into PFKey
|
||
* src/setkey/token.l: add "esp-udp" token
|
||
|
||
* rpm/ipsec-tools.spec.in: Bill Nottingham's SPEC-file patch:
|
||
This switches it to use %{_lib} (for /lib64 systems such as
|
||
x86-64 and s390x, and has it own the /etc/racoon directory in
|
||
the package as well.
|
||
|
||
---------------------------------------------
|
||
|
||
0.2.2 released
|
||
|
||
2003-03-13 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* configure.am, NEWS:
|
||
Update for 0.2.2 release
|
||
|
||
* Makefile.am: distribute depcomp
|
||
|
||
2003-03-10 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* src/racoon/Makefile.in: add @LEXLIB@ to the LIBS line to make
|
||
sure we link against the lexer library when necessary.
|
||
|
||
2003-03-07 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* configure.am:
|
||
* Makefile.am:
|
||
* rpm/Makefile.am:
|
||
* rpm/ipsec-tools.spec.in:
|
||
Added RPM SPEC to CVS
|
||
|
||
---------------------------------------------
|
||
|
||
0.2.1 released
|
||
|
||
2003-03-07 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* src/racoon/configure.in: change "CFLAGS" to "CPPFLAGS" for
|
||
ssl include directory, to make sure the other tests work properly.
|
||
|
||
2003-03-06 Derek Atkins <derek@ihtfp.com>
|
||
|
||
* src/racoon/kmpstat.c: fix gcc-3.2.2 compiler warning
|
||
|
||
* src/racoon/configure.in: look for krb5-config and don't
|
||
use it if it's not found. Fixes a configure-time warning.
|
||
|
||
--------------------------------------------
|
||
|
||
0.2 Released
|