summaryrefslogtreecommitdiff
path: root/crypto/dist/ipsec-tools/src/racoon/handler.h
AgeCommit message (Collapse)Author
2017-01-24PR/51682: Avoid DoS with fragment out of order insertion; keep fragmentschristos
sorted in the list.
2010-11-17Fix my previous patch to not call purge_remote() twice. Change the placetteras
where purge_remote() is called. This fixes also a possible crash from the same patch since ph1->remote can be NULL (when we are responder and config is not yet selected).
2010-11-12Improve DPD sequence checks to allow any reply within valid sequence windowtteras
to be proof of livelyness. This can improves things if there's random packet delays, or if racoon is not getting enough CPU time.
2010-10-21Remove initial-contact entry when all ISAKMP-SA are purged via adminport.tteras
This will avoid stale security associations if some of the delete notifications happens to get lost.
2009-09-03When rekeying phase2 use phase1 used to negotiate phase2 as a hint totteras
select the phase1 for rekeying the new phase2.
2009-07-03Get rid of the evil CMPSADDR macro. Trac #295.tteras
2009-03-12Support multiple anonymous remotes and decide remoteconf based on identity,tteras
received certificates and other information. General code clean up.
2009-01-23Detect if monotonic system clock is available, and use it for relativetteras
time measurements to avoid complite hang if time jumps backwards.
2009-01-23Introduce vendorid bitmask that can be used otherwhere to detect peertteras
capabilities.
2008-12-05From Arnaud Ebalard:tteras
Improved Mobile IPv6 support per draft-ebalard-mext-pfkey-enhanced-migrate.
2008-09-19Implement ISAKMP SA rekeying configurable with rekey {on|off|force} optiontteras
in remote conf.
2008-09-19Change struct sched to be allocated be the caller to avoid some memorytteras
allocations. Optimize scheduling algorithm to not scan all entries in the main loop.
2008-07-14Handle RESPONDER-LIFETIME notification in quick mode.tteras
2008-07-14Clean up notification payload handling. Handle INITIAL-CONTACT notificationtteras
in last main mode exchange (delayed) and during quick mode exchanges.
2008-03-06Refactor admin socket event protocol to be less error prone. Backwards ↵mgrooms
compatibility is provided. Submitted by Timo Teras.
2008-01-11added an 'established' arg to getph1byaddr()vanhu
2007-12-12Add support for nat-t oa payload handling. Submitted by Timo Teras.mgrooms
2006-09-09Migration of ipsec-tools to NetBSD CVS part 2: resolving the import conflicts.manu
Since we previously had a release branch and we import here the HEAD of CVS, let's assume all local changes are to be dumped. Local patches should have been propagated upstream, anyway.
2005-11-21Merge ipsec-tools 0.6.3 importmanu
2005-08-20Update to ipsec-tools 0.6.1manu
2005-08-07Resolve conflicts caused by recent ipsec-tools-0.6.1rc1 import by preferingmanu
the newer software. Some useful local change might have been overwritten, we'll take care of this soon.
2005-05-08Add a prototype for getph2bysaddr(), fixes build problem for isakmp.c.he
2005-05-08More NAT-T fixes for the situation where racoon acts as a VPN clientmanu
Flush SA and generated SP on DPD timeout and deletion payloads
2005-05-03on phase 2 acquire, lookup phase 2 by (src, dst, policy id) so thatmanu
multiple SA can be used in transport mode While I'm there, patch ipsec-tools ChangeLog to reflect the changes we took from ipsec-tools-0_6-branch
2005-04-19Fix simple DES support (security problems for racoon to racoon setups)manu
Fix broken generated policies flush
2005-02-23Import ipsec-tools 0.6 branch as of 2005/02/23. News from last imported versionmanu
according to ipsec-tools' ChangeLog: 2005-02-23 Emmanuel Dreyfus <manu@netbsd.org> * configure.ac, src/racoon/{Makefile.am|crypto_openssl.c}: optionnal support for patented algorithms: IDEA and RC5. * src/racoon/{isakmp_xauth.c|main.c}: don't initialize RADIUS if it is not required in the configuration * src/racoon/isakmp.c: do not reject addresses for which kernel refused UDP encapsulation, they can still be used for non NAT-T traffic (eg: NAT-T enabled racoon on non NAT-T enabled kernel) 2005-02-18 Emmanuel Dreyfus <manu@netbsd.org> * src/racoon/{main.c|eaytest.c|plairsa-gen.c} src/setkey/setkey.c: don't use fuzzy paths for package_version.h 2005-02-18 Yvan Vanhullebus <vanhu@free.fr> * src/racoon/isakmp_inf.c: Purge generated SPDs when getting a related DELETE_SA * src/racoon/pfkey.c: do NOT unbindph12() when SA acquire 2005-02-17 Emmanuel Dreyfus <manu@netbsd.org> From Fred Senault <fred.letter@lacave.net> * src/racoon/remoteconf.c: Fix a bug in script init 2005-02-17 Yvan Vanhullebus <vanhu@free.fr> * src/racoon/ipsec_doi.c: Workaround for phase1 lifetime checks 2005-02-15 Michal Ludvig <michal@logix.cz> * configure.ac: Changed --enable-natt_NN to --enable-natt-versions=NN,NN
2005-02-12Import ipsec-tools (tag ipsec-tools-0_6-base in ipsec-tools CVS)manu
ipsec-tools is a fork from KAME racoon/libipsec/setkey, with many enhancements.