summaryrefslogtreecommitdiff
path: root/crypto/dist/ipsec-tools/src
AgeCommit message (Collapse)Author
2023-05-09Deal with OpenSSL-3.xchristos
2023-02-27cast to the correct message structure (rt_msghdr instead of if_msghdr)kardel
2022-10-11Add parser sadb_x_policy_flags to libipsec/key_debug.knakahara
2022-04-21ipsec-tools: in lint mode, keep keyword 'inline'rillig
This avoids hundreds of lint warnings for OpenSSL's stack definitions: openssl/x509.h(75): warning: static function sk_X509_NAME_ENTRY_num unused [236]
2022-01-23PR/56658: Juraj Hercek: Plain RSA keys are not loaded by racoon IKE daemonchristos
2022-01-23PR/56657: Juraj Hercek: Add plainrsa-gen utility mentioned in racoon.conf(5)christos
and fix it for OpenSSL 1.1
2022-01-01s/implemenation/implementation/ in comment.msaitoh
2021-12-05s/vlaue/value/msaitoh
2021-12-05s/stauts/status/msaitoh
2021-12-05s/preceed/preced/msaitoh
2021-12-05s/from from/from/ in comment.msaitoh
2021-12-05s/funtion/function/ in comment.msaitoh
2021-09-14ipsectools: fix lint errorrillig
Returning a value from a void function is a GNU extension, but even in GNU mode, lint does not allow these. No functional change.
2021-09-06libipsec: fix undefined behavior when calling isprintrillig
2021-08-09fix typos in asymmetry, asymmetric(al), symmetrical.andvar
2021-07-24Fix all remaining typos, mainly in comments but also in few definitions and ↵andvar
log messages, reported by me in PR kern/54889. Also fixed some additional typos in comments, found on review of same files or typos.
2020-11-25Add ldap parameters debug and timeout.bouyer
Fix bug when using URI (use correct len for malloc) document ldap parameters uri, debug and timeout.
2020-11-25Add an option to pass a ldap uri, instead of just server and port.bouyer
uri takes precedence.
2020-11-25Fix ldap: ldap_sasl_bind_s() doens't like a NULL struct berval *, passbouyer
a pointer to a zero'd struct instead. While there use LDAP_SASL_SIMPLE instead of NULL for mechanism, and check return of ldap_set_option().
2020-11-25Reduce previouschristos
2020-11-25Fix address advancing for i386 and other 32-bit platforms.kardel
Makes racoon grok IPv6 addresses again on these platforms.
2020-06-05fix wrong size addition (Andrew Cagney)christos
XXX: This file is nearly identical with /usr/src/sys/netipsec/key_debug.c and should be merged.
2020-05-14Remove extra semicolon.msaitoh
2020-05-12- in script mode always output errors to stderr prefixed by the program name.christos
- in command mode always output errors to stdout not prefixed " " " - perror(3) -> warn(3)
2020-05-12Keep track of the filename to print in error messages.christos
Change quoting of error string from [] to `'.
2020-05-10prefix errors with the program name and use stderr.christos
2019-07-23Remove superfluous Li; rename section to match standards.wiz
2019-07-23setkey: document getspi and updateozaki-r
2019-07-23setkey: enable to use the getspi APIozaki-r
If a specified SPI is not zero, tell the kernel to use the SPI by using SADB_EXT_SPIRANGE. Otherwise, the kernel picks a random SPI. It enables to mimic racoon.
2019-02-03mark promisc() __dead - it never returns.mrg
2018-11-19Use Cm instead of Li or Ar for fixed command stringsozaki-r
2018-10-14Remove dead files that have never been built, and likely can't build sincemaxv
they are not correct C files.
2018-10-14Clean up setkey: remove dead wood, KNF, localify, and slightly improve.maxv
2018-10-13Fix SF#24: incorrect authentication algorithms, copy-pasto.maxv
2018-10-13Fix ticket SF#91: pass the correct size for tbuf.maxv
2018-10-05From Thomas Reim:christos
Current racoon code cannot detect duplicate last fragments as it uses the fragment flag instead of the fragment number. The code does not consider that the IKE payload fragments might not be received in the correct order. In this case, packet complete detection will again fail and VPN clients abandoned from VPN service. Nevertheless, clients still can add fragments to the fragment queue and fill it up to the possible 255 fragments. Only duplicates are detected, but not the fragments with a number greater than the last fragment number. The last fragment number is kept in the Phase 1 handler after fragment queue deletion, which may lead to error notifications after succesful reassembly of the IKE phase 1 message. In general, the 2017's CVE fix added laconic and difficult to understand failure notifications, which do not much help for analysis, why a VPN client was blocked by racoon server. This patch fixes the code and aligns it to Microsoft/Cisco IKE fragmentation specification. It provides error logging which is in line with above specification and adds some debug info to the logs to better support analysis VPN client blackballing. XXX: pullup-8
2018-10-02PR/53646: Thomas Reim: Incorrect detection of the packet complete code inchristos
fragment list check. While the fix in https://launchpad.net/~rdratlos/+archive/ubuntu/racoon - if (i > last_frag) /* It is complete */ + if (i >= last_frag) /* It is complete */ has the correct behavior, it violates the test for successful completion of the invariant of the loop: for (i = 1; i <= last_frag; i++) { if (!check_fragment_index()) break; } if (i > last_frag) return ok; It is better to move the check for NULL in the loop earlier, so that the final iteration is done and the test is kept the same. It makes the code easier to understand and preserves the original intent. XXX: pullup-8
2018-09-06Remove dead references to netinet6/ipsec.h.maxv
2018-09-06sync with realitymaxv
2018-08-28fix memory leaks: https://github.com/NetBSD/src/issues/6christos
2018-05-28drop __P, suggested by sevanmaxv
2018-05-28drop __P, suggested by sevanmaxv
2018-05-28fix -Wold-style-definitionmaxv
2018-05-28Remove ipsec_bindump, there is no prototype, so the function can't be used.maxv
2018-05-28fix -Wdiscarded-qualifiersmaxv
2018-05-28fix -Wunused and -Wold-style-definitionmaxv
2018-05-20Style.maxv
2018-05-19Remove dead code, and style.maxv
2018-05-19Remove unused 'error' variables, it's obvious they should have no use.maxv
2018-05-19Use strict prototypes, when they don't introduce more warnings than they fix.maxv
Also localify a few functions.