summaryrefslogtreecommitdiff
path: root/lib/libipsec/pfkey.c
AgeCommit message (Collapse)Author
2005-02-19Switch to ipsec-tools for libipsec, setkey, and racoon. Fromthorpej
Emmanuel Dreyfus, with some small changes by me.
2004-10-13I'm not sure what the comment is trying to say, but it can say it withabs
'making' at least as well as 'makeing'.
2004-04-25Initial commit of a port of the FreeBSD implementation of RFC 2385jonathan
(MD5 signatures for TCP, as used with BGP). Credit for original FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship credited to sentex.net. Shortening of the setsockopt() name attributed to Vincent Jardin. This commit is a minimal, working version of the FreeBSD code, as MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp modified to set the TCP-MD5 option; BMS's additions to tcpdump-current (tcpdump -M) confirm that the MD5 signatures are correct. Committed as-is for further testing between a NetBSD BGP speaker (e.g., quagga) and industry-standard BGP speakers (e.g., Cisco, Juniper). NOTE: This version has two potential flaws. First, I do see any code that verifies recieved TCP-MD5 signatures. Second, the TCP-MD5 options are internally padded and assumed to be 32-bit aligned. A more space-efficient scheme is to pack all TCP options densely (and possibly unaligned) into the TCP header ; then do one final padding to a 4-byte boundary. Pre-existing comments note that accounting for TCP-option space when we add SACK is yet to be done. For now, I'm punting on that; we can solve it properly, in a way that will handle SACK blocks, as a separate exercise. In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c ,and modifies: sys/net/pfkeyv2.h,v 1.15 sys/netinet/files.netinet,v 1.5 sys/netinet/ip.h,v 1.25 sys/netinet/tcp.h,v 1.15 sys/netinet/tcp_input.c,v 1.200 sys/netinet/tcp_output.c,v 1.109 sys/netinet/tcp_subr.c,v 1.165 sys/netinet/tcp_usrreq.c,v 1.89 sys/netinet/tcp_var.h,v 1.109 sys/netipsec/files.netipsec,v 1.3 sys/netipsec/ipsec.c,v 1.11 sys/netipsec/ipsec.h,v 1.7 sys/netipsec/key.c,v 1.11 share/man/man4/tcp.4,v 1.16 lib/libipsec/pfkey.c,v 1.20 lib/libipsec/pfkey_dump.c,v 1.17 lib/libipsec/policy_token.l,v 1.8 sbin/setkey/parse.y,v 1.14 sbin/setkey/setkey.8,v 1.27 sbin/setkey/token.l,v 1.15 Note that the preceding two revisions to tcp.4 will be required to cleanly apply this diff.
2004-02-24occured -> occurred. From Peter Postma.wiz
2003-09-26Process has only one c. From miod@openbsd.wiz
2003-08-26protect SADB_X_EXT_TAG with #ifdefitojun
2003-08-26typoitojun
2003-07-22cosmeticitojun
2003-03-09use __RCSID()lukem
2003-03-04Avoid memory leak. Pointed out by Patrick Latifi <patrickl at secureops dot com>christos
2002-05-14sync with latest kame setkey(8), modulo icmp6 hack.itojun
pfkey.c is now more picky about buffer length validation. spddump (setkey -DP) will print lifetime information.
2001-09-16Spell 'occurred' with two 'r's.wiz
2000-07-03More include cleanup. Remvoe (p) from #undef in libipsec.matt
2000-06-12sync with almost-latest KAME IPsec. full changelog would be too bigitojun
to mention here. notable changes are like below. kernel: - make PF_KEY kernel interface more robust against broken input stream. it includes complete internal structure change in sys/netkey/key.c. - remove non-RFC compliant change in PF_KEY API, in particular, in struct sadb_msg. we cannot just change these standard structs. sadb_x_sa2 is introduced instead. - remove prototypes for pfkey_xx functions from /usr/include/net/pfkeyv2.h. these functions are not supplied in /usr/lib. setkey(8): - get/delete does not require "-m mode" (ignored with warning, if you specify it) - spddelete takes direction specification
2000-03-13hide shouldn't-be-exported symbols from the outside.itojun
don't compile pfkey*, since we expect tons of changes in the near future. bump shlib major (due to less exported APIs than before - am I correct here?).
2000-02-08use proper include path (net/pfkeyv2.h)itojun
2000-02-08don't include in6.h directly.itojun
2000-01-31upgrade libipsec to the latest.itojun
- parser now uses yacc/lex (there'll be no symbol conflict). - outbound policy and inbound policy is now separate - policy specification for tunnel SA is improved - api changed, bump shlib major XXX some of programs will become not buildable - will commit shortly
1999-09-16temporary workaround against KAME PR 154.itojun
http://www2.kame.net/dev/query-pr.cgi?pr=154 This allows many keys to be dumped via "setkey -D", or many keys to be configured by single "setkey -c < foo" command.
1999-07-04add NetBSD RCS ID on the top.itojun
retain KAME RCS ID where there was one.
1999-07-03s/CFLAGS/CPPFLAGS/ for -D and -I.itojun
remove lint error.
1999-07-02More trailing white space.simonb
1999-07-01ipsec support library.itojun
mainly for debugging, and policy text->binary conversion. NO crypto code is included so it is export safe.