12011-03-17 Yvan Vanhullebus <vanhu@netasq.com> 2 3 * src/racoon/oakley.c: fixed a memory leak in 4 oakley_append_rmconf_cr() while generating plist. patch by Roman 5 Hoog Antink <rha@open.ch> 6 7 * src/racoon/oakley.c: free name later, to avoid a memory use after 8 free in oakley_check_certid(). also give iph1->remote to some plog() 9 calls. patch by Roman Hoog Antink <rha@open.ch> 10 11 * src/racoon/oakley.c: fixed a memory leak in 12 oakley_check_certid(). patch by Roman Hoog Antink <rha@open.ch> 13 142011-03-15 Yvan Vanhullebus <vanhu@netasq.com> 15 16 * src/racoon/: isakmp.c, isakmp_inf.c, pfkey.c: directly call 17 isakmp_ph1delete() instead of scheduling isakmp_ph1delete_stub(), as 18 it is useless an can lead to memory access after free 19 202011-03-14 Timo Teras <timo.teras@iki.fi> 21 22 * src/racoon/: grabmyaddr.c, handler.c, isakmp.c, isakmp_inf.c, 23 isakmp_quick.c, nattraversal.c, pfkey.c, policy.c, sockmisc.c, 24 sockmisc.h, throttle.c: Explicitly compare return value of 25 cmpsaddr() against a return value define to make it more obvious 26 what is the intended action. One more return value is also added, to 27 fix comparison of security policy descriptors. Namely, getsp() 28 should not allow wildcard matching (as the comment says, it does 29 exact matching) - otherwise we get problems when kernel has generic 30 policy with no ports, and a second similar policy with ports. 31 322011-03-14 Yvan Vanhullebus <vanhu@netasq.com> 33 34 * src/racoon/: cfparse.y, isakmp_xauth.c, isakmp_xauth.h, 35 remoteconf.c, remoteconf.h, rsalist.c, rsalist.h: avoid some 36 memory leaks / free memory access when reloading conf and have 37 inherited config. patch from Roman Hoog Antink <rha@open.ch> 38 39 * src/racoon/handler.c: removed an useless comment 40 41 * src/racoon/handler.c: check if we got RMCONF_ERR_MULTIPLE from 42 getrmconf_by_ph1() in revalidate_ph1tree_rmconf() 43 442011-03-11 Yvan Vanhullebus <vanhu@netasq.com> 45 46 * src/racoon/: handler.c, isakmp.c: directly delete a ph1 in 47 remove_ph1-) instead of scheduling it, to avoid (completely ?) a 48 race condition when reloading configuration 49 502011-03-06 Timo Teras <timo.teras@iki.fi> 51 52 * src/racoon/privsep.c: Quiet a gcc warning when strict-aliasing 53 checks are enabled. Reported by Stephen Clark. 54 552011-03-02 Yvan Vanhullebus <vanhu@netasq.com> 56 57 * src/racoon/session.c: flush sainfo list when closing session. 58 patch by Roman Hoog Antink <rha@open.ch> 59 60 * src/racoon/: remoteconf.c, rsalist.c, rsalist.h: free rsa 61 structures when deleting a struct rmconf. patch by Roman Hoog Antink 62 <rha@open.ch> 63 64 * src/racoon/: cfparse.y, remoteconf.c, remoteconf.h: free spspec 65 when deleting a rmconf struct. patch by Roman Hoog Antink 66 <rha@open.ch> 67 68 * src/racoon/: remoteconf.c, session.c: fixed some memory leaks in 69 remoteconf. patch by Roman Hoog Antink <rha@open.ch> 70 71 * src/racoon/: cfparse.y, prsa_par.y: fixed some memory leaks 72 during configuration parsing. patch by Roman Hoog Antink 73 <rha@open.ch> 74 752011-03-01 Yvan Vanhullebus <vanhu@netasq.com> 76 77 * src/racoon/: isakmp.c, pfkey.c: plog text fixes, patch from M E 78 Andersson <debian@gisladisker.se> 79 80 * src/racoon/cfparse.y: reset yyerrorcount before doing parse 81 stuff. patch by Roman Hoog Antink <rha@open.ch> 82 832011-02-20 Timo Teras <timo.teras@iki.fi> 84 85 * src/racoon/oakley.c: From Roman Hoog Antink <rha@open.ch>: Fix 86 memory leak when using plain RSA key authentication. 87 882011-02-11 Timo Teras <timo.teras@iki.fi> 89 90 * src/racoon/plainrsa-gen.c: From Mats E Andersson 91 <debian@gisladisker.se>: Fix fprintf format specifier usage from 92 previous patch. 93 942011-02-10 Timo Teras <timo.teras@iki.fi> 95 96 * src/racoon/plainrsa-gen.c: From Mats Erik Andersson 97 <debian@gisladisker.se>: Implement importing of RSA keys from PEM 98 files. 99 100 * src/racoon/prsa_par.y: From M E Andersson 101 <debian@gisladisker.se>: Fix parsing of restricted RSA key 102 addresses. 103 1042011-02-02 Yvan Vanhullebus <vanhu@netasq.com> 105 106 * src/racoon/: cftoken.l, isakmp.c, remoteconf.h, sainfo.c, 107 sainfo.h: store ph1id in an u_int32_t instead of a (signed)int. 108 Patch from Christophe Carre 109 1102011-01-28 Timo Teras <timo.teras@iki.fi> 111 112 * src/racoon/: sainfo.c, sainfo.h, session.c: From Roman Hoog 113 Antink <rha@open.ch>: Clean up sainfo reloading: rename the 114 functions, and remove unneeded global variable. 115 116 * src/racoon/: remoteconf.c, remoteconf.h, session.c: From Roman 117 Hoog Antink <rha@open.ch>: Clean up rmconf reloading: rename the 118 functions, and remove unneeded global variable. 119 120 * src/racoon/plog.c: From Roman Hoog Antink <rha@open.ch>: Log 121 remote IP address if available (slightly modified by tteras) 122 1232011-01-22 Timo Teras <timo.teras@iki.fi> 124 125 * src/racoon/isakmp_inf.c: From Roman Hoog Antink <rha@open.ch>: 126 Fixes a null pointer dereference that might occur after removing 127 peers from the config and then reloading. 128 1292011-01-20 Yvan Vanhullebus <vanhu@netasq.com> 130 131 * src/libipsec/pfkey.c: fixed a typo, it will now compile when 132 KMADDRESS is defined. reported by Roman Hoog Antink (rha (at) 133 open.ch) 134 1352010-12-28 Timo Teras <timo.teras@iki.fi> 136 137 * src/racoon/handler.c: From Roman Hoog Antink <rha@open.ch>: Fix 138 config reload to not delete too many phase 2 handles, because wrong 139 chain field is used when enumerating the handles. 140 1412010-12-16 gdt 142 143 * src/racoon/oakley.c: When encountering a certificate where "ID 144 mismatched with ASN1 SubjectName", and verify_identifier is off, 145 don't raise an error. This makes the behavior match the man page. 146 147 Patch sent for review long ago: 148 http://mail-index.netbsd.org/tech-security/2006/03/24/0000.html 149 with no negative feedback received to date. 150 1512010-12-14 Timo Teras <timo.teras@iki.fi> 152 153 * src/racoon/ipsec_doi.c: From Roman Hoog Antink <rha@open.ch>: Fix 154 possible null derefence. 155 1562010-12-08 Timo Teras <timo.teras@iki.fi> 157 158 * src/racoon/admin.c: Use separate SA addresses for phase2's 159 created by admin command. The phase2 startup overwrites src/dst with 160 ISAKMP ports if they are zero and we don't want that to happen for 161 the SA ports. 162 1632010-12-08 joerg 164 165 * src/libipsec/pfkey.c: ANSIfy 166 1672010-12-07 Timo Teras <timo.teras@iki.fi> 168 169 * src/racoon/isakmp_quick.c: Fix spacing and improve wording in 170 some log messages. 171 1722010-12-03 Timo Teras <timo.teras@iki.fi> 173 174 * src/libipsec/ipsec_dump_policy.c: Recognize direction for Linux 175 per-socket policies. 176 177 * src/: libipsec/libpfkey.h, libipsec/pfkey_dump.c, setkey/parse.y, 178 setkey/setkey.8: Support GRE key as upper layer protocol 179 specifier (will be supported in Linux kernel 2.6.38). 180 181 * src/racoon/grabmyaddr.c: Netlink deletion notification does not 182 guarentee actual address deletion: it might still exist on some 183 other interface. Make sure we do not unbind unless the address is 184 really gone. 185 1862010-11-17 Timo Teras <timo.teras@iki.fi> 187 188 * src/racoon/: handler.c, handler.h, isakmp.c, isakmp_inf.c: Fix my 189 previous patch to not call purge_remote() twice. Change the place 190 where purge_remote() is called. This fixes also a possible crash 191 from the same patch since ph1->remote can be NULL (when we are 192 responder and config is not yet selected). 193 1942010-11-12 Timo Teras <timo.teras@iki.fi> 195 196 * src/racoon/: admin.c, isakmp.c, isakmp_var.h, pfkey.c: 197 isakmp_post_acquire is now called from admin commands too, add a 198 flag so admin commands can be used to establish even passive links 199 on demand. 200 201 * src/racoon/isakmp.c: Purge all IPsec-SA's if the last main 202 ISAKMP-SA for the node is deleted by remote request and the phase1 203 rekeying is enabled (this will also trigger the new phase1_dead 204 script hook). 205 206 * src/racoon/: handler.h, isakmp_inf.c: Improve DPD sequence checks 207 to allow any reply within valid sequence window to be proof of 208 livelyness. This can improves things if there's random packet 209 delays, or if racoon is not getting enough CPU time. 210 211 * src/racoon/: admin.c, admin.h, kmpstat.c, racoonctl.c: Extern 212 admin protocol to allow reply packets to exceed 64kb. E.g SA dumps 213 with many established SAs can be easily over the limit. 214 2152010-10-22 Timo Teras <timo.teras@iki.fi> 216 217 * src/racoon/grabmyaddr.c: Change Linux Netlink address monitoring 218 to monitor local route changes. This works around a kernel bug, and 219 slightly improves behaviour on some special cases. 220 2212010-10-21 Timo Teras <timo.teras@iki.fi> 222 223 * src/racoon/: admin.c, evt.c, grabmyaddr.c, isakmp.c, pfkey.c, 224 session.c, session.h: Introduce priorities for file descriptor 225 polling mechanism and give priority to admin port. If admin port is 226 used by ISAKMP-SA hook scripts they should be preferred, other wise 227 heavy traffic can delay admin port requests considerably. This in 228 turn may cause renegotiation loop for ISAKMP-SA. This is mostly 229 useful for OpenNHRP setup, but can benefit other setups too. 230 231 * src/racoon/: admin.c, handler.c, handler.h: Remove 232 initial-contact entry when all ISAKMP-SA are purged via adminport. 233 This will avoid stale security associations if some of the delete 234 notifications happens to get lost. 235 2362010-10-20 Timo Teras <timo.teras@iki.fi> 237 238 * src/racoon/crypto_openssl.c: Use high-level openssl EVP and HMAC 239 functions when possible: this allows openssl to perform hardware 240 acceleration if available. 241 242 * src/racoon/: isakmp.c, isakmp_quick.c: Various improvements to 243 error log messages and a few additional error log messages to 244 improve diagnosing an error condition. 245 246 * src/racoon/grabmyaddr.c: Fix address comparison so we actually 247 close sockets which were bound to IP-address that got deconfigured. 248 2492010-10-11 Yvan Vanhullebus <vanhu@netasq.com> 250 251 * src/racoon/ipsec_doi.c: report a higher encryption key length in 252 approval for OBEY / CLAIM / STRICT modes 253 2542010-09-27 Yvan Vanhullebus <vanhu@netasq.com> 255 256 * src/racoon/isakmp_xauth.c: fixed some typos in logs (reported by 257 fazaeli (at) sepehrs.com) 258 2592010-09-24 Yvan Vanhullebus <vanhu@netasq.com> 260 261 * src/racoon/cftoken.l: fixed a fd leak, patch by getlaser (at) 262 gmail.com 263 2642010-09-22 Yvan Vanhullebus <vanhu@netasq.com> 265 266 * src/racoon/admin.c: get the correct length of username when 267 processing ADMIN_LOGOUT_USER, patch by rweikusat (at) mssgmbh.com 268 269 * src/racoon/nattraversal.h: fixed a typo in macros, reported by 270 marisp (at) mt.lv 271 2722010-09-21 Yvan Vanhullebus <vanhu@netasq.com> 273 274 * src/racoon/isakmp_cfg.c: moved from utmp.h to utmpx.h (patch 275 provided by marcin.cieslak (at) gmail.com) 276 2772010-09-08 Yvan Vanhullebus <vanhu@netasq.com> 278 279 * src/racoon/remoteconf.c: fixed remoteconf selection when no ID 280 specified in configuration, and added some debug to remoteconf 281 selection 282 2832010-08-26 Yvan Vanhullebus <vanhu@netasq.com> 284 285 * src/racoon/remoteconf.c: fix by Sergio.Gelato (at) astro.su.se: 286 duplicate some dynamic values in duprmconf() 287 2882010-08-04 Yvan Vanhullebus <vanhu@netasq.com> 289 290 * src/racoon/isakmp_cfg.c: fixed answer for IP4_SUBNET request 291 2922010-07-30 Yvan Vanhullebus <vanhu@netasq.com> 293 294 * src/racoon/doc/FAQ: updated link to NetBSD's documentation 295 2962010-06-22 Thomas Klausner <wiz@netbsd.org> 297 298 * src/racoon/racoon.conf.5: Bump date for previous. 299 3002010-06-22 Yvan Vanhullebus <vanhu@netasq.com> 301 302 * src/racoon/: cfparse.y, cftoken.l, isakmp.c, isakmp_inf.c, 303 racoon.conf.5, remoteconf.c, remoteconf.h: added a specific 304 script hook when a dead peer is detected 305 3062010-06-04 Thomas Klausner <wiz@netbsd.org> 307 308 * src/setkey/setkey.8: New sentence, new line. Bump date for 309 previous. 310 3112010-06-04 Yvan Vanhullebus <vanhu@netasq.com> 312 313 * src/setkey/: parse.y, setkey.8, token.l: Added support for 314 spdupdate command in setkey 315 3162010-04-07 Yvan Vanhullebus <vanhu@netasq.com> 317 318 * src/libipsec/ipsec_strerror.c: by Eric Preston: fixed a typo 319 3202010-04-02 Christos Zoulas <christos@netbsd.org> 321 322 * src/: libipsec/pfkey_dump.c, racoon/backupsa.c: handle ctime 323 returning NULL. 324 3252010-03-11 Christos Zoulas <christos@netbsd.org> 326 327 * src/racoon/handler.c: PR/42363: Yasuoka Masahiko: Second part of 328 the patch: iterate only on the phase2 handles that are bound by the 329 given phase1 handle. 330 3312010-03-05 Timo Teras <timo.teras@iki.fi> 332 333 * src/: libipsec/ipsec_set_policy.3, racoon/privsep.c, 334 racoon/doc/FAQ, setkey/setkey.8: From Stefan Bauer: Fix multiple 335 typoes and manpage formatting errors. 336 3372010-03-04 Yvan Vanhullebus <vanhu@netasq.com> 338 339 * src/racoon/session.c: From Pierre POMES: fixed admin port 340 initialization 341 3422010-02-28 snj 343 344 * src/racoon/: sockmisc.c, sockmisc.h: Fight the ever-increasing 345 size of src checkouts by spelling "useful" without an extra l. 346 3472010-02-09 Thomas Klausner <wiz@netbsd.org> 348 349 * src/racoon/: pfkey.c, proposal.h: Fix typo in comment. 350 3512010-01-17 Thomas Klausner <wiz@netbsd.org> 352 353 * src/racoon/sainfo.c: Free strdeupped string after using it. Found 354 by cppcheck. 355 356 * src/racoon/: eaytest.c, ipsec_doi.c: Close file handles after 357 using them. Found by cppcheck. 358 3592010-01-15 joerg 360 361 * src/setkey/setkey.8: Use .%U instead of .%O for URLs. 362 3632009-12-11 Timo Teras <timo.teras@iki.fi> 364 365 * src/racoon/Makefile.am: From Paul Wernau: vmbuf.h was defined 366 twice in the headers. Remove the redundant entry so new install tool 367 does not complain about overwriting just installed file. 368 3692009-11-22 Christos Zoulas <christos@netbsd.org> 370 371 * src/racoon/handler.c: PR/42363: Yasuoka Masahiko: 372 373 racoon uses a wrong IPsec-SA handle that is for other peer in case 374 it receives a ISAKMP message for IPsec-SA that has the same 375 message-id as the message-id that is received before. 376 377 racoon uses message-id to find the handle of IPsec-SA. The 378 message-id is a unique number for each peer, but different peers may 379 use the same value. 380 381 Different Windows Vista or Windows 7 peers seem to use the same 382 message-id. racoon can handle the first Windows's Phase-2, but it 383 cannot handle the second Windows. Because racoon misunderstands the 384 message for the second Windows as the message for the first Windows. 385 386 >Category: bin >Synopsis: racoon uses a wrong IPsec-SA 387 that is for different peer >Confidential: no >Severity: 388 serious >Priority: medium >Responsible: bin-bug-people 389 >State: open >Class: sw-bug >Submitter-Id: net 390 >Arrival-Date: Sun Nov 22 18:25:00 +0000 2009 >Originator: 391 yasuoka@iij.ad.jp 392 3932009-10-29 Christos Zoulas <christos@netbsd.org> 394 395 * src/setkey/token.l: use %option noinput nounput 396 3972009-10-28 Christos Zoulas <christos@netbsd.org> 398 399 * src/setkey/token.l: no unput 400 4012009-10-14 joerg 402 403 * src/libipsec/ipsec_set_policy.3: Do not use .Xo/.Xc to workaround 404 ancient groff limits. 405 406 * src/setkey/setkey.8: Do not use .Xo/.Xc to work around ancient 407 groff limits. Fix markup. 408 409 * src/racoon/racoon.conf.5: Don't use .Xo/.Xc to work around 410 ancient groff limits. Set only one list type. 411 4122009-09-18 Timo Teras <timo.teras@iki.fi> 413 414 * src/racoon/: isakmp_agg.c, isakmp_ident.c: From Tomas Mraz: Fix 415 gssapi error checking. 416 4172009-09-03 Timo Teras <timo.teras@iki.fi> 418 419 * src/racoon/: admin.c, handler.c, handler.h, isakmp.c, 420 isakmp_var.h, pfkey.c: When rekeying phase2 use phase1 used to 421 negotiate phase2 as a hint to select the phase1 for rekeying the new 422 phase2. 423 4242009-09-01 Timo Teras <timo.teras@iki.fi> 425 426 * src/racoon/: nattraversal.c, racoon.conf.5, vendorid.c: Check 427 nat_traversal configuration from remote configuration candidates 428 when acting as responder. Enable NAT-T if any of the remote 429 candidates have NAT-T enabled. 430 431 * src/racoon/remoteconf.c: Change remote conf matching level to 432 matching score. This way one can override anonymous certificate 433 block config with more exact "inhereted" IP specific block. 434 435 * src/racoon/: isakmp.c, racoon.conf.5: From Maik Broemme: export 436 ISAKMP SA identity as REMOTE_ID for phase1 up script (trac #313). 437 4382009-08-24 Yvan Vanhullebus <vanhu@netasq.com> 439 440 * src/racoon/oakley.c: fixed typo: algoriym -> algorithm 441 4422009-08-19 Yvan Vanhullebus <vanhu@netasq.com> 443 444 * src/racoon/remoteconf.c: fixed address check in 445 rmconf_match_type(), just check address with wildcard port 446 4472009-08-19 Timo Teras <timo.teras@iki.fi> 448 449 * src/racoon/remoteconf.c: Have an enum for rmconf_match_type() 450 return values to make the code a bit more readable. 451 4522009-08-18 Yvan Vanhullebus <vanhu@netasq.com> 453 454 * src/racoon/oakley.c: typo: algoritym -> algorithm 455 4562009-08-17 Yvan Vanhullebus <vanhu@netasq.com> 457 458 * src/libipsec/libpfkey.h: do not use SADB_X_NAT_T_NEW_MAPPING to 459 check system support for NAT-T, as at least FreeBSD doesn't have 460 this define anymore 461 462 * src/racoon/schedule.h: include stddef.h so we have a chance to 463 get the system offsetof if present 464 465 * src/racoon/crypto_openssl.h: removed a self include 466 4672009-08-13 Yvan Vanhullebus <vanhu@netasq.com> 468 469 * src/racoon/oakley.c: fixed a potential DoS in 470 oakley_do_decrypt(), reported by Orange Labs 471 4722009-08-10 Timo Teras <timo.teras@iki.fi> 473 474 * src/racoon/pfkey.c: Don't print EAGAIN error from 475 pfkey_handler(), it can occur normally under some code paths and is 476 not a hard error in any case. 477 4782009-08-06 Timo Teras <timo.teras@iki.fi> 479 480 * src/setkey/setkey.c: From Paul Wenau: Check fgets return value in 481 setkey to make gcc happy. 482 4832009-08-05 Timo Teras <timo.teras@iki.fi> 484 485 * src/racoon/pfkey.c: From Paul Wernau: Fix transport mode per-port 486 security associations that got broke during NAT-T fixes. 487 4882009-07-07 Timo Teras <timo.teras@iki.fi> 489 490 * src/racoon/sockmisc.c: From Arnaud Ebalard: Fix possible usage of 491 uninitialized local variable (not sure if any code path triggers 492 this, but this makes compiler happy). 493 4942009-07-03 Timo Teras <timo.teras@iki.fi> 495 496 * src/racoon/: admin.c, grabmyaddr.c, handler.c, handler.h, 497 isakmp.c, isakmp_cfg.c, isakmp_inf.c, isakmp_quick.c, 498 nattraversal.c, pfkey.c, policy.c, remoteconf.c, remoteconf.h, 499 sockmisc.c, sockmisc.h, throttle.c: Get rid of the evil CMPSADDR 500 macro. Trac #295. 501 502 * src/: libipsec/libpfkey.h, libipsec/pfkey.c, racoon/isakmp.c, 503 racoon/isakmp_inf.c, racoon/pfkey.c, racoon/pfkey.h: From Yvan 504 Vanhullebus: Use SADB_X_EXT_NAT_T_* consistently for passing the 505 NAT-T port information. This might break compatibility with some 506 kernels, but as discussed this is the proper way to pass NAT-T ports 507 and the broken kernels need to be fixed. 508 5092009-06-24 Timo Teras <timo.teras@iki.fi> 510 511 * src/racoon/session.c: Fix a call to null pointer: in some cases, 512 the unmonitor_fd can be called from another fd's callback. That 513 could lead to still have callback pending after unmonitoring the fd 514 resulting in a call to null pointer. This is fixed by making 515 unmonitor_fd now clear the pending fd_set too. Bug was introduced 516 by my commit in 2008-12-23. 517 5182009-05-20 Yvan Vanhullebus <vanhu@netasq.com> 519 520 * src/racoon/isakmp.h: typo 521 5222009-05-19 Timo Teras <timo.teras@iki.fi> 523 524 * src/racoon/: ipsec_doi.c, isakmp.c: From Jukka Salmi: Fix couple 525 of typos from previous commit. 526 5272009-05-18 Timo Teras <timo.teras@iki.fi> 528 529 * src/racoon/: ipsec_doi.c, isakmp.c, sockmisc.c, sockmisc.h: From 530 Tomas Mraz: Introduce union sockaddr_any and use it to make code 531 more readable. Related to trac #293. 532 533 * src/racoon/isakmp_inf.c: From Tomas Mraz: Remove variable that is 534 not really used; only referenced while uninitialized causing 535 valgrind error. 536 537 * src/racoon/nattraversal.c: From Tomas Mraz: Fix natt_flags check. 538 5392009-05-04 Thomas Klausner <wiz@netbsd.org> 540 541 * src/racoon/racoon.conf.5: Remove superfluous spaces around 542 parentheses. 543 5442009-04-29 Timo Teras <timo.teras@iki.fi> 545 546 * src/racoon/crypto_openssl.c: From Ross Meng: Fix a memory leak in 547 X509 certificate validation. 548 5492009-04-28 Timo Teras <timo.teras@iki.fi> 550 551 * src/racoon/handler.c: Reset nat_oa variables too when reusing 552 phase two handler. Otherwise phase2 rekeying might fail in some 553 scenarios. 554 5552009-04-22 Timo Teras <timo.teras@iki.fi> 556 557 * src/racoon/isakmp_frag.c: From Neil Kettle: Fix a possible null 558 pointer dereference in fragmentation code. 559 5602009-04-21 Timo Teras <timo.teras@iki.fi> 561 562 * src/racoon/: grabmyaddr.c, grabmyaddr.h, session.c: Fix 563 strict_address to work again. The lists needs to be initialized 564 before configuration is read, which happens before my_addr_init() 565 call. 566 5672009-04-20 Timo Teras <timo.teras@iki.fi> 568 569 * src/racoon/: isakmp.c, isakmp.h, isakmp_var.h: Fix a memory leak 570 in certificate request generation. 571 572 * src/racoon/: isakmp_inf.c, isakmp_xauth.c, plog.c: Orignally from 573 Bin Li: Fix possible memory corruption in binsanitize(). 574 575 * src/racoon/crypto_openssl.c: From Stephen Bevan: Fix a x509 576 signature verification memory leak. 577 578 * src/racoon/: admin.c, racoonctl.c: Originally from Bin Li: Fix a 579 crash with racoonctl logout user. 580 581 * src/racoon/nattraversal.c: Fix a memory leak in nat-t keepalive 582 code. 583 584 * src/racoon/handler.c: From Paul Moore: Phase2 message id's should 585 be unique wrt phase1, not globally. 586 5872009-03-13 Timo Teras <timo.teras@iki.fi> 588 589 * src/racoon/: pfkey.c, remoteconf.h: From Arnaud Ebalard: Fix 590 couple of problems with previous commit. 591 5922009-03-12 he 593 594 * src/racoon/: isakmp.c, remoteconf.c: When casting to/from a 595 pointer to an integral type (a bad practice, if you ask me), you 596 need to cast via intptr_t for portability. 597 5982009-03-12 Thomas Klausner <wiz@netbsd.org> 599 600 * src/racoon/racoon.conf.5: New sentence, new line. Avoid marking 601 up punctuation. 602 603 * src/racoon/racoonctl.8: Bump date for previous. Sort options to 604 establish-sa. Stop using Xo/Xc. 605 6062009-03-12 Timo Teras <timo.teras@iki.fi> 607 608 * src/racoon/: admin.c, cfparse.y, cftoken.l, crypto_openssl.c, 609 crypto_openssl.h, dnssec.c, dnssec.h, handler.c, handler.h, 610 ipsec_doi.c, ipsec_doi.h, isakmp.c, isakmp.h, isakmp_agg.c, 611 isakmp_base.c, isakmp_ident.c, isakmp_inf.c, isakmp_quick.c, 612 isakmp_var.h, nattraversal.c, oakley.c, oakley.h, racoon.conf.5, 613 racoonctl.8, racoonctl.c, remoteconf.c, remoteconf.h, sockmisc.c, 614 vendorid.c: Support multiple anonymous remotes and decide 615 remoteconf based on identity, received certificates and other 616 information. General code clean up. 617 6182009-03-06 Timo Teras <timo.teras@iki.fi> 619 620 * src/setkey/: extern.h, parse.y, setkey.c: setkey: fix deleteall 621 in Linux 622 623 Linux requires SADB_DELETE message to have SPI. So send a 624 SADB_DELETE message for each matching SA. Trac #284. 625 626 From: Gabriel Somlo <somlo@cmu.edu> 627 6282009-02-16 Timo Teras <timo.teras@iki.fi> 629 630 * src/libipsec/policy_parse.y: From Paul Moore: Fix a heap 631 corruption bug (yacc return non-null terminated buffer and sprintf 632 writes over bounds). 633 6342009-02-11 Yvan Vanhullebus <vanhu@netasq.com> 635 636 * src/racoon/: isakmp.c, sockmisc.c, sockmisc.h: trac#301: fixed 637 IPsec SAs flush in purge_remote() when NAT-T enabled but no NAT-T on 638 tunnel 639 6402009-02-03 Timo Teras <timo.teras@iki.fi> 641 642 * src/racoon/isakmp.c: From: Phil Sutter. Fix script environment 643 variables with IPv6 addresses. 644 6452009-01-26 Timo Teras <timo.teras@iki.fi> 646 647 * src/racoon/main.c: Argument parsing needs lcconf initialized. 648 6492009-01-24 Thomas Klausner <wiz@netbsd.org> 650 651 * src/racoon/racoonctl.c: Sort options in usage. 652 653 * src/racoon/racoonctl.8: Sort options. New sentence, new line. 654 655 * src/racoon/racoon.8: Sort options. 656 6572009-01-23 Timo Teras <timo.teras@iki.fi> 658 659 * src/racoon/: racoonctl.8, racoonctl.c: Update usage and manpage 660 for racoonctl. 661 662 * src/racoon/: main.c, racoon.8: Racoon -v to print version and 663 compilation information. Update usage message. 664 665 * NEWS: Update NEWS with major changes since 0.7 release. 666 667 * src/racoon/schedule.c: Fix monotonic scheduler change, to not 668 refresh 'now' before exit. Otherwise we can return negative timeout 669 after spending time handling other events. 670 671 * src/racoon/: handler.c, pfkey.c: From Arnaud Ebalard: Handle 672 reception of MIGRATE message during Phase 1 and Phase 2 negotiation. 673 Also corrects some debugging statements. 674 675 * src/racoon/pfkey.c: From Arnaud Ebalard: On the responder (for 676 instance), there is a need to not only migrate local and remote 677 addresses of Phase 1 that match previous addresses but also the 678 local and remote addresses of a Phase 1 *associated* with a migrated 679 Phase 2. For instance, we have that need when receiving the first 680 MIGRATE/KMADDRESS message because the old addresses are still the 681 HoA and the address of the HA (while the peer has contacted us using 682 the CoA and we have negotiated this address as src attribute in 683 Phase 2). The patch fixes that by having migrate_ph1_ike_addresses() 684 called from migrate_ph2_ike_addresses() callback. 685 686 * src/racoon/isakmp_quick.c: From Arnaud Ebalard: Set phase2 spid 687 when acting as responder. 688 689 * configure.ac, src/racoon/handler.c, src/racoon/handler.h, 690 src/racoon/isakmp_inf.c, src/racoon/isakmp_xauth.c, 691 src/racoon/schedule.c, src/racoon/schedule.h, 692 src/racoon/throttle.c, src/racoon/throttle.h: Detect if monotonic 693 system clock is available, and use it for relative time measurements 694 to avoid complite hang if time jumps backwards. 695 696 * src/racoon/: cfparse.y, ipsec_doi.c, isakmp.c, isakmp_agg.c, 697 isakmp_base.c, isakmp_cfg.c, isakmp_ident.c, isakmp_xauth.c, 698 oakley.c, oakley.h: Fix authentication method ambiguity by 699 internally using unique ID and setting/interpreting the wire format 700 based on received vendor ID:s. Fixes trac #280. 701 702 * src/racoon/: handler.h, isakmp_agg.c, isakmp_base.c, 703 isakmp_ident.c, vendorid.c, vendorid.h: Introduce vendorid 704 bitmask that can be used otherwhere to detect peer capabilities. 705 706 * configure.ac, src/racoon/admin.c, src/racoon/evt.c, 707 src/racoon/grabmyaddr.c, src/racoon/isakmp.c, src/racoon/pfkey.c, 708 src/racoon/session.c, src/racoon/session.h: Remove "fastquit" 709 configure option and make it the default behaviour. The previous 710 normal behaviour is buggy, as after flush kernel can immediately 711 create larval SA:s which would prevent exit. 712 7132009-01-20 Timo Teras <timo.teras@iki.fi> 714 715 * Makefile.am, misc/cvs2cl.pl, misc/cvsusermap: Autogenerate 716 ChangeLog from NetBSD CVS. Put sourceforge.net changes to 717 ChangeLog.old. 718 7192009-01-10 Thomas Klausner <wiz@netbsd.org> 720 721 * src/racoon/racoon.conf.5: Make ready for HTML output. Use proper 722 escape for backslash ('\e'). 723 7242009-01-10 Timo Teras <timo.teras@iki.fi> 725 726 * src/racoon/: crypto_openssl.c, racoon.conf.5: From Cyrus Rahman: 727 Accept RFC2253 compliant escaped special characters for asn1dn 728 identifier. 729 7302009-01-09 Timo Teras <timo.teras@iki.fi> 731 732 * configure.ac: Fix a CPPLAGS typo to CPPFLAGS which was intended 733 7342009-01-05 Timo Teras <timo.teras@iki.fi> 735 736 * src/racoon/: cfparse.y, cftoken.l, racoon.conf.5: Remove obsolete 737 configuration options, fix radius configuration block and add GRE as 738 recognized protocol. 739 740 * src/racoon/session.c: Do not use counting in signal handling as 741 it was unsafe by not using atomic functions (post increment is not 742 necessarily atomic). Instead reap all children on SIGCHLD as that 743 was the only signal needing signal counting. 744 7452008-12-30 Timo Teras <timo.teras@iki.fi> 746 747 * src/racoon/session.c: schedular() call can now modify fd mask so 748 make the working copy just before calling select(); otherwise it can 749 contain bad file descriptors 750 7512008-12-29 Michael van Elst <mlelstv@netbsd.org> 752 753 * src/setkey/parse.y: support icmp codes. Fixes PR 39056. 754 7552008-12-24 Christos Zoulas <christos@netbsd.org> 756 757 * src/racoon/grabmyaddr.c: remove sin{6,}_len linux does not have 758 it. From Timo Teras. 759 760 * src/racoon/grabmyaddr.c: I was wrong. addr is actually set. 761 762 * src/racoon/grabmyaddr.c: 763 - make this compile by zeroing out the whole structure not just 764 bogus fields. 765 - set length field of sockets appropriately. 766 - mark bogus no-op code (I don't understand what the author intended 767 here). 768 7692008-12-23 Thomas Klausner <wiz@netbsd.org> 770 771 * src/racoon/racoon.conf.5: Bump date for identity configuration 772 option removal. 773 7742008-12-23 Timo Teras <timo.teras@iki.fi> 775 776 * src/racoon/: cfparse.y, cftoken.l, ipsec_doi.c, localconf.c, 777 localconf.h, racoon.conf.5: Remove the obsoleted global identity 778 configuration option. 779 780 * src/racoon/: admin.c, admin_var.h, cfparse.y, debug.h, evt.c, 781 evt.h, grabmyaddr.c, grabmyaddr.h, handler.c, isakmp.c, 782 isakmp_inf.c, isakmp_var.h, localconf.c, localconf.h, main.c, 783 nattraversal.c, pfkey.c, pfkey.h, privsep.c, session.c, 784 session.h: rewrite local address detection make some functions 785 static that arr not needed globally rework how fd_set is 786 construction for the main loop select() 787 7882008-12-18 Timo Teras <timo.teras@iki.fi> 789 790 * src/racoon/pfkey.c: From Arnaud Ebalard: Delete larval ph2handles 791 when expire with hard lifetime received 792 7932008-12-16 Timo Teras <timo.teras@iki.fi> 794 795 * README: Update README 796 797 * src/racoon/pfkey.c: Fix transport mode address selection in 798 acquire handling. Some earlier fixes got lost on 2008-12-05 commit. 799 8002008-12-11 Yvan Vanhullebus <vanhu@netasq.com> 801 802 * src/racoon/grabmyaddr.c: Fixed compilation on FreeBSD (RTM_IFINFO 803 and RTM_OIFINFO stuff) 804 805 * src/racoon/isakmp.c: Fixed compilation when DPD support is 806 disabled 807 8082008-12-08 Timo Teras <timo.teras@iki.fi> 809 810 * src/racoon/: pfkey.c, privsep.c, privsep.h: Do not cache pfkey 811 sockets: it might cause to not handle some pfkey events when 812 select() has marked pfkey socket readable, but a timer callback 813 first calls pfkey_dump_sadb(). 814 8152008-12-05 Timo Teras <timo.teras@iki.fi> 816 817 * src/: libipsec/key_debug.c, libipsec/libpfkey.h, 818 libipsec/pfkey.c, racoon/handler.c, racoon/handler.h, 819 racoon/ipsec_doi.c, racoon/isakmp.c, racoon/isakmp_quick.c, 820 racoon/pfkey.c, racoon/policy.c, racoon/policy.h: From Arnaud 821 Ebalard: Improved Mobile IPv6 support per 822 draft-ebalard-mext-pfkey-enhanced-migrate. 823 8242008-12-04 Christoph Badura <bad@netbsd.org> 825 826 * src/racoon/privsep.c: Fix typo in previous and use SIG_IGN as I 827 intended. 828 8292008-12-02 Timo Teras <timo.teras@iki.fi> 830 831 * src/racoon/session.c: Explicitly ignore SIGPIPE. Default action 832 on Linux is terminate. 833 8342008-11-28 Thomas Klausner <wiz@netbsd.org> 835 836 * src/racoon/racoon.conf.5: Remove empty line. Fix typo. New 837 sentence, new line. 838 8392008-11-27 Yvan Vanhullebus <vanhu@netasq.com> 840 841 * src/racoon/main.c: Set up a default value for Mode Config Pool 842 size if pool address specified but pool size not specified 843 844 * src/racoon/isakmp_cfg.c: Fixed pool resizing 845 8462008-11-27 Timo Teras <timo.teras@iki.fi> 847 848 * src/racoon/pfkey.c: From Arnaud Ebalard: Remove MAXNESTEDSA 849 weirdness. It's probably meant for bundle support which is not done. 850 When someone actually writes bundle support, the nested SA stuff 851 would probably be reworked too anyway. 852 853 * src/: libipsec/libpfkey.h, libipsec/pfkey.c, racoon/cfparse.y, 854 racoon/cftoken.l, racoon/localconf.c, racoon/localconf.h, 855 racoon/pfkey.c, racoon/racoon.conf.5: From: Matthew Krenzer 856 Ability to set pfkey socket buffer size via configuration file 857 directive. (Indentation and minor fixes by me.) 858 8592008-11-25 Christoph Badura <bad@netbsd.org> 860 861 * src/racoon/: evt.c, privsep.c, session.c: Avoid using 862 MSG_NOSIGNAL as it is not available everywhere. Ignore SIGPIPE 863 instead. 864 865 * src/racoon/grabmyaddr.c: Ignore unspecified and looback 866 addresses. Ignoring unspecified addresses prevents racoon from 867 trying to bind to the wildcard address and specific addresses 868 simultaneously after e.g. dhclient has changed an interface's 869 address to 0.0.0.0. 870 871 * src/racoon/grabmyaddr.c: RTM_DELETE and RTM_IFINFO don't carry 872 info for added or deleted addresses. Ignore them silently. 873 874 * src/racoon/grabmyaddr.c: Ignoring an unsuitable address is not an 875 error. Therefore log it as informational. Make it clear from the 876 log message that a route message is not interesting. 877 878 * src/racoon/grabmyaddr.c: Use insmyaddr() instead of open coding 879 it. 880 881 * src/racoon/isakmp.c: Do not return erroneously from isakmp_open() 882 when setting IPV6_USE_MIN_MTU fails. 883 884 * src/racoon/: grabmyaddr.c, isakmp.c: Keep myaddr.sock at -1 when 885 no socket is opened. 886 8872008-11-08 Christoph Badura <bad@netbsd.org> 888 889 * src/racoon/samples/roadwarrior/client/: phase1-down.sh, 890 phase1-up.sh: Preserve owner and permissions of original 891 /etc/resolv.conf. Ensure that new /etc/resolv.conf isn't group or 892 world writable. 893 894 * src/racoon/samples/roadwarrior/client/: phase1-down.sh, 895 phase1-up.sh: Print and check INTERNAL_NETMASK4. 896 897 * src/racoon/samples/roadwarrior/client/: phase1-down.sh, 898 phase1-up.sh: Make the handling of NAT-T SPD entries automatic. 899 900 * src/racoon/samples/roadwarrior/client/: phase1-down.sh, 901 phase1-up.sh: Ensure that the determination of the default 902 gateway and the corresponding interface don't get confused by 903 multiple, possibly non-IPv4 default routes. Bring the NetBSD case 904 of deleting the VPN routes and address in line with the Linux case 905 and delete the address after deleting the VPN routes. 906 9072008-11-06 Yvan Vanhullebus <vanhu@netasq.com> 908 909 * src/racoon/sainfo.c: fixed delsainfo() to avoid a crash when 910 iddst's value is SAINFO_CLIENTADDR 911 9122008-10-29 S.P.Zeidler <spz@netbsd.org> 913 914 * src/racoon/ipsec_doi.c: Changes to ipsecdoi_id2str(): 915 916 struct sockaddr -> struct sockaddr_storage fixes a stack overflow 917 918 For non-linklocal addresses the value in 'scope' is garbage and gets 919 set to zero instead. 920 9212008-10-27 Timo Teras <timo.teras@iki.fi> 922 923 * src/racoon/pfkey.c: From Arnaud Ebalard: Add missing return to 924 error path 925 926 * src/racoon/grabmyaddr.c: From Francis Dupont (sent by Arnaud 927 Ebalard): recognize RTM_IFANNOUNCE 928 929 * src/racoon/grabmyaddr.c: From Arnaud Ebalard: Fix indentation 930 issues for readability 931 932 * src/racoon/session.c: From Arnaud Ebalard: initfds() needs to be 933 called only if monitored file descriptor numbers have changed 934 935 * src/racoon/isakmp_var.h: From Arnaud Ebalard: Remove duplicate 936 declaration 937 9382008-10-23 Timo Teras <timo.teras@iki.fi> 939 940 * src/racoon/: privsep.c, session.c, session.h: From Krzysztof 941 Piotr Oledzki <olel@ans.pl>: Revert parts of 2008-08-06 commit; the 942 problem those changes address are already handled in a sensible way 943 by Cyrus Rahman's patch from 2008-03-06. 944 9452008-10-09 Timo Teras <timo.teras@iki.fi> 946 947 * src/racoon/isakmp_quick.c: From Arnaud Ebalard: remove 948 unnecessary unbindph12() call which is now done in remph2() 949 9502008-09-25 Yvan Vanhullebus <vanhu@netasq.com> 951 952 * src/racoon/isakmp.c: Fixed resending mechanism to have non-ESP 953 marker for retransmitted packets 954 9552008-09-19 Thomas Klausner <wiz@netbsd.org> 956 957 * src/racoon/racoon.conf.5: New sentence, new line. 958 9592008-09-19 Timo Teras <timo.teras@iki.fi> 960 961 * src/racoon/: admin.c, cfparse.y, cftoken.l, handler.c, handler.h, 962 isakmp.c, isakmp_cfg.c, isakmp_inf.c, isakmp_quick.c, 963 isakmp_var.h, isakmp_xauth.c, pfkey.c, proposal.c, racoon.conf.5, 964 remoteconf.c, remoteconf.h: Implement ISAKMP SA rekeying 965 configurable with rekey {on|off|force} option in remote conf. 966 967 * src/racoon/: handler.c, handler.h, isakmp.c, isakmp_inf.c, 968 isakmp_quick.c, isakmp_var.h, isakmp_xauth.c, isakmp_xauth.h, 969 nattraversal.c, pfkey.c, pfkey.h, schedule.c, schedule.h, 970 session.c: Change struct sched to be allocated be the caller to 971 avoid some memory allocations. Optimize scheduling algorithm to not 972 scan all entries in the main loop. 973 9742008-09-17 Yvan Vanhullebus <vanhu@netasq.com> 975 976 * src/racoon/isakmp_inf.c: Fixed port match in purge_ipsec_spi() 977 when NAT-T enabled and trying to purge non NAT-T SAs 978 9792008-09-09 Yvan Vanhullebus <vanhu@netasq.com> 980 981 * src/racoon/pfkey.c: Some calls to set_port() were not correctly 982 updated in the previous commit 983 9842008-09-03 Yvan Vanhullebus <vanhu@netasq.com> 985 986 * src/racoon/pfkey.c: From Tomas Mraz: Duplicate addresses in 987 pk_sendxxx functions, as they may be altered for NAT-T stuff. 988 9892008-09-03 Timo Teras <timo.teras@iki.fi> 990 991 * src/: libipsec/pfkey.c, racoon/pfkey.c, racoon/sockmisc.c: 992 - Fix reloading of SPD (Linux satype check, handling of SPD dump 993 responses) 994 - Remove some spurious error log message from extract_port() 995 9962008-08-29 Gregory McGarry <gmcgarry@netbsd.org> 997 998 * src/racoon/isakmp.c: Eliminate gcc-specific feature of empty 999 structures. 1000 1001 * src/racoon/evt.h: Eliminate superfluous semicolon. 1002 1003 * src/racoon/: admin.c, admin.h: Eliminate gcc-specific feature of 1004 unnamed structures added recently. 1005 10062008-08-12 Yvan Vanhullebus <vanhu@netasq.com> 1007 1008 * src/racoon/isakmp.c: From Krzysztof Piotr Oledzki: Remove 1009 ph1handler if we received an invalid first exchange from initiator. 1010 10112008-08-06 Timo Teras <timo.teras@iki.fi> 1012 1013 * src/racoon/: privsep.c, session.c, session.h: From Krzysztof 1014 Piotr Oledzki: Make privileged process exit if unprivileged process 1015 is terminated and some spelling fixes. 1016 10172008-07-23 Matthew Grooms <mgrooms@shrew.net> 1018 1019 * src/racoon/: cfparse.y, session.c: Add some missing ifdefs 1020 required for non-radius enabled builds. 1021 10222008-07-23 Timo Teras <timo.teras@iki.fi> 1023 1024 * src/racoon/Makefile.am: Do not use GNU make specific extension. 1025 1026 * src/: libipsec/Makefile.am, racoon/Makefile.am, 1027 setkey/Makefile.am: Do flex/bison invocation in a more standard 1028 way, and keep the generated files in the dist tarball. 1029 10302008-07-22 Yvan Vanhullebus <vanhu@netasq.com> 1031 1032 * src/racoon/proposal.c: From Kohki Ohhira: fix some memory leaks, 1033 when malloc fails or when peer sends invalid proposal. 1034 10352008-07-22 Matthew Grooms <mgrooms@shrew.net> 1036 1037 * src/racoon/: cfparse.y, cftoken.l, isakmp_cfg.c, isakmp_xauth.c, 1038 isakmp_xauth.h, main.c, racoon.conf.5, session.c: Add an optional 1039 radius configuration section to the racoon.conf file. This is 1040 similar to the the LDAP configuration section and overrides settings 1041 in the system radius configuration file. 1042 10432008-07-21 Matthias Scheler <tron@netbsd.org> 1044 1045 * src/racoon/cfparse.y: Correct typo to fix the build. 1046 10472008-07-21 Timo Teras <timo.teras@iki.fi> 1048 1049 * src/racoon/: isakmp_agg.c, isakmp_base.c, isakmp_ident.c, 1050 vendorid.c, vendorid.h: Separate generic vendor id handling to a 1051 new function and use it. 1052 1053 * src/racoon/cfparse.y: Do not set default gss id if xauth is used, 1054 otherwise gss-id attribute might be sent even if it was not 1055 requested. 1056 10572008-07-15 Matthew Grooms <mgrooms@shrew.net> 1058 1059 * src/racoon/isakmp_cfg.c: Fix an a typo that prevented racoon from 1060 building with hybrid enabled. 1061 1062 * src/racoon/: crypto_openssl.c, eaytest.c, misc.c, misc.h, 1063 racoonctl.c: Fix a conflict with the FreeBSD 8 system hexdump 1064 function. 1065 10662008-07-14 Timo Teras <timo.teras@iki.fi> 1067 1068 * src/racoon/: handler.h, ipsec_doi.c, ipsec_doi.h, isakmp_quick.c, 1069 pfkey.c: Handle RESPONDER-LIFETIME notification in quick mode. 1070 1071 * src/racoon/: handler.h, isakmp.c, isakmp_agg.c, isakmp_ident.c, 1072 isakmp_inf.c, isakmp_inf.h, isakmp_quick.c, strnames.c: Clean up 1073 notification payload handling. Handle INITIAL-CONTACT notification 1074 in last main mode exchange (delayed) and during quick mode 1075 exchanges. 1076 10772008-07-11 Timo Teras <timo.teras@iki.fi> 1078 1079 * src/racoon/: isakmp.c, isakmp_inf.c: Original patch from Atis 1080 Elsts: Fix a double memory free and a memory corruption 1081 (LIST_REMOVE() on an uninserted node) in some error handling paths. 1082 10832008-07-09 Timo Teras <timo.teras@iki.fi> 1084 1085 * src/racoon/cfparse.y: From Chong Peng: fix a file descriptor and 1086 memory leak on configuration file reread 1087 10882008-07-02 Yvan Vanhullebus <vanhu@netasq.com> 1089 1090 * src/racoon/isakmp_inf.c: From Timo Teras: fix some %d to %zu 1091 (size_t values) 1092 10932008-06-18 Thomas Klausner <wiz@netbsd.org> 1094 1095 * src/racoon/racoonctl.8: Bump date for previous. 1096 10972008-06-18 Matthew Grooms <mgrooms@shrew.net> 1098 1099 * src/racoon/: admin.c, admin.h, racoonctl.8, racoonctl.c: Add an 1100 admin port command to retrieve the peer certificate. Submitted by 1101 Timo Teras. 1102 1103 * src/racoon/: admin.c, grabmyaddr.c, isakmp.c, misc.c, misc.h: Set 1104 sockets to be closed on exec to avoid potential file descriptor 1105 inheritance issues. Submitted by Timo Teras. 1106 1107 * src/racoon/: admin.c, grabmyaddr.c, ipsec_doi.c, isakmp.c, 1108 isakmp_cfg.c, isakmp_inf.c, privsep.c, remoteconf.c: Use utility 1109 functions to evaluate and manipulate network port values. No 1110 functional changes. Submitted by Timo Teras. 1111 1112 * src/racoon/: admin.c, racoonctl.c: Admin port code cleanup. No 1113 functional changes. Submitted by Timo Teras. 1114 1115 * src/racoon/pfkey.c: Correct a phase2 status event. Submitted by 1116 Timo Teras. 1117 11182008-05-24 Christos Zoulas <christos@netbsd.org> 1119 1120 * src/racoon/privsep.c: Coverity CID 5018: Fix double frees. 1121 11222008-05-08 Emmanuel Dreyfus <manu@netbsd.org> 1123 1124 * configure.ac: From Christian Hohnstaedt: allow out of tree 1125 building 1126 11272008-04-30 Martin Husemann <martin@netbsd.org> 1128 1129 * netbsd-import.sh: Convert TNF licenses to new 2 clause variant 1130 11312008-04-25 Yvan Vanhullebus <vanhu@netasq.com> 1132 1133 * src/racoon/isakmp_inf.c: From Timo Teras: extract port numbers 1134 from SADB_X_EXT_NAT_T[SD]PORT if present in purge_ipsec_spi(). 1135 11362008-04-13 Christos Zoulas <christos@netbsd.org> 1137 1138 * src/racoon/privsep.c: for symmetry set controllen the same way we 1139 set it on the receiving side. 1140 11412008-04-02 Emmanuel Dreyfus <manu@netbsd.org> 1142 1143 * src/racoon/: Makefile.am, sockmisc.c, sockmisc.h: fix Linux build 1144 11452008-03-28 Christos Zoulas <christos@netbsd.org> 1146 1147 * src/racoon/privsep.c: properly fix the variable stack allocation 1148 code. 1149 11502008-03-28 Emmanuel Dreyfus <manu@netbsd.org> 1151 1152 * src/racoon/privsep.c: Still from Cyrus Rahman: fix file 1153 descriptor leak introduced by previous commit. 1154 1155 * src/racoon/: Makefile.am, isakmp.c, isakmp_inf.c, privsep.c, 1156 privsep.h, sockmisc.c, doc/README.privsep: From Cyrus Rahman: 1157 Allow interface reconfiguration when running in privilege separation 1158 mode, document privilege separation 1159 11602008-03-06 Yvan Vanhullebus <vanhu@netasq.com> 1161 1162 * src/racoon/oakley.c: Generates a log if cert validation has been 1163 disabled by configuration 1164 11652008-03-06 Emmanuel Dreyfus <manu@netbsd.org> 1166 1167 * src/racoon/: privsep.c, session.c: From Cyrus Rahman 1168 <crahman@gmail.com> privilegied instance exit when unprivilegied one 1169 terminates. Save PID in real root, not in chroot 1170 11712008-03-06 Matthew Grooms <mgrooms@shrew.net> 1172 1173 * src/racoon/: admin.c, isakmp.c, isakmp_var.h, pfkey.c, 1174 racoonctl.8, racoonctl.c: Add the ability to initiate IPsec SA 1175 negotiations using the admin socket. Submitted by Timo Teras. 1176 1177 * src/racoon/: admin.c, admin.h, evt.c, evt.h, handler.c, 1178 handler.h, isakmp.c, isakmp_agg.c, isakmp_base.c, isakmp_cfg.c, 1179 isakmp_ident.c, isakmp_inf.c, isakmp_var.h, isakmp_xauth.c, 1180 racoonctl.8, racoonctl.c, session.c: Refactor admin socket event 1181 protocol to be less error prone. Backwards compatibility is 1182 provided. Submitted by Timo Teras. 1183 11842008-03-05 Matthew Grooms <mgrooms@shrew.net> 1185 1186 * src/racoon/cfparse.y: Properly initialize the unity network 1187 struct to prevent erroneous protocol and port info from being 1188 transmitted. 1189 1190 * src/racoon/: pfkey.c, pfkey.h, session.c: Reload SPD on SIGHUP or 1191 adminport reload. Also provide better handling for pfkey socket read 1192 errors. Submitted by Timo Teras. 1193 11942008-02-25 Emmanuel Dreyfus <manu@netbsd.org> 1195 1196 * src/racoon/ipsec_doi.c: From Brian Haley <brian.haley@hp.com> 1197 There's a cut/paste error in cmp_aproppair_i(), it's supposed to be 1198 checking spi_size but it's not. I'm not sure this patch is correct, 1199 but what's there isn't either. 1200 12012008-02-22 Emmanuel Dreyfus <manu@netbsd.org> 1202 1203 * src/racoon/isakmp.c: Fix address length, from Brian Haley 1204 12052008-02-10 S.P.Zeidler <spz@netbsd.org> 1206 1207 * src/racoon/ipsec_doi.c: closes PR bin/37644 did not meet violent 1208 opposition ( :) ) on ipsec-tools-devel 1209 12102008-01-11 Yvan Vanhullebus <vanhu@netasq.com> 1211 1212 * src/racoon/isakmp_inf.c: From Timo Teras: reset iph1->dpd_r_u in 1213 the scheduler's callback, to avoid access to freed memory. 1214 1215 * src/racoon/crypto_openssl.c: From Krzysztof Oledzki: Fix 1216 compilation with IDEA and recent gcc. 1217 1218 * src/racoon/isakmp_inf.c: From Krzysztof Oledzki: added some 1219 details to some logs (also reported new getph1byaddr() arg). 1220 1221 * src/racoon/isakmp.c: From Krzysztof Oledzki: Only search for 1222 established ph1 handles in DPD (also reported new getph1byaddr() 1223 arg). 1224 1225 * src/racoon/: handler.c, handler.h: added an 'established' arg to 1226 getph1byaddr() 1227 12282007-12-31 Matthew Grooms <mgrooms@shrew.net> 1229 1230 * src/racoon/: policy.c, racoonctl.8, racoonctl.c: Add GRE protocol 1231 number to racoonctl. Correct id wildcard matching for transport 1232 mode. Submitted by Timo Teras. 1233 12342007-12-12 Matthew Grooms <mgrooms@shrew.net> 1235 1236 * NEWS, src/racoon/isakmp_quick.c: Add corrections submitted in a 1237 follow up patch for the nat-t oa support. 1238 1239 * src/racoon/: handler.c, handler.h, isakmp_quick.c, pfkey.c: Add 1240 support for nat-t oa payload handling. Submitted by Timo Teras. 1241 12422007-12-04 Matthew Grooms <mgrooms@shrew.net> 1243 1244 * src/racoon/: ipsec_doi.c, ipsec_doi.h, isakmp_quick.c: Modify 1245 ipsecdoi_sockaddr2id() to obtain an id without specifying the exact 1246 prefix length. Correct a memory leak in phase2. Both submitted by 1247 Timo Teras. 1248 12492007-12-01 Thomas Klausner <wiz@netbsd.org> 1250 1251 * src/racoon/racoon.conf.5: Fix typos. New sentence, new line. 1252 12532007-11-29 Yvan Vanhullebus <vanhu@netasq.com> 1254 1255 * src/racoon/Makefile.am: From Natanael Copa: fixed a race 1256 condition when building yacc stuff. 1257 12582007-11-09 Yvan Vanhullebus <vanhu@netasq.com> 1259 1260 * src/racoon/pfkey.c: From Arnaud Ebalard: Some sanity checking in 1261 pk_recv() 1262 1263 * src/racoon/policy.c: From Arnaud Ebalard: Better matching of SPD 1264 entries in getsp_r(). 1265 1266 * src/racoon/isakmp_quick.c: From Arnaud Ebalard: Added some debug 1267 in get_proposal_r(). 1268 12692007-10-19 Emmanuel Dreyfus <manu@netbsd.org> 1270 1271 * src/racoon/: isakmp_cfg.c, isakmp_unity.c, isakmp_unity.h, 1272 racoon.conf.5: Add SPLITNET_{INCLUDR_LOCAL}_CIDR to hook scripts 1273 12742007-10-15 Yvan Vanhullebus <vanhu@netasq.com> 1275 1276 * src/libipsec/pfkey.c: Try to increase the buffer size of the 1277 pfkey socket, this may help things when we have a huge SPD 1278 12792007-10-02 Yvan Vanhullebus <vanhu@netasq.com> 1280 1281 * src/racoon/crypto_openssl.c: From Scott Lamb: include plog.h to 1282 work with the new plog macro. 1283 1284 * src/racoon/kmpstat.c: From Scott Lamb: plog changed to _plog to 1285 work with new plog macro 1286 1287 * src/racoon/: plog.c, plog.h: From Scott Lamb: new plog macro. 1288 12892007-09-19 Matthew Grooms <mgrooms@shrew.net> 1290 1291 * src/racoon/isakmp.c: Set REUSE option on sockets to prevent 1292 failures associated with closing and immediately re-opening. 1293 Submitted by Gabriel Somlo. 1294 1295 * src/racoon/isakmp_unity.c: Prevent duplicate entries in splitnet 1296 list. Submitted by Gabriel Somlo. 1297 12982007-09-13 Matthew Grooms <mgrooms@shrew.net> 1299 1300 * configure.ac: Fix autoconf check for selinux support. Submitted 1301 by Joy Latten. 1302 13032007-09-12 Matthew Grooms <mgrooms@shrew.net> 1304 1305 * src/racoon/: cfparse.y, cftoken.l, handler.c, isakmp_quick.c, 1306 pfkey.c, racoon.conf.5, sainfo.c, sainfo.h: Implement clientaddr 1307 sainfo remote id option and refine the sainfo man page syntax. 1308 13092007-09-05 Matthew Grooms <mgrooms@shrew.net> 1310 1311 * src/racoon/sainfo.c: Sort sainfo sections on insert and improve 1312 matching logic. 1313 13142007-09-03 Matthew Grooms <mgrooms@shrew.net> 1315 1316 * src/racoon/: cftoken.l, racoon.conf.5: Correct the syntax for 1317 wins4 in the man page and add nbns4 as an alias. Pointed out by 1318 Claas Langbehn. 1319 13202007-08-07 Emmanuel Dreyfus <manu@netbsd.org> 1321 1322 * src/racoon/isakmp_xauth.c: src/racoon/isakmp_xauth.c: Don't mix 1323 up RADIUS authentication and authorization ports. Allow 1324 interoperability with freeradius 1325 13262007-07-24 Matthew Grooms <mgrooms@shrew.net> 1327 1328 * NEWS: Update NEWS file with additional 0.7 improvements. 1329 13302007-07-18 Matthew Grooms <mgrooms@shrew.net> 1331 1332 * src/racoon/racoon.conf.5: Various racoon configuration manpage 1333 updates. 1334 13352007-07-18 Yvan Vanhullebus <vanhu@netasq.com> 1336 1337 * configure.ac, src/libipsec/ipsec_dump_policy.c, 1338 src/libipsec/ipsec_get_policylen.c, 1339 src/libipsec/ipsec_strerror.c, src/libipsec/key_debug.c, 1340 src/libipsec/libpfkey.h, src/libipsec/pfkey.c, 1341 src/libipsec/pfkey_dump.c, src/libipsec/policy_parse.y, 1342 src/libipsec/policy_token.l, src/libipsec/test-policy-priority.c, 1343 src/racoon/admin.c, src/racoon/backupsa.c, src/racoon/cfparse.y, 1344 src/racoon/cftoken.l, src/racoon/ipsec_doi.c, 1345 src/racoon/isakmp.c, src/racoon/isakmp_inf.c, 1346 src/racoon/isakmp_quick.c, src/racoon/pfkey.c, 1347 src/racoon/policy.c, src/racoon/proposal.c, 1348 src/racoon/remoteconf.c, src/racoon/sainfo.c, 1349 src/racoon/session.c, src/racoon/sockmisc.c, 1350 src/racoon/strnames.c, src/setkey/parse.y, src/setkey/setkey.c, 1351 src/setkey/token.l: use a single PATH_IPSEC_H to fix some 1352 path_to_ipsec.h issues 1353 13542007-07-16 Yvan Vanhullebus <vanhu@netasq.com> 1355 1356 * src/racoon/grabmyaddr.c: fixed a socket leak 1357 1358 * src/racoon/proposal.c: indentation 1359 13602007-06-07 Emmanuel Dreyfus <manu@netbsd.org> 1361 1362 * src/racoon/isakmp_cfg.c: From Paul Winder 1363 <Paul.Winder@tadpole.com>: Fix ignored INTERNAL_DNS4_LIST 1364 13652007-06-06 Yvan Vanhullebus <vanhu@netasq.com> 1366 1367 * src/racoon/: eaytest.c, var.h: From Rong-En Fan: fix compilation 1368 with gcc 4.2 1369 1370 * src/racoon/session.c: From Jianli Liu: speed up interfaces update 1371 when they change. 1372 1373 * src/racoon/handler.c: ignore obsolete lifebyte when validating 1374 reloaded configuration 1375 13762007-05-31 Emmanuel Dreyfus <manu@netbsd.org> 1377 1378 * src/racoon/: main.c, policy.h, security.c: From Joy Latten 1379 <latten@austin.ibm.com> Fix file descriptor shortage when using 1380 labeled IPsec. 1381 13822007-05-30 Emmanuel Dreyfus <manu@netbsd.org> 1383 1384 * src/racoon/kmpstat.c: From Jianli Liu <jlliu@nortel.com>: In 1385 racoonctl, use the specified socket path instead of the default 1386 location 1387 13882007-05-16 Christos Zoulas <christos@netbsd.org> 1389 1390 * src/racoon/cfparse.y: coverity CID 4168: yyerror() does not 1391 return, so we proceed to de-reference NULL. Make it return -1 1392 instead like in other places. 1393 1394 * src/racoon/cfparse.y: coverity CID 4170: yyerror() does not 1395 return, so we proceed to de-reference NULL. Make it return -1 1396 instead like in other places. 1397 13982007-05-04 Yvan Vanhullebus <vanhu@netasq.com> 1399 1400 * src/racoon/handler.c: search a ph1 by address if iph2->ph1 is 1401 NULL when validating the new config 1402 1403 * src/racoon/handler.c: added some debug in getph1byaddr() to track 1404 some port matching problems with NAT-T 1405 1406 * src/racoon/isakmp.c: added some debug in isakmp_chkph1there() to 1407 track some port matching problems with NAT-T 1408 1409 * src/racoon/isakmp_inf.c: added some debug for DELETE_SA process 1410 1411 * src/racoon/pfkey.c: Force the update of ph2 in pk_recvupdate() if 1412 NAT_T support, to solve some port match problems with the first 1413 IPSec SAs negociated as initiator 1414 14152007-04-04 Yvan Vanhullebus <vanhu@netasq.com> 1416 1417 * src/racoon/ipsec_doi.c: checks proto_id in ipsecdoi_chkcmpids() 1418 1419 * src/racoon/oakley.c: dumps peer's ID and peer's certificate 1420 subject /subjectaltname if they don't match 1421 14222007-03-26 Yvan Vanhullebus <vanhu@netasq.com> 1423 1424 * src/racoon/isakmp_inf.c: Store the DPD main scheduler in ph1 1425 handler, to be able to cancel it when removing the handler, and some 1426 minor cleanups in DPD code 1427 14282007-03-24 Christos Zoulas <christos@netbsd.org> 1429 1430 * src/racoon/isakmp_xauth.c: PR/36069: Huang Yushuo: racoon can't 1431 work with pam_group Set RUSER. 1432 14332007-03-23 Yvan Vanhullebus <vanhu@netasq.com> 1434 1435 * src/racoon/: ipsec_doi.c, security.c: From Joy Latten: fix a 1436 segfault when using security labels between 32bit and 64bit host. 1437 1438 * src/racoon/handler.c: expire zombie handlers in getph2byid(), to 1439 avoid situations where we'll never negociate a phase2 again 1440 1441 * src/racoon/: oakley.c, racoon.conf.5: From Cyrus Rahman: give 1442 more details about what is checked when using certificates to 1443 authenticate 1444 14452007-03-22 Yvan Vanhullebus <vanhu@netasq.com> 1446 1447 * src/racoon/: cfparse.y, ipsec_doi.c: fixed subnet check to 1448 generate IPV4_ADDRESS when needed in sockaddr2id() 1449 14502007-03-21 Yvan Vanhullebus <vanhu@netasq.com> 1451 1452 * src/racoon/: handler.c, isakmp.c, isakmp_inf.c, pfkey.c: NULL 1453 sched check is now done in SCHED_KILL 1454 1455 * src/racoon/schedule.h: checks if arg is NULL in SCHED_KILL 1456 14572007-03-15 Yvan Vanhullebus <vanhu@netasq.com> 1458 1459 * src/racoon/grabmyaddr.c: From Yves-Alexis Perez: enable 1460 monitoring of ipv6 address changes on Linux. 1461 1462 * src/racoon/isakmp.c: Consider a negociation timeout when 1463 retry_counter is <=0 instead of < 0 1464 14652007-02-28 Matthew Grooms <mgrooms@shrew.net> 1466 1467 * src/racoon/ipsec_doi.c: Add logic to allow ip address ids to be 1468 matched to ip subnet ids when appropriate. 1469 14702007-02-21 Yvan Vanhullebus <vanhu@netasq.com> 1471 1472 * src/racoon/ipsec_doi.c: block variable declaration before code in 1473 ipsecdoi_id2str() 1474 14752007-02-20 Yvan Vanhullebus <vanhu@netasq.com> 1476 1477 * src/racoon/isakmp_inf.c: Removed a debug printf.... 1478 1479 * src/racoon/isakmp.c: Only delete a generated SPD if it's creation 1480 date matches the creation date of the SA we are currently deleting 1481 1482 * src/racoon/: handler.c, isakmp_var.h: updated delete_spd() calls 1483 1484 * src/racoon/: isakmp_inf.c, pfkey.c: fills creation date of 1485 generated SPDs 1486 1487 * src/racoon/policy.h: added 'created' var 1488 14892007-02-19 Yvan Vanhullebus <vanhu@netasq.com> 1490 1491 * src/racoon/isakmp.c: Removed a debug printf.... 1492 14932007-02-16 Yvan Vanhullebus <vanhu@netasq.com> 1494 1495 * src/racoon/ipsec_doi.c: From Olivier Warin: Fix a %zu in a 1496 printf. 1497 14982007-02-15 Emmanuel Dreyfus <manu@netbsd.org> 1499 1500 * src/racoon/security.c: Missing SELinux file 1501 1502 * configure.ac: Missing stuff for SELinux 1503 15042007-02-15 Yvan Vanhullebus <vanhu@netasq.com> 1505 1506 * src/racoon/isakmp_inf.c: From "Uncle Pedro" on sf.net: Just 1507 expire a ph1 handle when receiving a DELETE-SA instead of calling 1508 purge_remote(). 1509 1510 * src/racoon/isakmp.c: Fixed the way phase1/2 messages are 1511 sent/resent, to avoid zombie handles and acces to freed memory 1512 15132007-02-02 Yvan Vanhullebus <vanhu@netasq.com> 1514 1515 * src/racoon/cfparse.y: Fixed a check of NAT-T support in libipsec 1516 15172007-02-01 Yvan Vanhullebus <vanhu@netasq.com> 1518 1519 * src/racoon/isakmp_inf.c: From "Uncle Pedro" on sf.net: When 1520 receiving an ISAKMP DELETE_SA, get the cookie of the SA to be 1521 deleted from payload instead of just deleting the ISAKMP SA used to 1522 protect the informational exchange. 1523 15242006-12-26 Arnaud Lacombe <alc@netbsd.org> 1525 1526 * src/racoon/ipsec_doi.c: CID-4167: check for 'iph1->approval != 1527 NULL' 1528 15292006-12-23 Thomas Klausner <wiz@netbsd.org> 1530 1531 * src/racoon/racoon.conf.5: Use even more macros. 1532 1533 * src/racoon/racoon.conf.5: Use more macros. 1534 1535 * src/racoon/racoon.conf.5: Serial comma, and bump date for 1536 previous. 1537 15382006-12-18 Yvan Vanhullebus <vanhu@netasq.com> 1539 1540 * src/racoon/crypto_openssl.c: From Joy Latten: fix a memory leak 1541 15422006-12-10 tag ipsec-tools-0_7-base 1543 15442006-12-10 Emmanuel Dreyfus <manu@netbsd.org> 1545 1546 * src/: libipsec/Makefile.am, libipsec/libpfkey.h, 1547 libipsec/pfkey.c, racoon/backupsa.c, racoon/cfparse.y, 1548 racoon/pfkey.c: Bring back API and ABI backward compatibility 1549 with previous libipsec before recent interface change. Bump libipsec 1550 minor version. Remove ifdefs in struct pfkey_send_sa_args to avoid 1551 ABI compatibility lossage. Add a capability flags to detect missing 1552 optional feature in libipsec 1553 1554 * src/racoon/: Makefile.am, doc/README.plainrsa: From Joy Latten: 1555 README.plainrsa documenting plain RSA auth 1556 15572006-12-09 Emmanuel Dreyfus <manu@netbsd.org> 1558 1559 * configure.ac, src/libipsec/libpfkey.h, src/libipsec/pfkey.c, 1560 src/racoon/Makefile.am, src/racoon/backupsa.c, 1561 src/racoon/backupsa.h, src/racoon/cftoken.l, 1562 src/racoon/ipsec_doi.c, src/racoon/ipsec_doi.h, 1563 src/racoon/isakmp_inf.c, src/racoon/isakmp_quick.c, 1564 src/racoon/pfkey.c, src/racoon/policy.c, src/racoon/policy.h, 1565 src/racoon/proposal.c, src/racoon/proposal.h, 1566 src/racoon/remoteconf.c: From Joy Latten: Add support for SELinux 1567 security contexts. Also cleanup the libipsec interface for adding 1568 and updating security associations. 1569 1570 * src/racoon/racoon.conf.5: From Simon Chang: More hints about 1571 plain RSA authentication 1572 15732006-12-05 Yvan Vanhullebus <vanhu@netasq.com> 1574 1575 * src/racoon/: proposal.c, proposal.h, racoon.conf.5: Check keys 1576 length regarding proposal_check level 1577 15782006-11-16 Matthew Grooms <mgrooms@shrew.net> 1579 1580 * src/racoon/sainfo.c: Correct issues associated with anonymous 1581 sainfo selection in racoon. 1582 15832006-11-09 Christos Zoulas <christos@netbsd.org> 1584 1585 * src/racoon/crypto_openssl.c: eliminate the only variable stack 1586 array allocation. 1587 15882006-10-31 Christian Biere <cbiere@netbsd.org> 1589 1590 * src/racoon/sockmisc.c: Don't define the deprecated 1591 IPV6_RECVDSTADDR if the "advanced IPv6 API" is used because 1592 IPV6_RECVPKTINFO and IPV6_PKTINFO are used to prevent potential bugs 1593 in the future just in case that the numeric value of the socket 1594 option is ever recycled. 1595 15962006-10-22 Yvan Vanhullebus <vanhu@netasq.com> 1597 1598 * src/racoon/: backupsa.c, cfparse.y: From Michal Ruzicka: fix 1599 typos 1600 16012006-10-19 Yvan Vanhullebus <vanhu@netasq.com> 1602 1603 * src/racoon/sainfo.c: From Matthew Grooms: use 1604 ipsecdoi_chkcmpids() and changed src/dst to loc/rmt in getsainfo(). 1605 1606 * src/racoon/: ipsec_doi.c, ipsec_doi.h: From Matthew Grooms: Added 1607 ipsecdoi_chkcmpids() function. 1608 16092006-10-09 Emmanuel Dreyfus <manu@netbsd.org> 1610 1611 * src/racoon/proposal.c: Fix memory leak (Coverity 3438 and 3437) 1612 1613 * src/racoon/isakmp_unity.c: Correctly check read() return value: 1614 it's signed (Coverity 1251) 1615 16162006-10-06 Emmanuel Dreyfus <manu@netbsd.org> 1617 1618 * configure.ac, src/libipsec/pfkey_dump.c, src/racoon/algorithm.c, 1619 src/racoon/algorithm.h, src/racoon/cftoken.l, 1620 src/racoon/crypto_openssl.c, src/racoon/crypto_openssl.h, 1621 src/racoon/eaytest.c, src/racoon/ipsec_doi.c, 1622 src/racoon/ipsec_doi.h, src/racoon/oakley.h, src/racoon/pfkey.c, 1623 src/racoon/racoon.conf.5, src/racoon/strnames.c, 1624 src/setkey/setkey.8, src/setkey/test-pfkey.c, src/setkey/token.l: 1625 Camelia cipher support as in RFC 4312, from Tomoyuki Okazaki 1626 <okazaki@kick.gr.jp> 1627 16282006-10-03 Emmanuel Dreyfus <manu@netbsd.org> 1629 1630 * src/racoon/admin.c: fix endianness issue introduced yesterday 1631 16322006-10-03 Yvan Vanhullebus <vanhu@netasq.com> 1633 1634 * src/racoon/racoon.conf.5: Added remoteid/ph1id syntax 1635 1636 * src/racoon/: cfparse.y, cftoken.l: Parses remoteid/ph1id values 1637 1638 * src/racoon/: handler.c, isakmp_quick.c, pfkey.c, sainfo.c: Uses 1639 remoteid/ph1id values 1640 1641 * src/racoon/: remoteconf.h, sainfo.h: Added remoteid/ph1id values 1642 16432006-10-02 Emmanuel Dreyfus <manu@netbsd.org> 1644 1645 * src/racoon/isakmp_base.c: 1646 avoid reusing free'd pointer (Coverity 2613) 1647 1648 * src/racoon/isakmp_inf.c: Check for NULL pointer (COverity 4175) 1649 1650 * src/racoon/isakmp_ident.c: Remove dead code (Coverity 3451) 1651 1652 * src/racoon/algorithm.c: Fix array overrun (Coverity 4172) 1653 1654 * src/racoon/admin.c: Fix memory leak (Coverity 2002) 1655 1656 * src/racoon/: admin.c, isakmp.c, sockmisc.c: Fix memory leak 1657 (Coverity 2001), refactor the code to use port get/set functions 1658 1659 * src/racoon/admin.c: Avoid reusing free'd pointer (Coverity 4200) 1660 1661 * src/racoon/oakley.c: Don't use NULL pointer (Coverity 3443), 1662 reformat to 80 char/line 1663 16642006-10-02 Tom Spindler <dogcow@netbsd.org> 1665 1666 * src/racoon/ipsec_doi.c: If you're going to initialize a pointer, 1667 you have to init it with a pointer type, not an int. 1668 16692006-10-02 Emmanuel Dreyfus <manu@netbsd.org> 1670 1671 * src/racoon/isakmp.c: Don't use NULL pointer (coverity 3439) 1672 1673 * src/racoon/ipsec_doi.c: Don't use NULL pointer (Coverity 1334) 1674 1675 * src/racoon/pfkey.c: Don't use NULL pointer (Coverity 944) 1676 1677 * src/racoon/proposal.c: Don't use NULL pointer (Coverity 941) 1678 1679 * src/racoon/racoonctl.c: Don't use NULL pointer (Coverity 942) 1680 1681 * src/racoon/sockmisc.c: Don't use null pointer (Coverity 863) 1682 16832006-10-01 Emmanuel Dreyfus <manu@netbsd.org> 1684 1685 * src/racoon/ipsec_doi.c: FIx memory leak (Coverity 4181) 1686 1687 * src/racoon/isakmp.c: Check that iph1->remote is not NULL before 1688 using it (Coverity 3436) 1689 16902006-09-30 Emmanuel Dreyfus <manu@netbsd.org> 1691 1692 * src/racoon/isakmp_agg.c: emove dead code (Coverity 4165) 1693 1694 * src/racoon/isakmp_cfg.c: Fix memory leak (Coverity 4179) 1695 1696 * src/racoon/samples/roadwarrior/client/: phase1-down.sh, 1697 phase1-up.sh: update the scripts for wrorking around routing 1698 problems on NetBSD 1699 1700 * src/racoon/session.c: Reuse existing code for closing IKE 1701 sockets, and avoid screwing things by setting p->sock = -1, which is 1702 not expected (Coverity 4173). 1703 1704 * src/racoon/admin.c: Do not free id and key, as they are used 1705 later 1706 17072006-09-29 Emmanuel Dreyfus <manu@netbsd.org> 1708 1709 * src/racoon/racoonctl.c: Fix the fix: handle_recv closes the 1710 socket, so we must call com_init before sending any data. 1711 17122006-09-28 Emmanuel Dreyfus <manu@netbsd.org> 1713 1714 * src/racoon/isakmp_xauth.c: Fix unchecked mallocs (Coverity 4176, 1715 4174) 1716 1717 * src/racoon/racoonctl.c: Fix access after free (Coverity 4178) 1718 17192006-09-26 Emmanuel Dreyfus <manu@netbsd.org> 1720 1721 * src/racoon/cfparse.y: Fix memory leak (Coverity) 1722 1723 * src/racoon/backupsa.c: Fix memory leak (Coverity) 1724 1725 * src/racoon/admin.c: Remove dead code (Coverity) 1726 1727 * src/racoon/admin.c: Fix memory leak (Coverity) 1728 1729 * src/racoon/admin.c: One more memory leak 1730 1731 * src/racoon/admin.c: Fix memory leak in racoonctl (coverity) 1732 1733 * src/racoon/ipsec_doi.c: Fix buffer overflow Also fix credits: SA 1734 bundle fix was contributed by Jeff Bailey, not Matthew Grooms. 1735 Matthew updated the patch for current code, though. 1736 1737 * src/racoon/: pfkey.c, proposal.c: fix SA bundle (e.g.: for 1738 negotiating ESP+IPcomp) 1739 17402006-09-25 Yvan Vanhullebus <vanhu@netasq.com> 1741 1742 * src/racoon/isakmp.c: From Yves-Alexis Perez: struct ip -> struct 1743 iphdr for Linux 1744 17452006-09-25 Emmanuel Dreyfus <manu@netbsd.org> 1746 1747 * src/racoon/isakmp.c: style (mostly for testing 1748 ipsec-tools-commits@netbsd.org) 1749 1750 * src/racoon/ipsec_doi.c: Fix double free, from Matthew Grooms 1751 17522006-09-21 Yvan Vanhullebus <vanhu@netasq.com> 1753 1754 * src/libipsec/pfkey.c: use sysdep_sa_len to make it compile on 1755 Linux 1756 17572006-09-19 Thomas Klausner <wiz@netbsd.org> 1758 1759 * src/racoon/racoon.conf.5: Bump date for ike_frag force. 1760 1761 * src/racoon/: plainrsa-gen.8, racoon.conf.5: New sentence, new 1762 line. 1763 1764 * src/racoon/: racoon.conf.5, plainrsa-gen.8: Remove trailing 1765 whitespace. 1766 17672006-09-19 Yvan Vanhullebus <vanhu@netasq.com> 1768 1769 * src/racoon/proposal.c: From Yves-Alexis Perez: fixes default 1770 value for encmodesv in set_proposal_from_policy() 1771 1772 * src/racoon/isakmp.c: always include some headers, as they are 1773 required even without NAT-T 1774 1775 * src/: libipsec/pfkey_dump.c, setkey/token.l: From Larry Baird: 1776 define SADB_X_EALG_AESCBC as SADB_X_EALG_AES if needed 1777 1778 * src/racoon/crypto_openssl.c: From Larry Baird: some printf() -> 1779 plog() 1780 17812006-09-18 Emmanuel Dreyfus <manu@netbsd.org> 1782 1783 * src/racoon/: cfparse.y, cftoken.l, isakmp.c, isakmp_frag.h, 1784 isakmp_inf.c, racoon.conf.5, remoteconf.c: From Matthew Grooms: 1785 ike_frag force option to force the use of IKE on first packet 1786 exchange (prior to peer consent) 1787 17882006-09-18 Yvan Vanhullebus <vanhu@netasq.com> 1789 1790 * rpm/suse/ipsec-tools.spec, src/racoon/prsa_tok.c: removed 1791 generated files from the CVS 1792 1793 * src/racoon/prsa_par.c: removed generated files from the CVS 1794 1795 * src/racoon/: cfparse.c, cftoken.c: removed generated files from 1796 the CVS 1797 17982006-09-18 Emmanuel Dreyfus <manu@netbsd.org> 1799 1800 * src/racoon/isakmp.c: From Matthew Grooms: handle IKE frag used in 1801 the first packet. That should not normally happen, as the initiator 1802 does not know yet if the responder can handle IKE frag. However, in 1803 some setups, the first packet is too big to get through, and 1804 assuming the peer supports IKE frag is the only way to go. 1805 1806 racoon should have a setting in the remote section to do taht 1807 (something like ike_frag force) 1808 18092006-09-16 Emmanuel Dreyfus <manu@netbsd.org> 1810 1811 * src/racoon/ipsec_doi.c: Trivial bugfix in RFC2407 4.6.2 1812 conformance, from Matthew Grooms 1813 18142006-09-15 Emmanuel Dreyfus <manu@netbsd.org> 1815 1816 * src/racoon/ipsec_doi.c: Fix build on Linux 1817 1818For older changes see ChangeLog.old 1819