CVS log for src/crypto/dist/ipsec-tools/src/racoon/isakmp_xauth.c

Up to [cvs.NetBSD.org] / src / crypto / dist / ipsec-tools / src / racoon

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

s/funtion/function/ in comment.

Add ldap parameters debug and timeout.
Fix bug when using URI (use correct len for malloc)
document ldap parameters uri, debug and timeout.

Add an option to pass a ldap uri, instead of just server and port.
uri takes precedence.

Fix ldap: ldap_sasl_bind_s() doens't like a NULL struct berval *, pass
a pointer to a zero'd struct instead.
While there use LDAP_SASL_SIMPLE instead of NULL for mechanism,
and check return of ldap_set_option().

Ooops, restore accidently removed files from merge mishap

Sync with HEAD

Sync with HEAD

Use strict prototypes, when they don't introduce more warnings than they fix.
Also localify a few functions.

More unused variables.

Pull up following revision(s) (requested by phx in ticket #1145):
	crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c: revision 1.26
	crypto/dist/ipsec-tools/src/racoon/isakmp.c: revision 1.75
	crypto/dist/ipsec-tools/src/racoon/isakmp_xauth.c: revision 1.28
	crypto/dist/ipsec-tools/src/racoon/isakmp_ident.c: revision 1.14
PR/50918: David Binderman: Fix memory leak
--
From Frank Wille:
Request "IKE mode config" in "rsasig" (certificates on both sides only)
authentication mode, if "mode_cfg" is configured to "on".
Tested with a Lancom router, using the following configuration:
path include "/etc/racoon";
path certificate "/etc/racoon/certs";
path script "/etc/racoon/scripts";
remote "wpsd"
{
    remote_address 1.2.3.4;
    exchange_mode main,base;
    my_identifier asn1dn;
    certificate_type x509 "vpnclient15.crt" "vpnclient15.key";
    ca_type x509 "ca.crt";
    mode_cfg on;
    dpd_delay 20;
    nat_traversal on;
    lifetime time 8 hour;
    script "phase1-up.sh" phase1_up;
    script "phase1-down.sh" phase1_down;
    proposal {
        encryption_algorithm aes;
        hash_algorithm md5;
        authentication_method rsasig;
        dh_group 2;
    }
    proposal_check obey;
}
sainfo anonymous
{
    pfs_group 2;
    lifetime time 8 hour;
    encryption_algorithm aes;
    authentication_algorithm hmac_md5;
    compression_algorithm deflate;
}

PR/50918: David Binderman: Fix memory leak

Rebase to HEAD as of a few days ago.

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Merge riastradh-drm2 to HEAD.

sync with HEAD

From Rainer Weikusat <rweikusat@mobileactivedefense.com>: Export phase1
remote address as Radius Calling-Station-Id.

resync with head

From Ian West <ian@niw.com.au>: Fix double free of the radius info on
config reload.

From Ian West <ian@niw.com.au>: Fix double free of the radius info on
config reload.

sync with head

From Vincent Bernat <bernat@luffy.cx>: TLS support for LDAP

fix prototype.

avoid some memory leaks / free memory access when reloading conf and have inherited config. patch from Roman Hoog Antink <rha@open.ch>

fixed some typos in logs (reported by fazaeli (at) sepehrs.com)

Sync with HEAD.

Third (and last) commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html

Orignally from Bin Li: Fix possible memory corruption in binsanitize().

Orignally from Bin Li: Fix possible memory corruption in binsanitize().

Apply patch (requested by manu/spz in #378):
Downgrade ipsec-tools to 0.7.1nb1.

Detect if monotonic system clock is available, and use it for relative
time measurements to avoid complite hang if time jumps backwards.

Fix authentication method ambiguity by internally using unique ID and
setting/interpreting the wire format based on received vendor ID:s. Fixes
trac #280.

Implement ISAKMP SA rekeying configurable with rekey {on|off|force} option
in remote conf.

Change struct sched to be allocated be the caller to avoid some memory
allocations. Optimize scheduling algorithm to not scan all entries in
the main loop.

Sync with wrstuden-revivesa-base-2.

Add an optional radius configuration section to the racoon.conf file. This
is similar to the the LDAP configuration section and overrides settings in
the system radius configuration file.

sync with head.

sync with HEAD

Refactor admin socket event protocol to be less error prone. Backwards compatibility is provided. Submitted by Timo Teras.

Sync w/ NetBSD-4-RC_1

Pull up following revision(s) (requested by manu in ticket #830):

Import ipsec-tools 0.7

Pull up following revision(s) (requested by manu in ticket #1823):
	crypto/dist/ipsec-tools/src/racoon/isakmp_xauth.c: revision 1.13
	crypto/dist/ipsec-tools/ChangeLog: revision 1.127
src/racoon/isakmp_xauth.c: Don't mix up RADIUS authentication and
authorization ports. Allow interoperability with freeradius

Don't mix up RADIUS authentication and authorization ports. Allow
interoperability with freeradius

src/racoon/isakmp_xauth.c: Don't mix up RADIUS authentication and
authorization ports. Allow interoperability with freeradius

PR/36069: Huang Yushuo: racoon can't work with pam_group
Set RUSER.

Fix unchecked mallocs (Coverity 4176, 4174)

Migration of ipsec-tools to NetBSD CVS part 2: resolving the import conflicts.
Since we previously had a release branch and we import here the HEAD of CVS,
let's assume all local changes are to be dumped. Local patches should have
been propagated upstream, anyway.

Migrate ipsec-tools CVS to cvs.netbsd.org

Fix Coverity run 5, issue 1966 -- memory leak
Approved by christos@.

Apply patch (requested by manu in ticket #981):
Update ipsec-tools to version 0.6.3.

Merge ipsec-tools 0.6.3 import

Merge ipsec-tools 0.6.2 import.

fix typos.

use get*_r()

Apply patch (requested by tron in ticket #741):
Update ipsec-tools to version 0.6.1.

Update to ipsec-tools 0.6.1

Resolve conflicts caused by recent ipsec-tools-0.6.1rc1 import by prefering
the newer software. Some useful local change might have been overwritten,
we'll take care of this soon.

Update ipsec-tools to 0.6.1rc1
Most of the changes since 0.6b4 have already been committed to the NetBSD
tree. This upgrade fixes some IPcomp and NAT-T related problems that were
left unadressed in the NetBSD tree.

Pull up revision 1.2 (requested by manu in ticket #336):
Really delete phase 1 on Xauth failure

Really delete phase 1 on Xauth failure

Updated ipsec-tools:

2005-03-16  Emmanuel Dreyfus <manu@netbsd.org>

        * src/racoon/{cftoken.l|localconf.h|privsep.c|racoon.conf.5}
          src/racoon/remoteconf.c: When running in privsep mode, check that
          private key and script paths match those given in the path section.

2005-03-15  Emmanuel Dreyfus <manu@netbsd.org>

        * src/racoon/{isakmp_cfg|isakmp_cfg.h|isakmp_xauth.c}: initialize
          RADIUS accounting at startup
        * src/racoon/privsep.c: fix minor bug in PAM cleanup
        * src/racoon/isakmp_cfg.c: only call cleanup_pam if PAM is used

2005-03-14  Emmanuel Dreyfus <manu@netbsd.org>

        * configure.ac: handle correctly dynamic libradius
        * src/racoon/cfparse.y: correctly initialize address pool

Import ipsec-tools ipsec-tools-0_6-20050314

Import ipsec-tools 0.6 branch as of 2005/02/23. News from last imported version
according to ipsec-tools' ChangeLog:

2005-02-23  Emmanuel Dreyfus <manu@netbsd.org>

        * configure.ac, src/racoon/{Makefile.am|crypto_openssl.c}: optionnal
          support for patented algorithms: IDEA and RC5.
        * src/racoon/{isakmp_xauth.c|main.c}: don't initialize RADIUS if it
          is not required in the configuration
        * src/racoon/isakmp.c: do not reject addresses for which kernel
          refused UDP encapsulation, they can still be used for non NAT-T
          traffic (eg: NAT-T enabled racoon on non NAT-T enabled kernel)

2005-02-18  Emmanuel Dreyfus <manu@netbsd.org>

        * src/racoon/{main.c|eaytest.c|plairsa-gen.c}
          src/setkey/setkey.c: don't use fuzzy paths for package_version.h

2005-02-18  Yvan Vanhullebus  <vanhu@free.fr>

        * src/racoon/isakmp_inf.c: Purge generated SPDs when getting a
          related DELETE_SA
        * src/racoon/pfkey.c: do NOT unbindph12() when SA acquire

2005-02-17  Emmanuel Dreyfus <manu@netbsd.org>

        From Fred Senault <fred.letter@lacave.net>
        * src/racoon/remoteconf.c: Fix a bug in script init

2005-02-17  Yvan Vanhullebus  <vanhu@free.fr>

        * src/racoon/ipsec_doi.c: Workaround for phase1 lifetime checks

2005-02-15  Michal Ludvig  <michal@logix.cz>

        * configure.ac: Changed --enable-natt_NN to --enable-natt-versions=NN,NN

Import ipsec-tools (tag ipsec-tools-0_6-base in ipsec-tools CVS)
ipsec-tools is a fork from KAME racoon/libipsec/setkey, with many
enhancements.

Initial revision