summaryrefslogtreecommitdiff
path: root/security/racoon
AgeCommit message (Collapse)AuthorFilesLines
2003-08-26upgrade to 20030826. corrects keylen miscomputation.itojun6-117/+13
2003-07-12$NetBSD$itojun4-4/+10
2003-07-12upgrade to 20030711 snapshot. (compiles at least on 1.6.1, not tested on 1.5)itojun5-6/+103
bunch of stability fixes
2003-03-22Install an rc.d script; closes PR pkg/20841 and PR pkg/20842 by David Ferlier.jmmv3-8/+32
Sort the Makefile a bit. Install a default configuration file in place. Bump PKGREVISION to 1.
2002-12-07Replace IGNORE with PKG_FAIL_REASON or PKG_SKIP_REASON as appropriate.schmonz1-2/+2
2002-11-20adjust version date embedded into binaryitojun1-3/+3
2002-11-20upgrade to 20021120.itojun4-36/+12
- fix sha2 computation (was in patch-ag) - plug some memory leaks - more strict isakmp header length check - correct phase 2 proposal reqid handling - check for fd_set overrun
2002-08-25Merge packages from the buildlink2 branch back into the main trunk thatjlam3-6/+6
have been converted to USE_BUILDLINK2.
2002-06-28Add PKG_SYSCONFDIR to BUILD_DEFS.seb1-2/+1
Note: it was already as part of CONFIGURE_ENV value, this change only makes it more "readable" IMHO. Remove explicit addition of PKG_SYSCONFDIR to BUILD_DEFS in a couple of Makefiles.
2002-06-25follow PKG_SYSCONFDIR (hope i did it right this time)itojun1-3/+6
2002-06-17kill USE_SSL, use openssl/buildlink.mk insteaddrochner1-8/+3
(to avoid building against a pkgsrc openssl w/o registering a dependency)
2002-05-20fix sha2 interoperability. From: "JuanJo Ciarlante" <jjo@mendoza.gov.ar>itojun2-1/+25
2002-05-13upgrade to 20020507a. logging issue is fixed. phase 2 negotiation w/itojun4-53/+7
unique policy is corrected.
2002-05-07fix arg to plogv().itojun5-5/+55
2002-04-26upgrade to 20020426a from kame.itojun4-45/+10
file descriptor leak fix. null encryption algorithm key length fix (should use 0). couple of null-pointer reference fixes. set port # to 500 in ID payload (possible interop issue - spec is unclear). correctly match address pair on informational exchange.
2002-04-16*** empty log message ***itojun1-1/+6
2002-04-15correct initial contact handling. PR 15949itojun2-1/+36
2002-04-15sync version number compiled into binary with pkg versionitojun1-2/+2
2001-12-14upgrade to 20011215a.itojun2-5/+5
- memory leaks has been plugged - retransmission logic has improved - 6144 DH MODP group
2001-11-01Move pkg/ files into package's toplevel directoryzuntum2-1/+1
2001-10-26upgrade to 20011026a. 20011016a had a serious bug in tunnel mode SAitojun2-6/+6
establishment.
2001-10-17correct version identification string.itojun1-2/+2
2001-10-17upgrade to 10/16 snapshot.itojun3-16/+7
- bugfixes in spd handling, scheduler leak. - make identity check more strict. - correct phase 2 proposal check.
2001-09-27Mechanical changes to 375 files to change dependency patterns of the formjlam1-2/+2
foo-* to foo-[0-9]*. This is to cause the dependencies to match only the packages whose base package name is "foo", and not those named "foo-bar". A concrete example is p5-Net-* matching p5-Net-DNS as well as p5-Net. Also change dependency examples in Packages.txt to reflect this.
2001-08-31upgrade to the latest (20010831a). a lot of bug fixes after helsinki IPsec/IKEitojun3-13/+13
bakeoff.
2001-08-06update. fix compilation on alpha.itojun2-6/+6
2001-08-02embed pkg version into binary to help diagnosis.itojun1-1/+2
2001-08-02make it at least compile on netbsd151 systems. kernel API diffs should beitojun3-1/+33
wrapped by configure.in scripts, however, we don't use them for libipsec part.
2001-08-02upgrade to 2001/8/2 KAME tree. whole bunch of stabilization were made.itojun2-5/+5
2001-06-28make sure to link against local libipsec.a.itojun3-8/+18
From: Michael Richardson <mcr@sandelman.ottawa.on.ca>
2001-06-12LIBS is automatically added to CONFIGURE_ENV by bsd.pkg.mk ifjlam1-2/+2
GNU_CONFIGURE is defined, so simply set LIBS to the appropriate value.
2001-06-11CPPFLAGS is now passed to MAKE_ENV and CONFIGURE_ENV by bsd.pkg.mk, sojlam1-3/+4
adapt by moving CPPFLAGS settings to top-level, and removing explicit inclusion of CPPFLAGS into MAKE_ENV and CONFIGURE_ENV.
2001-04-22remove "twofish" from sample configuration file, as the algorithmitojun2-8/+22
is not available in *BSD integrated KAME IPsec tree.
2001-04-18upgrade to latest racoon snapshot tar.gz on ftp.kame.net (20010418a).itojun2-4/+5
Wed Apr 11 18:52:26 JST 2001 sakane@ydc.co.jp * racoon: Supported to get a certificate from DNS CERT RR. Also getcertsbyname() is implemented In order to get CERT RRs. This function can use lwres.a if HAVE_LWRES is defined when racoon is compiled. XXX need more local test and interoperability test. XXX should be arranged too many certificate stuff in racoon.conf. 2001-04-10 Jason R. Thorpe <thorpej@zembu.com> * racoon/pfkey.c: pk_recvacquire(): Make sure the phase1 and phase2 handlers are unbound before the phase 2 handler is deleted. * racoon/isakmp.c: ph1_main(), quick_main(): Add the message to the received-list before processing to ensure the packet isn't processed twice in case of an error. isakmp_post_acquire(): Don't unbind the phase1/phase2 handlers; let the caller do it. isakmp_newcookie(): Plug memory leaks. From George Yang <gyang@zembu.com>. * racoon/ipsec_doi.c: get_ph2approvalx(): When we find a matching saprop, make sure to flushsaprop(pr0), as the returned saprop is a copy. Fixes a memory leak. From George Yang <gyang@zembu.com>. * racoon/isakmp_quick.c: quick_r2send(): Make sure to vfree(data) if we fail to allocate a new body. Fixes a memory leak. From George Yang <gyang@zembu.com>. Fri Apr 6 23:25:19 JST 2001 sakane@ydc.co.jp * racoon: implemented to generate the policy in the responder side automatically. If the responder does not have any policy in SPD during phase 2 negotiation, and the directive is set on, then racoon will choice the first proposal in the SA payload from the initiator, and generate policy entries from the proposal. This function is for the responder, and ignored in the initiator case. XXX should be checked tunnel mode case. 2001-04-04 Jason R. Thorpe <thorpej@zembu.com> * racoon: Add support for the Dmalloc debugging malloc library. This library gives very nice memory usage statistics and leak information. Wed Apr 4 22:47:27 JST 2001 sakane@ydc.co.jp * racoon: support scopeid. base code was from <Francis.Dupont@enst-bretagne.fr>. it should be considered more. 2001-04-03 Jason R. Thorpe <thorpej@zembu.com> * racoon: Better integration of debugging malloc libraries. Use wrapper macros (racoon_{malloc,calloc,free,realloc}()) so that debugging malloc implementations can get file/line info, and also put traditional malloc/calloc/free/realloc stubs in the main program so that libraries linked with racoon get the debugging allocators, as well. 2001-03-26 Jason R. Thorpe <thorpej@zembu.com> * racoon/isakmp_ident.c: ident_ir2sendmx(): plug memory leak -- gsstoken wasn't being freed at function exit. 2001-03-26 Jason R. Thorpe <thorpej@zembu.com> * racoon: Changes to Vendor ID payload handling. Determine which VID we will send on a per-proposal basis; we may need to send a different one for each proposal depending on the proposal contents (e.g. GSSAPI auth method). We no longer set the Vendor ID in the localconf. When matching the Vendor ID in check_vendorid(), use a table of known Vendor IDs, and return the index, and maintain a list of extensions that vendors implement (e.g. GSSAPI auth method). XXX We have a slight hack to recognize the Windows 2000 Vendor ID. Need to clarify with the Microsoft IPsec guys. In Aggressive Mode, as responder, when sending first response, make sure to include a Vendor ID payload. In Main Mode, as responder, when sending first response, make sure to include a Vendor ID payload. XXX Still more Vendor ID processing fixes to go. And GSSAPI auth doesn't interoperate with Windows 2000 yet. Thu Mar 22 08:06:30 JST 2001 sakane@ydc.co.jp * racoon: fixed to parse modp1536 of DH group. reported by <shigeru@iij.ad.jp> Thu Mar 22 04:56:57 JST 2001 sakane@ydc.co.jp * racoon/policy.c: fixed to compare between policies when the responder decides to accept the proposal or not. the upper layer protocol is represented by 0 in ID payload. Thu Mar 22 01:45:32 JST 2001 sakane@ydc.co.jp * racoon: fixed potencial of a buffer overrun when adding a ID payload to the ISAKMP payload. It happened when policy is both to use IPSec transport mode and not to specify a transport protocol. reported by <cs@purdue.edu>. Thu Mar 15 20:39:03 JST 2001 sakane@ydc.co.jp * racoon: - fixed a phase 2 handler deletion. racoon will delete a phase2 handler immediately when hard lifetime expires. - check a unit of the timer in the configuration file. 2001-03-06 Jason R. Thorpe <thorpej@zembu.com> * kame/racoon/schedule.c: Implement sched_scrub_param(), which kills all scheduler work queue entries which a specified parameter. * kame/racoon/handler.c: Use sched_scrub_param() to make sure no references to a handler exist when it is freed. 2001-03-05 Jason R. Thorpe <thorpej@zembu.com> * kame/racoon/gssapi.c: Use GSS_C_MECH_CODE when reporting GSSAPI errors. 2001-03-05 Jason R. Thorpe <thorpej@zembu.com> * kame/racoon/handler.c: Implement deleteallph2(), which deletes all Phase 2 handlers for a given src/dst/proto. * kame/racoon/isakmp_inf.c: When processing INITIAL-CONTACT, try to use the SADB_DELETE `delete all' extension and deleteallph2() before doing it The Hard Way. For both The Easy Way and The Hard Way, make sure we only delete SAD entries for SATYPEs that we manage. * kame/racoon/pfkey.c: Use a table of SATYPEs that we manage, and use that table to initialize our PF_KEY state. Thu Feb 22 10:08:27 JST 2001 sakane@ydc.co.jp * racoon: fixed to check the outbound policy when the responder received the 1st packet in phase 2. the tunnel mode and the transport specified the pair of IP addresses of the end of the SA had failed.
2001-04-17+ move the distfile digest/checksum value from files/md5 to distinfoagc3-9/+7
+ move the patch digest/checksum values from files/patch-sum to distinfo
2001-02-25Cleanup MKDIR usage => INSTALL_*_DIRhubertf1-3/+3
XXX need to teach pkglint to be more picky about this
2001-02-22update to 2001/2/22 snapshot.itojun2-4/+4
sync up with majority interpretation on tunnel mode bundle proposal. lots of IKE implementation proposes "IP AH ESP IP payload" as "AH tunnel and ESP tunnel". couple of other minor fixes
2001-02-18upgrade: 20001211a -> 20010215aitojun4-18/+5
key changes: -B flag, DH shared secret length handling fix, logging level fix, gssapi support (not enabled, may not work on plain 1.5 due to issue in kerberos library)
2001-02-17Update to new COMMENT style: COMMENT var in Makefile instead of pkg/COMMENT.wiz2-2/+2
2001-01-11Fix typo.dent1-2/+2
2001-01-08typo. freebsd PR 24127itojun1-1/+1
2000-12-12remove bogus bound-check. need revisit (DoS issue is not re-introduced).itojun2-1/+14
sync with kame
2000-12-11upgrade to the latest (2000/12/11). most important change is that prioritojun2-4/+4
versions had DoS possiblity, due to insufficient length check.
2000-11-11upgrade to 11/11a. better support for multiple address on a single IF,itojun2-4/+4
and IPv6 address properties (deprecated, tentative).
2000-11-06upgrade to 20001106a.itojun4-24/+5
- validate initial contact better. - more fine-grained control over pre-shared key configuration. - cert fixes.
2000-11-06do not return negative value from internal random() function.itojun2-1/+20
from shigeru@iij.ad.jp. sync with KAME.
2000-10-21add RCS Idwiz1-0/+1
2000-10-10aupdate to 2000/10/10a.itojun2-14/+8
- always use random number from /dev/urandom, instead of random(3). - OpenSSL dependency is simplified - just use USE_SSL, and assume that RSA function is there. pkgsrc does not really support intermediate netbsd-current codebase. per discussion on packages@netbsd.org. approved by packages@netbsd.org
2000-10-04upgrade to 10/4 snapshot.itojun5-70/+11
- disable idea/rc5 in phase 1 by default - use official DOI # for AES (= rijndael) - be more careful about parsing variable-length packet content - have __attribute__((__packed__)), be friendly with align-picky arch (confirmed to be working on i386, sh3 and alpha)
2000-09-24disable admin port better (KAME session.c 1.13 -> 1.14)itojun2-1/+55
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-14 03:42:38 +0000