Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

225 lines (186 sloc) 9.759 kb
CHANGELOG for KAME kit
$Id: CHANGELOG,v 1.422 2000/01/09 01:34:34 itojun Exp $
<200001>
Sun Jan 9 10:32:59 JST 2000 sakane@kame.net
massive clarification to racoon ISAKMP daemon.
- Merged Eric Lemiere's code for limited certificate support.
- There are two management hander.
"Phase 1 handler" is to manage ISAKMP SA. It is created when
phase 1 exchange on both initiator and responder side will be
started.
"Phase 2 handler" is to manage IPsec SAs. It is created when
pfkey acquire message will be received, and when 1st message
in phase 2 will be received on responder side.
- Vendor id will be sent after negotiating hasn algorithm.
When we receive vendor id before negotiating it, we use default hash
algorithm MD5 to check.
- Post command deleted.
- msgid_t delted.
- don't release management handler. do it only if retry will be
timed up.
- separate the function of isakmp exchange. one is to check received
data. other is to reply. the reason is for handling to resend.
- change name "dir" to "side" in order to distinguish from policy
direction.
- If initiator request PFS, but responder is not ready to do that,
responder stops the negotiation. If initiator don't request PFS,
but responder require it, also responder stops the negotiation.
Sun Jan 9 03:03:39 2000 SUMIKAWA Munechika <sumikawa@ebina.hitachi.co.jp>
* freebsd3/ports/heimdal: upgrade to 0.2l.
* freebsd3/usr.sbin/inetd: support IDENT.
Sat Jan 8 23:53:23 JST 2000 sakane@ydc.co.jp
* kame/sys/netkey/key.c:
- fix kenrel crash when flushing SAD.
- for stability, increment refcnt of SA when key_getsavbyspi() called.
- add some error message
- fix errno at key_update().
Sat Jan 8 04:40:33 JST 2000 itojun@iijlab.net
* kame/sys/netinet/{frag6,ip6_input,nd6_nbr}.c:
use arc4random() on openbsd. it should give better random value
for initializing sequence numbers.
From: deraadt@openbsd.org
Sat Jan 8 03:20:05 JST 2000 itojun@iijlab.net
* /sys/netinet/udp_usrreq.c, kame/sys/netinet6/udp6_usrreq.c:
drop incoming udp packet with dst port = 0. it is, or seems to be,
illegal based on RFC768 (99% sure but 1% in doubt).
with traditional 4.4BSD code, udp socket will mistakingly accept
such packets after socket() and before first bind()/connect().
this can be used to confuse, or de-synchronize, udp-based protocols.
Sat Jan 8 00:37:28 2000 Shin'ichi Fujisawa <fujisawa@kame.net>
* kame/sys/netinet6/natpt*.[ch]: NAT-PT translator.
* kame/kame/{natptconfig,natptd,natptlog}: translator configulation
command and natpt related commands.
- These NAT-PT translator and commands are now under development.
It's user interface and overall functionality are subjects to
future improvements and changes. So, please be careful when you
try it.
- At this time, this translator works on FreeBSD228 only. Please
wait a while to works on other platforms.
Sat Jan 8 00:09:44 2000 SUMIKAWA Munechika <sumikawa@ebina.hitachi.co.jp>
* freebsd3/ports/openssh: upgrade to current source of OpenBSD,
which support IPv6 in default. Any additional patches does not
neccesary anymore.
2000-01-07 JINMEI, Tatuya <jinmei@isl.rdc.toshiba.co.jp>
* kame/sys/netinet6/ip6_output.c (ip6_output): do not insert a
dest options header (even if specified by a user) that should be
placed before a routing header, unless a routing header really
exists.
2000-01-07 JINMEI, Tatuya <jinmei@isl.rdc.toshiba.co.jp>
* kame/kame/rtsold: use raw ip6 socket for probing interface
status instead of a separate UDP socket, in order to avoid
receiving unexpected UDP datagrams.
In response to: kit/187
2000-01-06 JINMEI, Tatuya <jinmei@isl.rdc.toshiba.co.jp>
* kame/sys/netinet6/icmp6.c (icmp6_input): upper layer detection
in notifying an icmp6 error was improved:
- if the erroneous packet contains a routing header, examine the
header to determine the final destination and use it to update
path MTU.
- if the erroneous packet contains a fragment header, stop
chasing the header chain unless it is the first fragment.
With the former fix the kernel will perform path MTU discovery
correctly even if triggered packets contain a routing header.
* A new function icmp6_mtudisc_update() was added to cleanup the
code.
Thu Jan 6 16:43:52 JST 2000 itojun@iijlab.net
* sys/netkey/key.c: when searching IPsec SA for inbound IPsec traffic,
do not check src match according to RFC2401. it looks that IPsec
specs do not really agree with each other about what should be
in IPsec SA, and what should be matched. see comment lines near
key_allocsa().
Thu Jan 6 13:49:43 JST 2000 itojun@iijlab.net
* sys/netinet6/ip6_input.c: add missing case for net.inet6.ip6.rr_prune
for openbsd and netbsd.
* netbsd/pkgsrc/net/zebra, freebsd[23]/ports/zebra: upgrade to 0.83a.
Thu Jan 6 01:40:50 JST 2000 itojun@iijlab.net
* sys/netinet6/icmp6.c: avoid panic on getsockopt(ICMPV6_FILTER).
From: shigeya@foretune.co.jp
* {openbsd,bsdi4}/sys/netinet6/raw_ipv6.c: clarify rip6_ctloutput().
Wed Jan 5 19:44:12 JST 2000 itojun@iijlab.net
* netbsd/usr.bin/systat, openbsd/usr.bin/systat:
make systat IPv6 ready. "netstat" subcommand is changed for this.
Wed Jan 5 13:27:43 JST 2000 itojun@iijlab.net
* kame/libinet6/getnameinfo.c: allow reverse lookup for v4 loopback
network (127.0.0.0/8).
* kame/libinet6/rcmd.c: implement iruserok_sa(). iruserok_af() does
not make sense as it is not scope-aware.
nuke ruserok_af(), as ruserok() takes string hostname and is af
independent already. we don't really need ruserok_af().
iruserok_af() is kept for backward compatibility. we'll nuke it
afterwards.
Wed Jan 5 02:49:05 JST 2000 itojun@iijlab.net
* netbsd: add net.inet6.ip6.bindv6only sysctl. this is a replacement
of net.inet6.ip6.mapped_addr, which was bitwise opposite to
IPV6_BINDV6ONLY.
if set to 1: AF_INET6 listening socket will grab IPv6 traffic only.
if set to 0: AF_INET6 listening socket will grab IPv4 traffic as well,
as if it was from v4 mapped address (described in rfc1933).
default value is 1 (i.e. AF_INET6 socket grabs IPv6 traffic only).
the variable controls inbound direction only; you can always use
v4 mapped address for outgoing connections.
"options INET6_BINDV6ONLY" will remove the code completely and
hardcodes behavior to net.inet6.ip6.bindv6only=1 case.
"options MAPPED_ADDR_ENABLED" and net.inet6.ip6.mapped_addr were
obsoleted on netbsd (were introduced on Dec 21 1999).
2000-01-05 JINMEI, Tatuya <jinmei@isl.rdc.toshiba.co.jp>
* kame/kame/{bgpd, pim6[ds]d, ping6, traceroute6}: were modified
to use rfc2292bis by default. Related Makefiles were also
modified.
2000-01-04 JINMEI, Tatuya <jinmei@isl.rdc.toshiba.co.jp>
* kame/kame/libinet6/{ip6opt.c, rthdr.c}: implemented some new
functions introduced in rfc2292bis (see TODO.2292bis for more
details).
All the new functions except rcmd_af and rexec_af are now
available.
2000-01-04 JINMEI, Tatuya <jinmei@isl.rdc.toshiba.co.jp>
* kame/sys/netinet6/{various files}: implemented the new advanced
API (rfc2292bis). The kernel part is now almost finished (see
TODO.2292bis for more details).
Note about lower compatibility: I believe the new kernel is
fairly compatible with the old API (i.e. RFC2292).
There are few compatibility issues in interfaces using ancillary
data. I believe the compatibility issues won't practically bother
you.
You don't have to care compatibility when setting a socket option
except IPV6_HOPLIMIT. If you use the option but don't want to
migrate to the new API, you have two choices. One is to use
IPV6_RECVHOPLIMIT instead of IPV6_HOPLIMIT and just keep the other
code. The other is to define COMPAT_RFC2292 in your kernel
configuration file and recompile the kernel. Then the kernel will
handle IPV6_HOPLIMIT in the RFC2292 manner.
Unfortunately, it is impossible to ensure compatibility for
getting socket options whose semantics in the new API is different
than in RFC2292. If you don't want to use the new API but want to
do getsockopt for such options (I believe the possibility is very
rare, though) define COMPAT_RFC2292 in your kernel configuration
file and recompile the kernel. Then the kernel will handle the
options in the RFC2292 manner.
Please note that the new API is enabled by default in any case.
Tue Jan 4 18:59:08 JST 2000 sakane@ydc.co.jp
* kame/sys/netkey:
don't check sequence number at key_update() even if SA initiator.
don't change sequence number passed from userland at key_getspi()
instead of the value of sequence number.
They can be re-enable to define IPSEC_DOSEQCHECK.
Sun Jan 2 22:59:45 JST 2000 itojun@iijlab.net
* kame/libinet6/name6.c: don't bark even if we see T_SIG and other
record types.
KAME PR: 184
From: Assar Westerlund <assar@sics.se>
Sun Jan 2 22:07:54 JST 2000 itojun@iijlab.net
* kame/tcpdump/isakmp.h, kame/racoon/isakmp.h:
avoid use of bitfield on packet format definition. it is
non-portable.
* kame/Makefile.inc: added it to share definitions across top-level
Makefile and platform Makefile (like netbsd/Makefile).
NOTE: if you use anoncvs, you may need to checkout Makefile.inc
manually.
Sun Jan 2 03:46:57 JST 2000 itojun@iijlab.net
* sys/netinet6/icmp6.[ch]: add net.inet6.icmp6.nodeinfo sysctl MIB,
which enables/disables node information query processing in the
kernel.
Sat Jan 1 03:02:02 JST 2000 itojun@iijlab.net
* netbsd/usr.bin/ftp: fix "ftp URL" behavior. it failed if the
specified URL is in certain condition due to bug in IPv6 support.
Sat Jan 1 JST 2000
* happy Y2K from KAME team!
Jump to Line
Something went wrong with that request. Please try again.