summaryrefslogtreecommitdiff
path: root/keyexchange/isakmpd-20041012/debian
diff options
context:
space:
mode:
Diffstat (limited to 'keyexchange/isakmpd-20041012/debian')
-rw-r--r--keyexchange/isakmpd-20041012/debian/ChangeLog1668
-rw-r--r--keyexchange/isakmpd-20041012/debian/README.Debian17
-rw-r--r--keyexchange/isakmpd-20041012/debian/changelog153
-rw-r--r--keyexchange/isakmpd-20041012/debian/control17
-rw-r--r--keyexchange/isakmpd-20041012/debian/copyright21
-rw-r--r--keyexchange/isakmpd-20041012/debian/isakmpd.dirs13
-rw-r--r--keyexchange/isakmpd-20041012/debian/isakmpd.init32
-rw-r--r--keyexchange/isakmpd-20041012/debian/isakmpd.lintian3
-rwxr-xr-xkeyexchange/isakmpd-20041012/debian/rules73
9 files changed, 1997 insertions, 0 deletions
diff --git a/keyexchange/isakmpd-20041012/debian/ChangeLog b/keyexchange/isakmpd-20041012/debian/ChangeLog
new file mode 100644
index 0000000..bae602d
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/ChangeLog
@@ -0,0 +1,1668 @@
+End of changelog debian package isakmpd.20041012-1
+--------------------------------------------------
+
+2004-10-08 17:18 hshoexer
+
+ * sysdep/common/libsysdep/arc4random.c: pull in some changes from
+ libc arc4random (only relevant for non-OpenBSD systems): ansify,
+ discard first 256 output bytes, make key schedule more arc4
+ stream ciper like.
+
+ ok djm ho
+
+2004-10-01 06:08 jsg
+
+ * monitor_fdpass.c: add some missing $, ok djm@ 'That looks fine to
+ me' millert@
+
+2004-09-24 15:31 ho
+
+ * udp_encap.c: Don't process NAT-T keepalives. Noted by Kamel
+ Messaoudi. hshoexer@ ok
+
+2004-09-20 23:36 hshoexer
+
+ * virtual.c: compile cleanly with -Wsign-compare ok ho
+
+2004-09-20 23:35 hshoexer
+
+ * monitor_fdpass.c: Remove __func__ ok ho deraadt
+
+2004-09-17 16:54 hshoexer
+
+ * isakmpd.c: avoid signal race.
+
+ ok ho@ otto@
+
+2004-09-17 15:53 ho
+
+ * exchange.c, ike_quick_mode.c, ipsec.c, key.c, pf_key_v2.c:
+ Missing #ifdefs.
+
+2004-09-17 15:46 ho
+
+ * init.c: #include <stdlib.h> for srandom().
+
+2004-09-17 15:45 ho
+
+ * message.c: Permit next payload type NAT-OA. Noted by Kamel
+ Messaoudi.
+
+2004-08-23 13:53 ho
+
+ * exchange.c: We need to set sa->initiator before checking if the
+ newly created SA replaces an old one, or the id_i/id_r check will
+ mismatch. Previous behaviour was mostly harmless, but wasted some
+ resources (until normal SA expiration). hshoexer@ "haven't tried,
+ but think it's ok"
+
+2004-08-23 13:16 ho
+
+ * Makefile: Default enable DPD (Dead Peer Detection) support.
+ hshoexer@ ok
+
+2004-08-23 13:13 ho
+
+ * exchange.h: Indent nit.
+
+2004-08-17 16:48 hshoexer
+
+ * message.c: check for msg->isakmpg_sa being NULL before
+ referencing ok ho@
+
+2004-08-14 15:29 hshoexer
+
+ * ike_quick_mode.c: When using -K (keynote disabled), check peers'
+ proposal against isakmpd.conf.
+
+ ok ho@ henning@
+
+2004-08-13 04:51 djm
+
+ * monitor_fdpass.c: extra check for no message case; ok markus,
+ deraadt, hshoexer, henning
+
+2004-08-12 13:21 hshoexer
+
+ * monitor.c: Fix compiler warning on alpha. Noted by and ok ho@
+
+2004-08-12 13:08 ho
+
+ * pf_key_v2.c: Avoid memleak on error (Linux/KAME). Found by
+ Benjamin Pineau.
+
+2004-08-10 21:21 deraadt
+
+ * virtual.c, x509.c: spacing
+
+2004-08-10 17:59 ho
+
+ * dpd.c, dpd.h, exchange.c, ipsec.c, isakmp_num.cst,
+ isakmpd.conf.5, message.c, message.h, pf_key_v2.c, pf_key_v2.h,
+ sa.c, sa.h, sysdep.h, udp_encap.c, sysdep/bsdi/sysdep.c,
+ sysdep/darwin/sysdep.c, sysdep/freebsd/sysdep.c,
+ sysdep/freeswan/sysdep.c, sysdep/linux/sysdep.c,
+ sysdep/netbsd/sysdep.c, sysdep/openbsd/sysdep.c: Better
+ implementation of the Dead Peer Detection protocol, RFC 3706.
+ hshoexer@ ok.
+
+2004-08-10 11:49 ho
+
+ * sysdep/linux/GNUmakefile.sysdep: Linux has AES (and DES). From
+ Benjamin Pineau.
+
+2004-08-10 11:47 ho
+
+ * sysdep/common/libsysdep/arc4random.c: If opening /dev/arandom
+ fails, try /dev/random. Suggested by Benjamin Pineau.
+
+2004-08-08 21:11 deraadt
+
+ * GNUmakefile, conf.c, dpd.c, exchange.c, ike_auth.c,
+ ike_phase_1.c, ike_quick_mode.c, ipsec.c, isakmp_cfg.c, log.c,
+ message.c, monitor.c, nat_traversal.c, pf_key_v2.c, policy.c,
+ sa.c, sysdep.h, transport.c, udp.c, udp_encap.c, ui.c, util.c,
+ virtual.c, x509.c: spacing
+
+2004-08-03 12:54 ho
+
+ * nat_traversal.c, transport.c, udp.c, udp.h, udp_encap.c,
+ virtual.c: Rewrite the transport reference count code to avoid
+ leaks. hshoexer@ ok.
+
+2004-08-02 17:48 hshoexer
+
+ * sa.c: Do not expire unestablished phase 2 SAs on SIGHUP.
+
+ ok ho@
+
+2004-08-02 17:30 ho
+
+ * GNUmakefile: Missed to add virtual.c here. Noted by Benjamin
+ Pineau.
+
+2004-07-30 12:45 ho
+
+ * Makefile, sysdep.h, util.c: Style.
+
+2004-07-29 22:02 ho
+
+ * conf.c: Less noise while debugging.
+
+2004-07-29 10:54 ho
+
+ * ike_aggressive.c, ike_phase_1.c, nat_traversal.c: Repair NAT-T
+ using Aggressive mode, NAT-D checks were in the wrong place.
+ Noted by Yvan VANHULLEBUS.
+
+2004-07-09 18:06 deraadt
+
+ * doi.c, exchange.c: ansi
+
+2004-07-08 21:53 hshoexer
+
+ * virtual.c: free() and close() in error path.
+
+ ok ho@
+
+2004-07-08 12:37 jmc
+
+ * isakmpd.8, isakmpd.conf.5: typo, and line adjustment;
+
+2004-07-08 00:25 hshoexer
+
+ * isakmpd.8, isakmpd.conf.5: document -a/-K and
+ "Acquire-Only"/"Use-Keynote".
+
+ ok markus@ henning@ ho@ english polish and mdoc help and ok jmc@
+
+2004-07-07 11:16 hshoexer
+
+ * message.c: plug memleak when receiving an
+ INVALID_HASH_INFORMATION notify. Found by Patrick Latifi,
+ thanks!
+
+ ok ho@
+
+2004-07-07 11:13 hshoexer
+
+ * udp_encap.c: compile cleanly with -Wsign-compare; while around,
+ kill a space
+
+ ok ho@
+
+2004-07-05 19:33 pvalchev
+
+ * ike_phase_1.c: %lu and cast to unsigned long to print a size_t;
+ ok ho
+
+2004-06-30 12:07 hshoexer
+
+ * nat_traversal.c: Compile cleanly with gcc3.3.2.
+
+ ok ho@
+
+2004-06-26 13:32 jmc
+
+ * isakmpd.conf.5: new sentence, new line;
+
+2004-06-26 08:07 hshoexer
+
+ * monitor.c, monitor.h, pf_key_v2.c, pf_key_v2.h,
+ sysdep/openbsd/sysdep.c: Narrow down privsep interface. Move
+ pf_key_v2_open() to monitor.
+
+ Work in progress.
+
+ ok ho@
+
+2004-06-26 05:40 mcbride
+
+ * sysdep/: bsdi/Makefile.sysdep, darwin/GNUmakefile.sysdep,
+ darwin/Makefile.sysdep, freebsd/GNUmakefile.sysdep,
+ freebsd/Makefile.sysdep, linux/GNUmakefile.sysdep,
+ netbsd/GNUmakefile.sysdep, netbsd/Makefile.sysdep,
+ openbsd/GNUmakefile.sysdep, openbsd/Makefile.sysdep: Remove
+ -DHAVE_GETNAMEINFO frome makefiles.
+
+ Pointed out by ho@
+
+2004-06-25 22:25 hshoexer
+
+ * conf.c, conf.h, ike_quick_mode.c, isakmpd.c, policy.c, policy.h:
+ Keynote policy checking can now be disabled by "-K" switch and
+ config tag "Use-Keynote". Default is to use keynote.
+
+ ok henning@ ho@
+
+2004-06-25 21:42 mcbride
+
+ * udp.c, util.c: Remove HAVE_GETNAMEINFO alternate code. Compiled
+ binary is unchanged.
+
+ ok msf@ hshoexer@ itojun@ ho@
+
+2004-06-25 02:58 hshoexer
+
+ * init.c, log.c, monitor.c, monitor.h, ui.c: Narrow down privsep
+ interface. Remove ui_init to monitor. So we can get rid of
+ monitor_mkfifo.
+
+ Work in progress.
+
+ ok ho@
+
+2004-06-24 19:02 hshoexer
+
+ * monitor.c: Remove some unused code. Fix handling of sigchild.
+ Now it's possible to sigstop/sigcont isakmpd correclty.
+
+ ok ho@
+
+2004-06-24 17:58 hshoexer
+
+ * policy.c: Also handle keys from x509-certificates embedded in
+ keynote credentials.
+
+ with msf@ ok ho@
+
+2004-06-24 01:36 ho
+
+ * pf_key_v2.c: Print corrent prefix. Found and tested by alex at
+ vbone.net.
+
+2004-06-23 05:01 hshoexer
+
+ * ike_auth.c, util.c, util.h: Avoid stat before open. Do open and
+ fstat instead. Remove check_file_secrecy() as it is obsoleted be
+ check_file_secrecy_fd().
+
+ ok ho@
+
+2004-06-23 03:17 ho
+
+ * Makefile, sysdep.h, util.c: Make compiling with Boehm's gc
+ possible again.
+
+2004-06-23 02:56 ho
+
+ * ike_phase_1.c: Support IPV{4,6}_ADDR_SUBNET IDs in Phase 1, just
+ like the man page says we do. Noted and tested by alex at
+ vbone.net. Also avoid a potential SEGV here. hshoexer@ok
+
+2004-06-23 02:55 hshoexer
+
+ * ipsec.c, isakmpd.c: Add commandline switch -a / config tag
+ "Acquire-Only" to tell isakmpd to not touch flows.
+
+ initial work by markus ok markus@ ho@ henning@
+
+2004-06-22 20:22 hshoexer
+
+ * ike_auth.c: kn_get_string() may return NULL on failure. Handle
+ this corrctly.
+
+ with msf@, ok ho@ markus@
+
+2004-06-22 05:44 ho
+
+ * virtual.c: The NAT-T drafts suggest we should drop incoming
+ messages arriving on the old port (500) after we've switched to
+ the new one.
+
+2004-06-22 01:42 ho
+
+ * isakmpd.conf.5: Describe the [Default]:NAT-T-Keepalive
+ configuration parameter.
+
+2004-06-22 01:28 ho
+
+ * Makefile: Enable NAT-T support.
+
+2004-06-22 01:27 ho
+
+ * ipsec.c, nat_traversal.c, nat_traversal.h, sa.c, sa.h,
+ udp_encap.c: Implement NAT-T keepalive messages.
+
+2004-06-21 20:41 ho
+
+ * pf_key_v2.c: udpencap_port should be taken from dst transport
+
+2004-06-21 20:40 ho
+
+ * virtual.c: When switching from main to encap transport, copy dst
+ port if translated (NAT).
+
+2004-06-21 20:34 ho
+
+ * monitor.c: Strip away umask bits in monitor_fopen(). hshoexer@
+ ok.
+
+2004-06-21 20:29 ho
+
+ * ipsec.c: style nit
+
+2004-06-21 19:02 markus
+
+ * features/nat_traversal: undo double-patch; Dries Schellekens
+
+2004-06-21 18:37 ho
+
+ * log.c: Don't write too much IKE data in packet capture
+
+2004-06-21 18:01 ho
+
+ * log.c, message.c: Packet capture should add the ESP-marker when
+ NAT-T is active.
+
+2004-06-21 17:15 ho
+
+ * pf_key_v2.c: Tell the kernel to enable ESP-in-UDP encapsulation
+ when we have SAs negotiated with NAT-T.
+
+2004-06-21 15:09 ho
+
+ * exchange.c, sa.h, transport.c, udp.c, udp_encap.c, virtual.c:
+ Port floating (500->4500) for p1 and p2 exchanges.
+
+2004-06-20 19:44 ho
+
+ * message.c: message_parse_payloads should accept payloads in the
+ private range. While here, also cleanup some messages.
+
+2004-06-20 19:17 ho
+
+ * dpd.c, exchange.c, ike_auth.c, ike_phase_1.c, ike_quick_mode.c,
+ init.c, ipsec.c, isakmp_cfg.c, isakmp_doi.c, message.c,
+ message.h, nat_traversal.c: Make the payload array in struct
+ message dynamic, since we need to handle payloads in the private
+ range, such as the pre-RFC NAT-D/NAT-OA. Replace
+ TAILQ_FIRST(&msg->payload[i]) instances with function calls.
+
+2004-06-20 17:24 ho
+
+ * Makefile, exchange.h, ike_phase_1.c, init.c, ipsec.c, isakmp.h,
+ isakmp_fld.fld, message.c, nat_traversal.c, nat_traversal.h,
+ policy.c, transport.c, transport.h, udp.c, udp.h, udp_encap.c,
+ udp_encap.h, util.c, util.h, virtual.c, virtual.h,
+ features/nat_traversal: NAT-Traversal for isakmpd. Work in
+ progress... hshoexer@ ok.
+
+2004-06-20 17:20 ho
+
+ * dpd.c, dpd.h, exchange.c, isakmp_num.cst, sa.h, features/dpd: A
+ start towards Dead Peer Detection (DPD) support, as specified in
+ RFC 3706
+
+2004-06-20 17:11 ho
+
+ * message.c: Some vendors send the last Aggressive Mode message
+ unencrypted, which we should accept. Problem noted by alex at
+ vbone.net. hshoexer@ ok.
+
+2004-06-20 17:03 ho
+
+ * isakmpd.c, monitor.c, monitor.h: To make debugging the
+ unprivileged child process easier, make 'isakmpd -dd' pause just
+ after privsep; print the PIDs and wait for SIGCONT. hshoexer@ ok
+
+2004-06-17 21:39 hshoexer
+
+ * ipsec.c: Yet another bunch of memleask found and fixed by Patrick
+ Latifi. Thanks!
+
+ ok ho@
+
+2004-06-17 21:36 hshoexer
+
+ * udp.c: Plug a memleak. Found and fixed (and some cleanup) by
+ Patrick Latifi. Thanks!
+
+ ok ho@
+
+2004-06-17 21:32 hshoexer
+
+ * x509.c: Evaluate result of X509_verify_cert() more carefully.
+
+ ok cloder@
+
+2004-06-16 17:08 hshoexer
+
+ * util.c: Fix wrong pointer dereference and plug memleak. Found
+ and patch by Patrick Latifi. Thanks!
+
+ ok ho@
+
+2004-06-16 17:05 hshoexer
+
+ * ipsec.c: fix ipv6-address and ipv6-address-mask mixup. Found by
+ Patrick Latifi. Thanks!
+
+ ok ho@
+
+2004-06-15 17:53 hshoexer
+
+ * ike_quick_mode.c, isakmp_cfg.c: also use MSG_AUTHENTICATED flag.
+
+ ok ho@
+
+2004-06-14 15:53 hshoexer
+
+ * conf.c, ike_auth.c, x509.c: avoid stat before open
+
+ ok ho@
+
+2004-06-14 12:04 hshoexer
+
+ * message.c: added a missing message_free().
+
+ ok ho@
+
+2004-06-14 11:55 ho
+
+ * cert.c, conf.c, connection.c, crypto.c, dnssec.c, exchange.c,
+ field.c, hash.c, if.c, ike_auth.c, ike_main_mode.c,
+ ike_phase_1.c, ike_quick_mode.c, ipsec.c, isakmp_cfg.c,
+ isakmp_doi.c, isakmpd.c, key.c, log.c, math_2n.c, math_group.c,
+ message.c, monitor.c, pf_key_v2.c, policy.c, timer.c,
+ transport.c, udp.c, util.c, x509.c: KNF, style, 80c, etc.
+ hshoexer@ ok
+
+2004-06-11 12:17 brad
+
+ * message.c: typo in comment
+
+2004-06-11 05:08 brad
+
+ * ike_phase_1.c, ike_quick_mode.c, ipsec.c, message.c, message.h:
+ MFC: Fix by hshoexer@
+
+ Mark authenticated messages explicitly. Better check for
+ authentication before deleteing SAs.
+
+ This fix is needed to solve the problems reported by Thomas
+ Walpuski, previous diff was not sufficient. Pointed out by
+ Thomas. Thanks!
+
+2004-06-11 04:34 brad
+
+ * ike_phase_1.c, ike_quick_mode.c, ipsec.c, message.c, message.h:
+ MFC: Fix by hshoexer@
+
+ Mark authenticated messages explicitly. Better check for
+ authentication before deleteing SAs.
+
+ This fix is needed to solve the problems reported by Thomas
+ Walpuski, previous diff was not sufficient. Pointed out by
+ Thomas. Thanks!
+
+2004-06-10 14:54 hshoexer
+
+ * ike_phase_1.c, ike_quick_mode.c, ipsec.c, message.c, message.h:
+ Mark authenticated messages explicitly. Better check for
+ authentication before deleteing SAs.
+
+ This fix is needed to solve the problems reported by Thomas
+ Walpuski, previous diff was not sufficient. Pointed out by
+ Thomas. Thanks!
+
+ ok ho@ niklas@, testing and spellcheck by todd@ msf@
+
+2004-06-09 23:15 brad
+
+ * message.c: MFC: Fix by hshoexer@
+
+ only accept DELETEs during an authenticated INFORMATIONAL
+ exchange. Fix for recent problem disclosed by Thomas Walpuski.
+
+2004-06-09 22:48 brad
+
+ * message.c: MFC: Fix by hshoexer@
+
+ only accept DELETEs during an authenticated INFORMATIONAL
+ exchange. Fix for recent problem disclosed by Thomas Walpuski.
+
+2004-06-09 16:02 ho
+
+ * conf.c, exchange.c, ike_phase_1.c, ike_quick_mode.c, ipsec.c,
+ isakmp_cfg.c, message.c, pf_key_v2.c, transport.c, udp.c: Style
+ nits. hshoexer@ ok
+
+2004-06-09 14:59 hshoexer
+
+ * message.c: only accept DELETEs during an authenticated
+ INFORMATIONAL exchange. Fix for recent problem disclosed by
+ Thomas Walpuski.
+
+ ok ho@
+
+2004-06-06 15:05 ho
+
+ * ike_phase_1.c: Style (KNF, 80c). No binary change.
+
+2004-06-02 18:19 hshoexer
+
+ * ike_auth.c, x509.c: remove unused BIO-functions.
+
+ ok markus@ ho@
+
+2004-05-27 00:17 hshoexer
+
+ * ike_auth.c: do not leak fd on error path.
+
+ ok ho@
+
+2004-05-24 16:54 hshoexer
+
+ * util.c: Use correct function names in log messages. Kill some
+ spaces.
+
+ ok deraadt@ ho@
+
+2004-05-23 20:17 hshoexer
+
+ * field.c, field.h, hash.c, if.c, ike_aggressive.c,
+ ike_aggressive.h, ike_auth.c, ike_main_mode.c, ike_main_mode.h,
+ ipsec.c, ipsec.h, isakmp_cfg.c, isakmp_cfg.h, isakmp_doi.c,
+ isakmpd.c, key.c, log.c, log.h, math_2n.c, math_ec2n.c,
+ math_ec2n.h, math_group.c, message.c, message.h, monitor.c,
+ monitor_fdpass.c, pf_key_v2.h, policy.c, prf.c, sa.c, sa.h,
+ timer.c, timer.h, udp.c, ui.c, util.c, x509.c, x509.h: More KNF.
+ Mainly spaces and line-wraps, no binary change.
+
+ ok ho@
+
+2004-05-23 18:14 deraadt
+
+ * if.c, udp.c: remove excessive monitor_ prefixes
+
+2004-05-23 18:14 deraadt
+
+ * policy.c, util.c, util.h: stat before open is flawed
+
+2004-05-23 18:13 deraadt
+
+ * key.c: greater care with arguments
+
+2004-05-19 16:30 ho
+
+ * ipsec.c, isakmpd.c: Permit symbolic protocol and service names,
+ such as "Protocol= tcp", in the <IPsec-ID> sections. hshoexer@ ok
+
+2004-05-14 10:42 hshoexer
+
+ * attribute.c, attribute.h, cert.c, cert.h, conf.c, conf.h,
+ connection.c, cookie.c, cookie.h, crypto.c, crypto.h, dh.h,
+ dnssec.c, dnssec.h, doi.c, doi.h: Some more KNF, no binary
+ change.
+
+ ok ho@
+
+2004-05-13 08:56 ho
+
+ * connection.c, isakmpd.8, sa.c, sa.h, ui.c, ui.h: Extensions to
+ the FIFO interface: "C get [section]:tag" fetches a configuration
+ value. "C add [section]:tag=value" adds 'value' to a list,
+ typically for the [Phase 2]:Connections tag. FIFO "S" command
+ destination file changed. Various KNF cleanups. hshoexer@ ok.
+
+2004-05-10 20:34 deraadt
+
+ * monitor.c: 64bit gcc saw missing cast
+
+2004-05-06 12:40 ho
+
+ * exchange.c: KNF cleanup. hshoexer@ ok
+
+2004-05-03 23:23 hshoexer
+
+ * exchange.c, exchange.h: KNF. ok ho@
+
+2004-04-30 00:36 hshoexer
+
+ * message.c: Better checking of minimum payload lengths. Drop out
+ safely when an unknown payload type is encountered. While
+ around, do some KNF.
+
+ ok ho@
+
+2004-04-28 22:20 hshoexer
+
+ * ike_quick_mode.c, policy.c, policy.h: remove unused variable and
+ shorten names of two other. Removed some spaces while around.
+
+ ok ho@ markus@
+
+2004-04-28 16:40 ho
+
+ * ipsec_num.cst, isakmp_num.cst: Reserve some payload numbers for
+ RFC 3547 and the earlier NAT-T drafts. hshoexer@ ok.
+
+2004-04-23 16:15 ho
+
+ * conf.c, conf.h: Make sure KEY_LENGTH attribute is present when
+ checking AES proposals, required when acting as responder to
+ SafeNet peers. Also make conf_load_defaults() readable again
+ (KNF). hshoexer@ ok.
+
+2004-04-15 22:20 deraadt
+
+ * conf.c: more knf; ok hshoexer
+
+2004-04-15 20:53 deraadt
+
+ * conf.c: knf
+
+2004-04-15 20:39 deraadt
+
+ * app.c, app.h, attribute.c, attribute.h, cert.c, cert.h, conf.c,
+ conf.h, connection.c, connection.h, constants.c, constants.h,
+ cookie.c, cookie.h, crypto.c, crypto.h, dh.c, dh.h, dnssec.c,
+ dnssec.h, doi.c, doi.h, exchange.h, field.c, field.h,
+ genconstants.sh, genfields.sh, gmp_util.c, gmp_util.h, hash.c,
+ hash.h, if.c, if.h, ike_aggressive.c, ike_aggressive.h,
+ ike_auth.c, ike_auth.h, ike_main_mode.c, ike_main_mode.h,
+ ike_phase_1.c, ike_phase_1.h, ike_quick_mode.c, ike_quick_mode.h,
+ init.c, init.h, ipsec.c, ipsec.h, ipsec_doi.h, isakmp.h,
+ isakmp_cfg.c, isakmp_cfg.h, isakmp_doi.c, isakmp_doi.h,
+ isakmpd.c, key.c, key.h, libcrypto.c, libcrypto.h, log.c, log.h,
+ math_2n.c, math_2n.h, math_ec2n.c, math_ec2n.h, math_group.c,
+ math_group.h, math_mp.h, message.c, message.h, monitor.c,
+ monitor.h, monitor_fdpass.c, pf_key_v2.c, pf_key_v2.h, policy.c,
+ policy.h, prf.c, prf.h, sa.c, sa.h, sysdep.h, timer.c, timer.h,
+ transport.c, transport.h, udp.c, udp.h, ui.c, ui.h, util.c,
+ util.h, x509.c, x509.h, sysdep/openbsd/keynote_compat.c,
+ sysdep/openbsd/sysdep.c: partial move to KNF. More to come.
+ This has happened because there are a raft of source code
+ auditors who are willing to help improve this code only if this
+ is done, and hey, isakmpd does need our standard auditing
+ process. ok ho hshoexer
+
+2004-04-15 02:27 deraadt
+
+ * isakmpd.8: spaces
+
+2004-04-13 23:48 hshoexer
+
+ * if.c: Add missing #include. Found by Stefan Paletta.
+
+ ok henning@ ho@
+
+2004-04-08 18:08 henning
+
+ * sysdep/linux/sys/queue.h: swap the last two parameters to
+ TAILQ_FOREACH_REVERSE. matches what FreeBSD and NetBSD do. ok
+ millert@ mcbride@ markus@ ho@, checked to not affect ports by
+ naddy@
+
+2004-04-08 12:05 hshoexer
+
+ * init.c, isakmpd.c: Set timezone before privsep, child uses now
+ correct timezone. Noticed by david@
+
+ ok ho@ david@
+
+2004-04-08 00:45 ho
+
+ * conf.h, exchange.h, ike_auth.c, ike_phase_1.c, ike_quick_mode.c,
+ ipsec.c, log.c, math_2n.c, math_group.c, math_group.h, message.c,
+ monitor.c, pf_key_v2.c, policy.c, sa.c, udp.c, ui.c, util.c,
+ x509.c, regress/crypto/cryptotest.c: -Wsign-compare nits.
+ hshoexer@ ok.
+
+2004-04-08 00:45 ho
+
+ * key.c: Reset *data in case of unknown key types
+
+2004-04-08 00:43 ho
+
+ * Makefile: -Wmissing-declarations
+
+2004-04-07 22:04 ho
+
+ * sa.c: More careful when walking LIST queues. hshoexer@, david@
+ ok.
+
+2004-03-31 12:54 ho
+
+ * cert.c, crypto.c, exchange.c, hash.c, ike_auth.c: -Wsign-compare
+ nits. hshoexer@ ok.
+
+2004-03-31 12:53 ho
+
+ * monitor.c: Use sysdep_sa_len() instead of sa->sa_len, also
+ correct a log_fatal() message. hshoexer@ ok.
+
+2004-03-31 12:47 ho
+
+ * isakmpd.c, sysdep/openbsd/Makefile.sysdep: Don't assume
+ closefrom(2) exists everywhere. hshoexer@, markus@ ok.
+
+2004-03-29 19:07 deraadt
+
+ * monitor.c: use malloc (oops)
+
+2004-03-29 18:32 deraadt
+
+ * monitor.c: wrong FD_ZERO(); from ho, hshoexer, markus
+
+2004-03-29 18:32 deraadt
+
+ * udp.c: memory mishandling; from ho
+
+2004-03-24 17:44 hshoexer
+
+ * isakmpd.8: Add some notes about privsep to manpage.
+
+ ok ho@ jmc@ deraadt@
+
+2004-03-23 19:20 hshoexer
+
+ * monitor.c: Remove erroneous null termination.
+
+ ok ho@ deraadt@
+
+2004-03-19 15:04 hshoexer
+
+ * Makefile, conf.c, conf.h, if.c, ike_auth.c, isakmpd.c, log.c,
+ monitor.c, monitor.h, policy.c, sa.c, udp.c, ui.c, x509.c: Add
+ missing bits to make already present privsep code work. Enable
+ privsep.
+
+ ok ho@ deraadt@ markus@
+
+2004-03-17 16:05 brad
+
+ * doi.h, ike_quick_mode.c, ipsec.c, isakmp_cfg.c, isakmp_doi.c,
+ message.c, util.h: MFC: Fix by hshoexer@
+
+ Fix payload handling flaws found by cloder@. Based on initial
+ patch by cloder@.
+
+ ok deraadt@ hshoexer@
+
+2004-03-17 15:59 brad
+
+ * doi.h, ike_quick_mode.c, ipsec.c, isakmp_cfg.c, isakmp_doi.c,
+ message.c, util.h: MFC: Fix by hshoexer@
+
+ Fix payload handling flaws found by cloder@. Based on initial
+ patch by cloder@.
+
+ ok deraadt@ hshoexer@
+
+2004-03-17 12:10 ho
+
+ * ike_auth.c: For consistency and to avoid a rare memory leak, the
+ result from ike_auth_get_key() should always be released after
+ use. Found and ok hshoexer@.
+
+2004-03-15 17:34 hshoexer
+
+ * monitor.c: Properly check succes of chroot().
+
+ ok ho@
+
+2004-03-15 17:29 hshoexer
+
+ * monitor.c, monitor.h: Remove unused code.
+
+ ok ho@
+
+2004-03-11 17:56 hshoexer
+
+ * isakmp_cfg.c: Fix a memleak.
+
+ ok ho@
+
+2004-03-11 00:08 hshoexer
+
+ * doi.h, ipsec.c, isakmp_doi.c, message.c, util.h: Fix payload
+ handling flaws found by cloder@. Based on initial patch by
+ cloder@. Testing by markus@ cloder@ hshoexer@.
+
+ ok ho@
+
+2004-03-10 17:10 hshoexer
+
+ * message.c: Plug up memory leak.
+
+ ok ho@
+
+2004-03-10 12:17 hshoexer
+
+ * message.c: Reduce some noise on receipt of an invalid spi.
+
+ ok ho@
+
+2004-03-10 10:28 ho
+
+ * pf_key_v2.c: Fix for PR2429, from Clemens Wittinger.
+
+2004-03-09 22:42 hshoexer
+
+ * message.c: Plug memleaks, found by cloder@.
+
+ ok ho@
+
+2004-02-27 20:14 hshoexer
+
+ * ipsec.c: Remove dead code.
+
+ ok ho@
+
+2004-02-27 20:07 hshoexer
+
+ * conf.c, isakmpd.conf.5: Add group 14 (modp2048) to predefined
+ suites. Manpage also updated. ok ho@
+
+2004-02-27 11:16 ho
+
+ * ike_phase_1.c, ike_quick_mode.c, sa.c, sa.h: (C)-2004
+
+2004-02-27 10:01 ho
+
+ * ike_phase_1.c, ike_quick_mode.c, sa.c, sa.h: Follow RFC 2408 more
+ closely regarding how to better check the proposal returned by
+ the other peer (the responder). Some implementations (notably the
+ Cisco PIX) does not follow a SHOULD in section 4.2 of the RFC.
+ With certain proposal combinations this caused us to setup the
+ wrong SA resulting in us being unable to process incoming IPsec
+ traffic (over this tunnel).
+
+ Tested against a number of different IKE implementations.
+ hshoexer@ ok.
+
+2004-02-26 16:27 hshoexer
+
+ * regress/rsakeygen/rsakeygen.c: remove unused code. noticed by
+ ho@ ok ho@
+
+2004-02-26 06:52 jmc
+
+ * isakmpd.conf.5: tweak; ok hshoexer@
+
+2004-02-25 17:01 hshoexer
+
+ * init.c, isakmpd.conf.5, log.c, log.h, regress/b2n/Makefile,
+ regress/crypto/Makefile, regress/crypto/cryptotest.c,
+ regress/dh/Makefile, regress/ec2n/Makefile,
+ regress/group/Makefile, regress/prf/Makefile,
+ regress/rsakeygen/Makefile, regress/rsakeygen/rsakeygen.c,
+ regress/util/Makefile: Add and document configuration options
+ Logverbose and Loglevel. As log.c now depends on conf.c and some
+ regression tests use log.c, add conf.c to Makefiles where
+ necessary.
+
+ ok ho@
+
+2004-02-20 12:31 hshoexer
+
+ * ike_quick_mode.c: More small adjustments of log messages.
+
+2004-02-20 10:46 hshoexer
+
+ * ike_quick_mode.c: Fix some double free errors. While around,
+ adjust a log message. ok ho@
+
+2004-02-19 16:35 hshoexer
+
+ * isakmpd.c: small cleanup of log messages. ok ho@
+
+2004-02-19 10:54 ho
+
+ * isakmpd.c, log.c, log.h: With -d, SIGINT should do a clean
+ shutdown. Without -d, logs should be sent to syslog, level
+ LOG_INFO.
+
+2004-02-19 10:46 ho
+
+ * isakmpd.c: Cleanup.
+
+2004-02-16 21:40 markus
+
+ * exchange.c: check for isakmp_sa->transport != NULL; noticed by
+ bluhm at genua.de ok hshoexer@
+
+2004-02-11 09:55 jmc
+
+ * samples/VPN-3way-template.conf: typo; from Olivier Cherrier;
+
+2004-02-05 12:01 hshoexer
+
+ * exchange.c: small logging cleanup and improvement requested by
+ markus ok ho@ markus@
+
+2004-01-26 15:56 niklas
+
+ * regress/exchange/run.pl: Added 2-clause license
+
+2004-01-24 00:08 jmc
+
+ * isakmpd.8: `Ns' implies `No', so `Ns No' -> `Ns'; (even simpler
+ in adduser(8)) discussed with todd@
+
+2004-01-16 11:51 hshoexer
+
+ * exchange.c, ike_quick_mode.c, isakmpd.8, isakmpd.c, log.c, log.h:
+ Added -v option. Enables logging of successful exchange
+ completion. ok ho@
+
+2004-01-16 01:00 brad
+
+ * exchange.c, ipsec.c, message.c: Fixes a few message handling
+ flaws in isakmpd as reported by Thomas Walpuski.
+
+ ok deraadt@ hshoexer@
+
+2004-01-13 23:50 brad
+
+ * crypto.c, crypto.h, exchange.c, ipsec.c, message.c: Fixes a few
+ message handling flaws in isakmpd as reported by Thomas Walpuski.
+
+ ok deraadt@ hshoexer@
+
+2004-01-09 11:03 hshoexer
+
+ * regress/exchange/run.sh: call nc correctly (nc has changed a
+ while ago). ok markus@
+
+2004-01-06 01:22 hshoexer
+
+ * conf.c, sa.c: small typos fixed.
+
+ ok markus@
+
+2004-01-06 01:09 hshoexer
+
+ * x509.c: Remove redundant test for file types. Noted by Stefan
+ Paletta. While around, fix typos in log messages.
+
+ Both ok markus@
+
+2004-01-03 17:38 ho
+
+ * ipsec.c: Be more careful with INITIAL-CONTACT and do not delete
+ SPIs when getting an INVALID-SPI notification. Issues noted by
+ Thomas Walpuski. markus@ ok.
+
+2003-12-22 19:13 markus
+
+ * crypto.h: use AES_BLOCK_SIZE only for USE_AES; report
+ martti.kuparinen@iki.fi; ok ho@
+
+2003-12-18 03:03 ho
+
+ * transport.c: Mention the exchange name when giving up on a
+ message. Suggested by Michael Coulter.
+
+2003-12-15 11:06 hshoexer
+
+ * ipsec.c, ipsec_num.cst, math_group.c, math_group.h: Support for
+ groups modp2048, modp3072, modp4096, modp6144 and modp8192 (IDs
+ 14 to 18).
+
+ ok ho@
+
+2003-12-14 15:50 ho
+
+ * log.c, util.c, util.h: Log the actual port for src and dst, don't
+ assume it's always 500.
+
+2003-12-14 15:34 ho
+
+ * sysdep/linux/sysdep.c: Make isakmpd work on big endian linux
+ machines. From Sebastian Klemke. Also, a few style nits and a
+ better error message text.
+
+2003-12-05 14:17 ho
+
+ * message.c: Style nits
+
+2003-12-04 23:44 hshoexer
+
+ * message.c: Validate SPIs presented in DELETE messages of the
+ informational exchange. ok markus@
+
+2003-12-04 22:13 miod
+
+ * ike_phase_1.c, isakmp_cfg.c: Typos
+
+2003-11-20 12:23 jmc
+
+ * isakmpd.8: use .Dv for AF_INET and AF_INET6 (kills ugly line
+ break); spotted by Alexey E. Suslikov;
+
+ also kill some .Pp's before displays/lists for better PostScript
+ output;
+
+2003-11-08 20:17 jmc
+
+ * init.c: typos from Jonathon Gray;
+
+2003-11-07 11:16 jmc
+
+ * x509.c, samples/VPN-3way-template.conf: adress -> address, and a
+ few more; all from Jonathon Gray;
+
+ (mvme68k/mvme88k) vs.c and (vax) if_le.c ok miod@ isakmpd ones ok
+ ho@
+End of changelog debian package isakmpd.20031107-1
+--------------------------------------------------
+
+2003-11-06 17:12 ho
+
+ * dnssec.c, exchange.c, field.c, if.c, ike_auth.c, ipsec.c, key.c,
+ log.c, message.c, message.h, monitor_fdpass.c, pf_key_v2.c,
+ policy.c, ui.c, x509.c, x509.h: Style nits.
+
+2003-11-06 16:55 ho
+
+ * exchange.c, message.c: Require encrypted messages are soon as we
+ have the keystate for it. Require DELETE payloads to be
+ accompanied by HASHes, and add validation for HASH payloads
+ without active exchanges. From Hans-Joerg Hoexer with various
+ modifications and suggestions from me and markus@. Ok markus@.
+
+2003-11-06 16:50 ho
+
+ * ipsec.c: spis[] type tweak. From Hans-Joerg Hoexer.
+
+2003-11-05 13:55 jmc
+
+ * isakmpd.conf.5: PFS: Perfect Forward Secrecy (RFC 2409); from
+ misc@ and ok markus@
+
+2003-11-05 13:31 jmc
+
+ * QUESTIONS: updated URL from Jared Yanovich;
+
+2003-10-25 22:47 mcbride
+
+ * isakmpd.policy.5: OpenSSL generates DNs with emailAddress, not
+ Email.
+
+2003-10-25 09:47 jmc
+
+ * isakmpd.8: receiveing -> receiving; from Jared Yanovich;
+
+2003-10-14 16:29 ho
+
+ * exchange.c, ike_auth.c, ike_phase_1.c, ipsec.c, isakmp_doi.c:
+ constant_lookup() to constant_name() cleanup. markus@ ok.
+
+2003-10-13 15:57 ho
+
+ * isakmpd.8, log.h, ui.c: Add a UI FIFO debug class. ok markus@
+ plus I think henning@
+
+2003-10-04 19:29 cloder
+
+ * ike_phase_1.c: Avoid crash on invalid config file (missing value
+ for LIFE_DURATION). OK ho@
+
+2003-09-26 17:59 aaron
+
+ * sysdep/freeswan/klips.c: Fix off-by-ones in format string for 's'
+ specifier; millert@, deraadt@ ok
+
+2003-09-26 13:29 cedric
+
+ * udp.c: don't listen to INADDR_ANY if Listen-on is specified.
+ patch from markus@, ok ho@
+
+2003-09-26 00:28 aaron
+
+ * monitor.c: Fix off-by-one out-of-bounds write; millert@ ok
+
+2003-09-25 16:15 cloder
+
+ * exchange.c, if.c: Fix one case of set length before realloc. Fix
+ another case of foo = realloc(foo...) and avoid possible memory
+ leaks. Avoid leaving things pointing to freed memory on failure.
+
+2003-09-24 13:12 markus
+
+ * crypto.c, crypto.h, regress/crypto/cryptotest.c: re-add AES, but
+ without using EVP; patch from Hans-Joerg.Hoexer at
+ yerbouti.franken.de; ok ho@ (interops with isakmpd+AES in OpenBSD
+ 3.4)
+
+2003-09-24 12:13 markus
+
+ * crypto.c, crypto.h, regress/crypto/cryptotest.c: back out EVP
+ change; causes fd leaks; ok cedric@
+
+End of changelog debian package isakmpd.20030907-1
+--------------------------------------------------
+
+2003-09-05 09:50 tedu
+
+ * monitor.c: socket leak on error paths. from Patrick Latifi. ok
+ deraadt@ ho@
+
+2003-09-02 20:15 ho
+
+ * conf.c, ipsec.c: A couple of nits. deraadt@ ok.
+
+2003-09-02 20:14 ho
+
+ * message.c: Require ISAKMP_FLAGS_ENC on phase 2 messages. ok
+ markus@, deraadt@.
+
+2003-09-02 20:11 ho
+
+ * sysdep/linux/: bitstring.h, sys/queue.h: For easier compilation
+ on linux systems. Requested by Thomas Walpuski.
+
+2003-08-28 16:43 markus
+
+ * Makefile, TO-DO, conf.c, crypto.c, crypto.h, isakmpd.conf.5,
+ regress/crypto/Makefile, regress/crypto/cryptotest.c: support AES
+ in phase 1, too. switch to OpenSSL EVP interface; with
+ Hans-Joerg.Hoexer at yerbouti.franken.de; ok ho@
+
+2003-08-20 16:43 ho
+
+ * samples/singlehost-west.conf: Zap an old "Identification" tag in
+ this sample config. I have no idea what it was supposed to do and
+ in any case there is no reference to this tag in current code.
+ Pointed out by Fridtjof Busse.
+
+2003-08-20 14:25 ho
+
+ * isakmpd.8: certpatch(8) can be used to create FQDN X509v3
+ extensions too. From Fridtjof Busse, via henning@. Thanks.
+
+
+End of changelog debian package isakmpd.20030820-1
+--------------------------------------------------
+
+2003-07-09 10:16 jmc
+
+ * isakmpd.conf.5, isakmpd.policy.5: - remove some .Ss's that worked
+ around the old blank line bug - remove some unnecessary .Pp's -
+ mdoc a list
+
+ ok ho@
+
+2003-06-20 11:14 ho
+
+ * transport.c: Be a bit more verbose when we give up on ever seeing
+ a response to the last message we sent out. In case we initiated
+ the exchange, one possible and common reason is a network level
+ problem (pf, routing, whatnot), if we're the responder, there is
+ also the possibility we were scanned by something like ike-scan.
+ markus@ ok.
+
+2003-06-17 23:56 millert
+
+ * sysdep/common/libsysdep/: strlcat.c, strlcpy.c: Sync with
+ share/misc/license.template and add missing DARPA credit where
+ applicable.
+
+2003-06-15 12:32 ho
+
+ * exchange.c: ID copying should happen earlier in exchange_finalize
+ so that we won't lose data during rekeying. From Jean-Francois
+ Dive.
+
+2003-06-14 13:47 ho
+
+ * message.c: allocate payload_node with calloc instead of malloc
+
+2003-06-13 05:50 brad
+
+ * ipsec.c: MFC: Fix from ho@
+
+ Do not crash on unsupported IPSec ID types, as noted by Eric
+ Boudrand.
+
+ deraadt@ millert@ ok
+
+2003-06-13 05:34 brad
+
+ * ipsec.c: MFC: Fix from ho@
+
+ Do not crash on unsupported IPSec ID types, as noted by Eric
+ Boudrand.
+
+ deraadt@ millert@ ok
+
+2003-06-10 18:41 deraadt
+
+ * conf.c, exchange.c, ike_auth.c, ike_phase_1.c, ike_quick_mode.c,
+ isakmp_cfg.c, log.c, monitor.c, monitor.h, pf_key_v2.c, policy.c,
+ transport.c, udp.c, x509.c: boring cleanups
+
+2003-06-10 14:21 ho
+
+ * ipsec.c: Do not crash on unsupported IPSec ID types, as noted by
+ Eric Boudrand.
+
+2003-06-04 09:31 ho
+
+ * exchange.c, ike_aggressive.c, ike_auth.c, ike_phase_1.c,
+ ike_quick_mode.c, init.c, ipsec.c, ipsec.h, isakmpd.8, isakmpd.c,
+ isakmpd.policy.5, libcrypto.c, libcrypto.h, message.c, message.h,
+ pf_key_v2.c, policy.c, policy.h, sa.c, sa.h, udp.c, x509.c,
+ x509.h, apps/certpatch/certpatch.8, apps/certpatch/certpatch.c,
+ regress/ec2n/ec2ntest.c, regress/hmac/hmactest.c: Remove the rest
+ of clauses 3 and 4. Approved by Niklas Hallqvist, Angelos D.
+ Keromytis and Niels Provos.
+
+2003-06-04 09:27 ho
+
+ * DESIGN-NOTES: Remove 3 and 4 from the "license to use"
+
+2003-06-03 17:20 ho
+
+ * sysdep/linux/: GNUmakefile.sysdep, sysdep-os.h, sysdep.c: Remove
+ clause 3. Approved by niklas@ and Thomas Walpuski.
+
+2003-06-03 17:02 ho
+
+ * sysdep/linux/README: Obsolete.
+
+2003-06-03 16:53 ho
+
+ * sysdep/: bsdi/GNUmakefile.sysdep, bsdi/Makefile.sysdep,
+ bsdi/sysdep-os.h, bsdi/sysdep.c, darwin/GNUmakefile.sysdep,
+ darwin/Makefile.sysdep, darwin/sysdep-os.h, darwin/sysdep.c,
+ freebsd/GNUmakefile.sysdep, freebsd/Makefile.sysdep,
+ freebsd/sysdep-os.h, freebsd/sysdep.c,
+ freeswan/GNUmakefile.sysdep, freeswan/Makefile.sysdep,
+ freeswan/klips.c, freeswan/klips.h, freeswan/sysdep-os.h,
+ freeswan/sysdep.c, netbsd/GNUmakefile.sysdep,
+ netbsd/Makefile.sysdep, netbsd/sysdep-os.h, netbsd/sysdep.c,
+ openbsd/GNUmakefile.sysdep, openbsd/Makefile.sysdep,
+ openbsd/keynote_compat.c, openbsd/sysdep-os.h, openbsd/sysdep.c:
+ Remove clauses 3 and 4. Approved by markus@ and niklas@.
+
+2003-06-03 16:52 ho
+
+ * sysdep/common/: blf.h, libsysdep/GNUmakefile, libsysdep/Makefile,
+ libsysdep/blowfish.c: Remove clauses 3 and 4. Approved by Niklas
+ Hallqvist and Niels Provos.
+
+2003-06-03 16:39 ho
+
+ * regress/Makefile, regress/check.sh, regress/b2n/b2ntest.c,
+ regress/crypto/cryptotest.c, regress/dh/dhtest.c,
+ regress/exchange/Makefile, regress/exchange/run.sh,
+ samples/Makefile, regress/group/grouptest.c,
+ regress/prf/prftest.c, regress/rsakeygen/Makefile,
+ regress/rsakeygen/rsakeygen.c, regress/util/utiltest.c,
+ regress/x509/Makefile, regress/x509/x509test.c: Remove clauses 3
+ and 4. Approved by Niklas Hallqvist and Niels Provos.
+
+2003-06-03 16:35 ho
+
+ * apps/: Makefile, certpatch/Makefile: Remove clauses 3 and 4.
+ Approved by Niklas Hallqvist and Niels Provos.
+
+2003-06-03 16:34 ho
+
+ * apps/keyconv/: Makefile, keyconv.8, keyconv.c, keyvalues.h:
+ Remove clause 3.
+
+2003-06-03 16:29 ho
+
+ * features/: aggressive, dnssec, ec, isakmp_cfg, policy, privsep,
+ x509: Remove clause 3. Approved by niklas@
+
+2003-06-03 16:28 ho
+
+ * GNUmakefile, Makefile, app.c, app.h, attribute.c, attribute.h,
+ cert.c, cert.h, conf.c, conf.h, connection.c, connection.h,
+ constants.c, constants.h, cookie.c, cookie.h, crypto.c, crypto.h,
+ dh.c, dh.h, dnssec.c, dnssec.h, doi.c, doi.h, exchange.h,
+ exchange_num.cst, field.c, field.h, genconstants.sh,
+ genfields.sh, gmp_util.c, gmp_util.h, hash.c, hash.h, if.c, if.h,
+ ike_aggressive.h, ike_auth.c, ike_auth.h, ike_main_mode.c,
+ ike_main_mode.h, ike_phase_1.h, ike_quick_mode.h, init.c, init.h,
+ ipsec_doi.h, ipsec_fld.fld, ipsec_num.cst, isakmp.h,
+ isakmp_cfg.c, isakmp_cfg.h, isakmp_doi.c, isakmp_doi.h,
+ isakmp_fld.fld, isakmp_num.cst, isakmpd.conf.5, log.c, log.h,
+ math_2n.c, math_2n.h, math_ec2n.c, math_ec2n.h, math_group.c,
+ math_group.h, math_mp.h, monitor.c, monitor.h, pf_key_v2.h,
+ prf.c, prf.h, sysdep.h, timer.c, timer.h, transport.c,
+ transport.h, udp.h, ui.c, ui.h, util.c, util.h: Remove clauses 3
+ and 4. With approval from Niklas Hallqvist and Niels Provos.
+
+2003-06-03 15:16 jmc
+
+ * isakmpd.8, isakmpd.conf.5, isakmpd.policy.5: - section reorder -
+ some mdoc fixes
+
+2003-06-03 14:51 ho
+
+ * conf.c, constants.c, dnssec.c, exchange.c, ike_auth.c,
+ ike_phase_1.c, ike_quick_mode.c, ipsec.c, log.c, message.c,
+ policy.c, sa.c, udp.c, x509.c: Cleanup. Use 'sizeof variable'
+ instead of magic constants.
+
+2003-06-03 03:52 millert
+
+ * sysdep/common/libsysdep/: strlcat.c, strlcpy.c: Use an ISC-tyle
+ license for all my code; it is simpler and more permissive.
+
+2003-06-02 22:06 millert
+
+ * sysdep/freeswan/sys/queue.h: Remove the advertising clause in the
+ UCB license which Berkeley rescinded 22 July 1999. Proofed by
+ myself and Theo.
+
+2003-05-18 23:26 ho
+
+ * monitor.c: Add some path sanitation; only permit write operations
+ to /tmp, /var/tmp and /var/run. Opens in /etc/isakmpd/ are
+ read-only. Any other path is invalid. markus@ ok.
+
+2003-05-18 22:46 ho
+
+ * init.c: Style tweak.
+
+2003-05-18 22:39 ho
+
+ * sa.c: Add a debug message to sa_reinit() to indicate when we
+ renegotiate active connections.
+
+2003-05-18 22:09 ho
+
+ * monitor_fdpass.c: Forgot to remove a couple of debug messages
+
+2003-05-18 22:06 ho
+
+ * udp.c: struct sockaddr is not large enough in itself to contain
+ the address value. Switching to sockaddr_storage makes interface
+ rescanning work properly. niklas@ ok.
+
+2003-05-18 21:37 ho
+
+ * conf.c, ike_auth.c, isakmpd.c, log.c, monitor.c, monitor.h,
+ monitor_fdpass.c, pf_key_v2.c, policy.c: More isakmpd privsep
+ work. X509 private keys are now kept in the privileged process
+ only. Various cleanup and bugfixes. markus@ ok
+
+2003-05-18 20:16 ho
+
+ * GNUmakefile, pf_key_v2.c, udp.c, sysdep/linux/GNUmakefile.sysdep,
+ sysdep/linux/sysdep-os.h, sysdep/linux/sysdep.c: Sysdep for
+ native Linux IPSec, 2.5 and later. From Thomas Walpuski, with
+ various tweaks by me. niklas@ ok.
+
+2003-05-17 19:39 ho
+
+ * monitor.h, monitor_fdpass.c: Better return codes from mm_send_fd
+ and mm_receive_fd
+
+2003-05-17 19:32 ho
+
+ * monitor_fdpass.c: Use log_error(), not log_fatal(). Style.
+
+2003-05-17 19:26 jmc
+
+ * isakmpd.conf.5: tweak; ok ho@
+
+2003-05-16 22:31 ho
+
+ * init.c, isakmpd.conf.5, sa.c, sa.h: If the "Renegotiate-on-HUP"
+ tag is defined in the [General] section, a HUP signal (or "R" to
+ the FIFO) will also renegotiate all Phase 2 SAs, i.e all
+ connections. ok niklas@, tested and ok kjell@.
+
+2003-05-15 05:20 ho
+
+ * ike_auth.c: Correct a two year old typo, which might actually
+ make setsockopt(..., IP_IPSEC_LOCAL_AUTH, ...) start working.
+
+2003-05-15 04:28 ho
+
+ * exchange.c, ike_auth.c, sa.c, sa.h: Cleanup. Do not store the
+ private key in either the exchange or sa structs.
+
+2003-05-15 04:08 ho
+
+ * ike_auth.c: Work around some OpenSSL BIO "features" to read the
+ key correctly.
+
+2003-05-15 04:04 ho
+
+ * monitor.c: Proper exit of the monitor process.
+
+2003-05-15 03:51 ho
+
+ * monitor.c: wait() for the child process
+
+2003-05-15 02:28 ho
+
+ * Makefile, conf.c, conf.h, ike_auth.c, init.c, isakmpd.c, log.c,
+ monitor.c, monitor.h, monitor_fdpass.c, pf_key_v2.c, policy.c,
+ udp.c, ui.c, util.c, features/privsep, sysdep/openbsd/sysdep.c:
+ Start of privilege separation for isakmpd. There are some kinks
+ left, so keep it default disabled for now. markus@ says ok to
+ commit.
+
+2003-05-15 02:24 ho
+
+ * log.h: (c)
+
+2003-05-15 01:44 kjell
+
+ * pf_key_v2.c: properly terminate debug string (levels >=40) Use
+ "%.*s" as suggested by Niklas. ok ho@. Lost by kjell. oked ho@.
+ lost by kjell again. oked ho@
+
+2003-05-15 01:29 ho
+
+ * features/policy: Remove the .if/.endif stuff that gmake does not
+ understand. Replace with a comment about needing keynote for
+ policy.
+
+2003-05-14 22:49 ho
+
+ * GNUmakefile, Makefile, sysdep/freeswan/GNUmakefile.sysdep,
+ sysdep/freeswan/Makefile.sysdep, sysdep/freeswan/README,
+ sysdep/freeswan/klips.c, sysdep/freeswan/klips.h,
+ sysdep/freeswan/sysdep-os.h, sysdep/freeswan/sysdep.c,
+ sysdep/freeswan/sys/queue.h, sysdep/linux/GNUmakefile.sysdep,
+ sysdep/linux/Makefile.sysdep, sysdep/linux/README,
+ sysdep/linux/klips.c, sysdep/linux/klips.h,
+ sysdep/linux/sysdep-os.h, sysdep/linux/sysdep.c: Call the
+ FreeS/WAN sysdep 'freeswan'. The 'linux' sysdep will be native
+ Linux IPSec.
+
+2003-05-14 20:11 ho
+
+ * conf.c, conf.h, ike_auth.c: Default public key directory
+ definition sanity.
+
+2003-05-14 20:10 ho
+
+ * policy.c, policy.h: Policy file default defined twice, kill the
+ local copy.
+
+2003-05-14 20:08 ho
+
+ * isakmpd.c: Fix a typo (in unused code).
+
+2003-05-14 19:37 ho
+
+ * ipsec.c, ipsec_num.cst, pf_key_v2.c, policy.c, sa.c: I did not
+ test this enough. Unbreak.
+
+2003-05-12 23:48 ho
+
+ * isakmp_num.cst: Update with some data for NAT-T specific payload
+ types, IKEv2 notifications, ISAKMP EAP code and types, plus fix
+ an old typo.
+
+2003-05-12 23:43 ho
+
+ * ipsec.c, pf_key_v2.c, policy.c, sa.c: AES -> AES_128_CBC
+
+2003-05-12 23:42 ho
+
+ * ipsec_num.cst: Add two more encapsulation types (UDP encap,
+ potential future NAT-T) Add BLOCK_SIZE attribute Rename
+ IPSEC_ESP_AES -> IPSEC_ESP_AES_128_CBC.
+
+2003-05-12 01:17 ho
+
+ * genconstants.sh: Slight style fix for .cst files. Permit comments
+ also after a definition.
+
+2003-05-11 04:16 markus
+
+ * pf_key_v2.c: fix ID-type for ipv6; ok niklas; report fries
+
+2003-05-10 23:13 jmc
+
+ * isakmpd.8, isakmpd.conf.5: typos;
+
+2003-04-30 17:15 jason
+
+ * conf.c: cast size_t to unsigned long and use %lu;ok ho
+
+2003-04-27 13:17 ho
+
+ * isakmpd.8: Describe the 'C set' FIFO command better. (PR#3148,
+ also)
+
+2003-04-27 13:16 ho
+
+ * ui.c: Make the 'C set' FIFO command work as expected. PR#3148.
+
+2003-04-14 15:08 ho
+
+ * isakmpd.c: Unlink FIFO and pid files on clean shutdown. PR#3199
+
+2003-04-14 12:22 ho
+
+ * pf_key_v2.c: More snprintf style
+
+2003-04-14 12:14 ho
+
+ * pf_key_v2.c: A "%d" is 12 chars, not 10. Use sizeof num instead
+ of '10' in snprintf. From Theo.
+
+2003-04-09 17:46 ho
+
+ * x509.c: Less noise for missing crl dir, demoted to debug message.
+
+2003-03-21 16:13 markus
+
+ * isakmpd.conf.5: document [initiator-id] section;
+ richb@timestone.com.au; ok ho@, jmc@
+
+2003-03-20 20:39 margarida
+
+ * isakmp_cfg.c: Pull patch from current: Fix by ho@. Proper
+ id_string for SET/ACK responder, plus attr payload fixes.
+
+ ok millert@ markus@ ho@
+
+2003-03-16 09:13 matthieu
+
+ * samples/: VPN-east.conf, VPN-west.conf: secrity -> security. Ok
+ ho@
+
+2003-03-14 15:49 ho
+
+ * math_group.c, transport.c, sysdep/common/blf.h,
+ sysdep/common/libsysdep/blowfish.c: Spelling fixes from david@.
+ jmc@ ok.
+
+2003-03-13 14:24 ho
+
+ * ike_auth.c: Might as well do blinding here too.
+
+2003-03-13 11:31 ho
+
+ * util.c: Avoid "j += snprintf()". niklas@ ok.
+
+2003-03-06 21:29 jmc
+
+ * isakmpd.conf.5, isakmpd.policy.5: .Xr typos;
+
+ ok deraadt@
+
+2003-03-06 15:22 cedric
+
+ * util.c: fix text2sockaddr() when HAVE_GETNAMEINFO is false and
+ port is NULL. ok ho@
+
+2003-03-06 14:48 cedric
+
+ * field.c: "len" is decremented too early, so the second argument
+ of the snprintf call is too small on last run of the loop. ok
+ ho@
+
+2003-03-06 14:32 ho
+
+ * exchange.c: Bad cut'n'paste msg plus style fixes.
+
+2003-03-06 10:56 ho
+
+ * util.c: Less ambiguous l-value usage. Noted by cedric@
+
+2003-03-06 05:07 david
+
+ * apps/keyconv/keyconv.8: date should be written formally: .Dd
+ Month day, year ok henning@ jmc@
+
+2003-03-03 17:51 ho
+
+ * isakmpd.conf.5: Re-add the BUGS section; the RFCs still do not
+ permit differing DH groups in the same proposal. This time,
+ mention that this also applies to mixing PFS and non-PFS suites.
+
+2003-02-26 23:55 ho
+
+ * samples/VPN-west.conf: Typo/pasto. Spotted by Tim Donahue.
+
+2003-02-26 09:17 david
+
+ * exchange.c: IPsec is written ``IPsec'', not ``IPSec''. ok ho@
+
+2003-02-24 13:01 markus
+
+ * pf_key_v2.c: pf_key_v2_flow: typo in debug msg (KAME)
+
+2003-02-22 07:57 kjell
+
+ * README: typo: noneheless->nontheless
+
+2003-02-22 07:56 kjell
+
+ * isakmpd.8, isakmpd.conf.5: Clarify some language, grammar. ho@
+ okayed this many moons ago, and I forgot all about it.
+
+2003-02-12 16:11 markus
+
+ * if.c, if.h, udp.c: better error checking on bind(); from
+ Alexander_Bluhm at genua.de; ok ho@
+
+2003-02-05 11:29 jmc
+
+ * isakmpd.8: typos; isakmpd(8) ok niklas@, mailwrapper(8) help
+ kjell@
+
+2003-02-04 21:02 markus
+
+ * conf.c: don't set the Transform for Default-phase-1-configuration
+ twice, ok ho@
+
+2003-02-04 21:02 markus
+
+ * conf.h: default to 3DES-SHA-RSA_SIG (same as in OpenBSD 3.2); ok
+ ho@
+
+2003-01-22 16:13 ho
+
+ * ike_auth.c: Typo.
+
+2003-01-20 20:52 deraadt
+
+ * isakmpd.policy.5: typos; alan@alanday.com
diff --git a/keyexchange/isakmpd-20041012/debian/README.Debian b/keyexchange/isakmpd-20041012/debian/README.Debian
new file mode 100644
index 0000000..5ed5128
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/README.Debian
@@ -0,0 +1,17 @@
+State of the package / isakmpd port to linux
+--------------------------------------------
+The port is operational and is included in upstream, from various sources.
+
+
+Where to start
+--------------
+- isakmpd.conf man pages.
+- configuration examples.
+- openbsd isakmpd documentation.
+
+caution note
+------------
+- keynote is used to check for all policy components. For exemple, if acting
+ as initiator, isakmpd will send the isakmpd.conf configured proposals but
+ will only check the received proposal with the rules enforced in isakmpd.policy.
+
diff --git a/keyexchange/isakmpd-20041012/debian/changelog b/keyexchange/isakmpd-20041012/debian/changelog
new file mode 100644
index 0000000..1883efc
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/changelog
@@ -0,0 +1,153 @@
+isakmpd (20041012-4) unstable; urgency=high
+
+ * Fix replay protection (CVE-2006-4436)
+ Thanks to Stefan Fritsch <sf@fritsch.de> (Closes: #385894)
+
+ -- Jochen Friedrich <jochen@scram.de> Mon, 4 Sep 2006 18:41:00 +0200
+
+isakmpd (20041012-3) unstable; urgency=low
+
+ * Fix NAT-T RFC support.
+ * Remove superfluos header from packet dump so tcpdump and ethereal
+ can read the dump.
+
+ -- Jochen Friedrich <jochen@scram.de> Mon, 28 Aug 2006 17:14:47 +0200
+
+sakmpd (20041012-2) unstable; urgency=low
+
+ * New maintainer (Closes: #358800)
+ * Replace SADB_X_SPDADD by SADB_X_SPDUPDATE (Closes: #346214)
+ * Fix NAT-T (Closes: #324753)
+ * Fix openssl incompatibility with version 0.9.8b (Closes: #334624)
+ * Fix dependencies (Closes: #320393, #325849)
+ * gcc compiler fixes (Closes: #318241)
+ * Update standards version to 3.7.2
+
+ -- Jochen Friedrich <jochen@scram.de> Tue, 21 Feb 2006 14:26:40 +0100
+
+isakmpd (20041012-1) unstable; urgency=high
+
+ * new upstream cvs merge.
+ * add setsockopt to properly configure udp encap socket.
+ * add proper source port in nat-t sadb set (thanks to Thomas Walpuski).
+ * DPD now works (closes: #258479).
+ * NAT-T now works (closes: #269851).
+ * remove double dependency on libkeynote0 (closes: #272377).
+
+ -- Jean-Francois Dive <jef@debian.org> Tue, 7 Sep 2004 11:28:18 +0200
+
+isakmpd (20040628-1) unstable; urgency=high
+
+ * New upstream cvs merge.
+ * Enabled DPD.
+ * Enabled NAT-T + added support for linux nat-t pfkey msgs.
+ * Fix payload handling denial-of-service vuln (closes: #239739);
+ * Add spd cleartext entry (thanks to Vincent Bernat). (closes: #243990).
+ * Add dependency on linux-kernel-headers (closes: #238793).
+ * Add man page for isakmpd.policy.
+ * No issue with Renegotiate-on-HUP (closes: #255507).
+ * x509v3.cnf provided (closes: #238542).
+ * Added certpatch utility (closes: #231743).
+ * Fixed pcap support (closes: #238543).
+
+ -- Jean-Francois Dive <jef@debian.org> Mon, 5 Jul 2004 23:32:47 +0200
+
+isakmpd (20040204-1) unstable; urgency=low
+
+ * Provide ike-server (closes: #223784).
+ * Fixes for big indian systems (thanks to Sebastian Klemke).
+ (closes: #223845).
+ * Fix for certificates file access on non ext2 enabled kernel
+ systems, thanks to jochen. (closes: #225474).
+ * Update kernel version informations. (closes: #229795).
+ * New upstream cvs merge.
+ * Added missing man page isakmpd.policy(5) (thanks to Toni Mueller).
+ (closes: #231123).
+
+ -- Jean-Francois Dive <jef@debian.org> Sun, 8 Feb 2004 20:55:34 +0100
+
+isakmpd (20031107-2) unstable; urgency=high
+
+ * SECURITY fix for INITIAL_CONTACT handeling. (previous
+ release actually did fixed INVALID_SPI informational exchange
+ security issue). The problem is the exact same nature for both
+ type of informational messages: because the end result is SA
+ deletation, the HASH payload should be in the message and checked.
+
+ -- Jean-Francois Dive <jef@debian.org> Thu, 13 Nov 2003 14:54:01 +0100
+
+isakmpd (20031107-1) unstable; urgency=high
+
+ * new upstream cvs merge.
+ * SECURITY fix for HASH payload handeling (closes: #219864).
+ * SECURITY fix handeling of quick mode exchange encryption (it now
+ does require quick mode to be encrypted both Rx/Tx).
+ * SECURITY fix for INITIAL_CONTACT handeling (did not check for
+ mandatory HASH payload).
+ * Updated linux kernel header for interop with debian x86 kernels.
+ * Fix issues with policy handeling in keynote.
+
+ -- Jean-Francois Dive <jef@debian.org> Thu, 13 Nov 2003 11:05:09 +0100
+
+isakmpd (20030907-1) unstable; urgency=high
+
+ * new upstream cvs merge.
+ * Fixed kernel interface due to ABI changes in linux IPSec.
+ * Fixed keynote issue.
+
+ -- Jean-Francois Dive <jef@debian.org> Wed, 10 Sep 2003 22:47:17 +0200
+
+isakmpd (20030718-1) unstable; urgency=high
+
+ * New upstream version.
+ * Merged new upstream linux native build support.
+ * Added fine grained selector support to upstream linux native sysdep.
+ * Removed useless libc and kernel headers.
+ * Removed libdes.
+ * Added generated upstream changelog (generated by cvs2cl.pl).
+
+ -- Jean-Francois Dive <jef@debian.org> Tue, 22 Jul 2003 12:15:30 +0200
+
+isakmpd (20030119-2) unstable; urgency=low
+
+ * Fixed init script (closes: #188086).
+ * Added support for Protocol and Port text definition in ID handeling.
+ (expl: Protocol = icmp instead of Protocol = 1).
+
+ -- Jean-Francois Dive <jef@debian.org> Mon, 9 Jun 2003 14:11:02 +0200
+
+isakmpd (20030119-1) unstable; urgency=low
+
+ * Changed version number to a sane format.
+
+ -- Jean-Francois Dive <jef@debian.org> Thu, 20 Mar 2003 18:46:56 +0100
+
+isakmpd (19012003-4) unstable; urgency=low
+
+ * Fixed source tree clean issues (libdes, libsysdep) (closes: #184295).
+ * Added diff to package upload.
+
+ -- Jean-Francois Dive <jef@debian.org> Tue, 18 Mar 2003 17:30:57 +0100
+
+isakmpd (19012003-3) unstable; urgency=low
+
+ * switched libdes copyright from copyright.libdes to
+ copyright file.
+
+ -- Jean-Francois Dive <jef@debian.org> Thu, 20 Feb 2003 13:10:54 +1100
+
+isakmpd (19012003-2) unstable; urgency=low
+
+ * Added reference to BSD license and libdes license.
+ * Renmoved double dependency on libssl.
+ * Removed /usr/doc link.
+ * Added lintian overrides.
+
+ -- Jean-Francois Dive <jef@debian.org> Sun, 26 Jan 2003 00:36:40 +1100
+
+isakmpd (19012003-1) unstable; urgency=low
+
+ * Inital debianization (Closes: #163904).
+
+ -- Jean-Francois Dive <jef@debian.org> Sun, 26 Jan 2003 00:36:40 +1100
+
diff --git a/keyexchange/isakmpd-20041012/debian/control b/keyexchange/isakmpd-20041012/debian/control
new file mode 100644
index 0000000..ba34296
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/control
@@ -0,0 +1,17 @@
+Source: isakmpd
+Maintainer: Jochen Friedrich <jochen@scram.de>
+Priority: optional
+Section: net
+Standards-Version: 3.7.2
+Build-Depends: debhelper (>= 5), libkeynote-dev, libssl-dev, libgmp3-dev, libpcap-dev, linux-kernel-headers
+
+Package: isakmpd
+Priority: optional
+Section: net
+Architecture: any
+Provides: ike-server
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: The Internet Key Exchange protocol openbsd implementation
+ IKE is a protocol which allow to exchange security information between
+ to peers. This implementation requires the native linux ipsec support.
+
diff --git a/keyexchange/isakmpd-20041012/debian/copyright b/keyexchange/isakmpd-20041012/debian/copyright
new file mode 100644
index 0000000..f418b06
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/copyright
@@ -0,0 +1,21 @@
+This package have been packaged by Jean-Francois Dive <jef@debian.org> as
+isakmpd. The upstream source of isakmpd can be found at www.openbsd.org
+
+This package is now maintained by Jochen Friedrich <jochen@scram.de>
+
+- This package links against openssl.
+- This package include linux kernel include files for interface definition
+ purposes. This should mean that GPL does not apply for this distribution.
+- This package include libdes from the openbsd tree which have the same
+ license as openssl, please refer to the following license statement for details.
+
+This is isakmpd, a BSD-licensed ISAKMP/Oakley (a.k.a. IKE)
+implementation. It's written by Niklas Hallqvist and Niels Provos,
+funded by Ericsson Radio Systems AB. Isakmpd's home is in the
+OpenBSD main source tree under src/sbin/isakmpd. Look at
+http://www.openbsd.org/ for details on how to get OpenBSD source.
+
+The isakmpd license is the BSD license, please refer to
+/usr/share/common-license/BSD for details. The few code modification in isakmpd
+(linux support) are authored by Jean-Francois Dive and Jochen Friedrich
+and are release on the same license as isakmpd itself.
diff --git a/keyexchange/isakmpd-20041012/debian/isakmpd.dirs b/keyexchange/isakmpd-20041012/debian/isakmpd.dirs
new file mode 100644
index 0000000..de7adf9
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/isakmpd.dirs
@@ -0,0 +1,13 @@
+usr/sbin
+usr/bin
+etc/isakmpd
+etc/isakmpd/certs
+etc/isakmpd/crls
+etc/isakmpd/ca
+etc/isakmpd/pubkeys/ipv4
+etc/isakmpd/pubkeys/ipv6
+etc/isakmpd/pubkeys/fqdn
+etc/isakmpd/pubkeys/ufqdn
+etc/isakmpd/private
+usr/share/doc/isakmpd/samples
+usr/share/lintian/overrides
diff --git a/keyexchange/isakmpd-20041012/debian/isakmpd.init b/keyexchange/isakmpd-20041012/debian/isakmpd.init
new file mode 100644
index 0000000..57de3d4
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/isakmpd.init
@@ -0,0 +1,32 @@
+#!/bin/sh
+#
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+DAEMON=/usr/sbin/isakmpd
+PIDFILE=/var/run/isakmpd.pid
+
+test -f $DAEMON || exit 0
+
+case "$1" in
+ start)
+ echo -n "Starting OpenBSD isakmpd: "
+ start-stop-daemon --start --verbose --pidfile $PIDFILE --exec $DAEMON > /dev/null 2>&1
+ echo "done"
+ ;;
+ stop)
+ echo -n "Stopping OpenBSD isakmpd: "
+ start-stop-daemon --stop --verbose --pidfile $PIDFILE --exec $DAEMON > /dev/null 2>&1
+ echo "done"
+ ;;
+ restart|force-reload)
+ echo -n "Restarting OpenBSD isakmpd: "
+ start-stop-daemon --stop --verbose --pidfile $PIDFILE --exec $DAEMON > /dev/null 2>&1
+ start-stop-daemon --start --verbose --pidfile $PIDFILE --exec $DAEMON > /dev/null 2>&1
+ echo "done"
+ ;;
+ *)
+ echo "Usage: /etc/init.d/isakmpd {start|stop|restart|force-reload}"
+ exit 1
+ ;;
+esac
+
+exit 0
diff --git a/keyexchange/isakmpd-20041012/debian/isakmpd.lintian b/keyexchange/isakmpd-20041012/debian/isakmpd.lintian
new file mode 100644
index 0000000..7d9b585
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/isakmpd.lintian
@@ -0,0 +1,3 @@
+isakmpd: copyright-should-refer-to-common-license-file-for-gpl
+isakmpd: non-standard-dir-perm
+isakmpd: non-standard-file-perm
diff --git a/keyexchange/isakmpd-20041012/debian/rules b/keyexchange/isakmpd-20041012/debian/rules
new file mode 100755
index 0000000..d15e56a
--- /dev/null
+++ b/keyexchange/isakmpd-20041012/debian/rules
@@ -0,0 +1,73 @@
+#!/usr/bin/make -f
+
+export DH_COMPAT := 5
+
+b := $(CURDIR)/debian/isakmpd
+
+arrange: arrange-stamp
+arrange-stamp: install
+ dh_testdir
+ touch arrange-stamp
+
+binary: binary-stamp
+binary-stamp: binary-indep binary-arch
+ dh_testdir
+ touch binary-stamp
+
+binary-arch: binary-arch-stamp
+binary-arch-stamp: arrange
+ dh_testdir
+ dh_testroot
+ dh_installdocs -n DESIGN-NOTES QUESTIONS README README.PKI TO-DO $(CURDIR)/debian/README.Debian x509v3.cnf
+ cp $(CURDIR)/samples/*.conf $(b)/usr/share/doc/isakmpd/samples/
+ cp $(CURDIR)/samples/VPN-east.conf $(b)/etc/isakmpd/isakmpd.conf
+ cp $(CURDIR)/samples/policy $(b)/etc/isakmpd/isakmpd.policy
+ cp $(CURDIR)/isakmpd $(b)/usr/sbin/
+ cp $(CURDIR)/apps/certpatch/certpatch $(b)/usr/bin
+ cp $(CURDIR)/debian/isakmpd.lintian $(b)/usr/share/lintian/overrides/isakmpd
+ dh_installman isakmpd.8 isakmpd.conf.5 isakmpd.policy.5 apps/certpatch/certpatch.8
+ dh_installinit
+ dh_installchangelogs $(CURDIR)/debian/ChangeLog upstream
+ dh_compress
+ dh_fixperms
+ find $(b)/etc/isakmpd -type d | xargs chmod 0700
+ find $(b)/etc/isakmpd -type f | xargs chmod 0600
+ dh_strip
+ dh_installdeb
+ dh_perl
+ dh_shlibdeps
+ dh_gencontrol
+ dh_md5sums
+ dh_builddeb
+ touch binary-arch-stamp
+
+binary-indep: binary-indep-stamp
+binary-indep-stamp: arrange
+ dh_testdir
+ touch binary-indep-stamp
+
+build: build-stamp
+build-stamp: config
+ dh_testdir
+ $(MAKE)
+ touch build-stamp
+
+clean:
+ dh_testdir
+ dh_testroot
+ $(MAKE) clean
+ dh_clean arrange-stamp binary-stamp binary-arch-stamp binary-indep-stamp build-stamp config-stamp install-stamp
+ find $(CURDIR) -type f -name ".depend" | xargs rm -f
+
+config: config-stamp
+config-stamp:
+ dh_testdir
+ touch config-stamp
+
+install: install-stamp
+install-stamp: build
+ dh_testdir
+ dh_installdirs
+ touch install-stamp
+
+.PHONY: arrange binary binary-arch binary-indep build clean config install