When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

show more ...

<stdlib.h> is included, so do not need to cast result from
malloc, calloc, realloc*
ok krw millert

When binding to addresses, ignore any IP address not in the current
routing domain.

While here, update comment on what the ioctl is used for (from sthen@).

OK mikeb@, sthen@

cleaning up my tree: trivial KNF and a comment fix.

do not listen on tentative (during DAD), duplicated (after DAD) or
detached addresses. bind(2) will not allow this. ok hshoexer, fries

There's no point in checking ptr for NULL before doing free(ptr)
since free(NULL) is just fine.

ok hshoexer@

Fix interop-issue with vpn peers that start reyking on port 4500 when
NAT-T is used. Solves problems with cisco and openswan.

Tested by todd@ (cisco interop), ok ho@

Original fix with Stefan Roth

Fix interop-issue with vpn peers that start reyking on port 4500 when
NAT-T is used. Solves problems with cisco and openswan.

Tested by todd@ (cisco interop), ok ho@

Original fix with Stefan Roth (stefan dot roth at siemens dot com),
thanks!

show more ...

Big spelling cleanup, no binary change. From david@

zap unused variable and silence gcc.
From Mike Belopuhov <mkb at crypt dot org dot ru>
Thanks!

Do not touch LIST_* macro internals.

with otto@, ok ho@

some small knf, ok ho@

read the information from the INADDR_ANY socket and do not loop if
a new IP appears (cf udp.c, rev 1.74), ok ho@ hshoexer@ cloder@ deraadt@

get rid of sysdep_sa_len

ok cloder@

USE_DEBUG is bye bye

nat-traversal always

Remove references to LINUX_IPSEC

remove unnecessary typecasts.

ok ho@

knf, ok cloder

Add -T flag to isakmpd to disable NAT-T support from the command line.
This lets binat setups work again without having to recompile isakmpd.
OK ho, hshoexer.

spacing; ok cloder

No need for err.h. hshoexer@ ok

cleanup binding and cloning functions, use text2port(), correctly
determin the encap port. This makes udpencap fully useable on ports
other than the default 4500.

ok ho cloder

where possible, use bzero instead of memset

ok cloder henning

Allow the Address, Network, or Netmask values of the <IPsec-ID> to be
specified with an interface name (in which case the first address is used)
or the keyword 'default' (in which case the address is

Allow the Address, Network, or Netmask values of the <IPsec-ID> to be
specified with an interface name (in which case the first address is used)
or the keyword 'default' (in which case the address is selected based on the
default route). eg:

[roadwarrior-ip]
ID-type= IPV4_ADDR
Address= default

ok ho@ hshoexer@

show more ...

compile cleanly with -Wsign-compare
ok ho