CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/27 05:20:54
Modified files:
sbin/iked : Tag: OPENBSD_7_9 ca.c iked.h ikev2.c
ikev2_pld.c ocsp.c radius.c
Log message:
iked: Reject malformed and out-of-state IKEv2 messages
A malicious or malformed IKEv2 peer could crash iked, or cause a
certificate validation verdict to be applied to the wrong peer
identity. Reject malformed DELETE payloads and EAP responses for
which no matching server state exists, and bind CA and OCSP verdicts
to the identity they were computed for.
Reported by Stefan Rinkes and acts1631kjv at proton me.
from hshoexer@; OK markus@
this is errata/7.9/027_iked.patch.sig
