Disclaimer: 

Please note: Although OBSOLETED patches are available on SunSolve, Sun recommends using the most recent patches and the most recent revision of those patches. OBSOLETED patches do not include the latest bug fixes and/or product enhancements, and may require the installation of additional patches as a corrective measure.

Status: OBSOLETE

Patch Id: 114435-09

***********************************************************************
READ THE TERMS OF THE AGREEMENT ("AGREEMENT") IN THE LEGAL_LICENSE.TXT
FILE CAREFULLY BEFORE USING THIS SOFTWARE. BY USING THE SOFTWARE, YOU
AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE
TERMS, PROMPTLY DESTROY THE UNUSED SOFTWARE.
***********************************************************************

Summary: Obsoleted by: 114435-10 SunOS 5.9_x86: IKE Hardware - libike Patch

Date:  Dec/13/2005

Installation Requirements:

Reconfigure immediately after patch is installed                      
                      Install in Single User Mode

Solaris Release: 9_x86

Sun OS Release: 5.9_x86

Unbundled Product: 

Unbundled Release: 

Xref: This patch available for SPARC as patch 113451

Topic: 

SunOS 5.9_x86: IKE Hardware - libike Patch

Relevant Architecture: i386

BugId's fixed with this patch:

4666686 4667873 4671563 4673333 4673338 4687237 4704460 4731575 4739746 4742619 4745493 4745709 4752466 4762219 4804299 4823665 4832562 4840090 4842368 4890236 4919747 4919802 4927429 4930399 4941232 4963817 4974853 4976759 4977335 4982429 5016628 6259973 6265403 6268124 6316863 6317027

Changes incorporated in this version:

6259973 6265403 6268124 6316863 6317027

Patches accumulated and obsoleted by this patch:

115261-01

Patches which conflict with this patch: 

Required Patches:

Obsoleted by:

Files Included in this Patch: 

/etc/security/exec_attr
/usr/lib/abi/abi_libike.so.1
/usr/lib/inet/certdb
/usr/lib/inet/certlocal
/usr/lib/inet/certrldb
/usr/lib/inet/in.iked
/usr/lib/libike.so.1
/usr/sbin/ikeadm
/usr/sbin/ikecert

Problem Description: 

6316863 in.iked stops responding after 8 hours because cookies have been updated
6265403 Short-lived Phase I SAs get bitten by libike's retransmit-driven delayed cleanup
6259973 IKE phase2 exchange fails to occur when phase1 SA nears expiry
6268124 ikeadm won't remove expiring phase1 SA's by address
6317027 libike tries to dereference the wrong negotiation

(from 114435-08)

4963817 IKE p2 negotiation failures on x86 with per-socket policies

(from 114435-07)

5016628 ikecert certrldb -e "certspec" does not work
4976759 Callers of ssh_x509_crl_decode() should check for SSH_X509_OK/FAILURE
4977335 ssh_x509_crl_decode() can fail but return SSH_X509_OK
4974853 certrldb will dump core if pem_to_ber() returns NULL

(from 114435-06)

4982429 patch 113451-06 adds certlocal entry to exec_attr redundantly

(from 114435-05)

4762219 ikeadm write preshared causes in.iked heartburn
4941232 Deleting P1 SAs by address should delete ALL matching P1 SAs

(from 114435-04)

4804299 Failed to change the default value of 28800 for Phase 2 SA's via p2_lifetime_sec
4919747 p2_lifetime default value is too high
4919802 Solaris IKE does not negotiate p2_lifetime_secs when creating an SA
4667873 in.iked door protocol handles some key lengths badly
4840090 Why is add_new_sa() called before a phase1_t is linked to a Phase 1 pm_info?
4890236 in.iked botches PF_KEY identity extensions
4927429 Some deleted Phase Is linger slightly too long.

(from 114435-03)

4930399 ASN.1 patches from SSH, Inc.

(from 114435-02)

        This patch revision accumulates/obsoletes Solaris Update S9U5
        feature point patch 115261-01

(from 114435-01)

4673333 IKE should support hardware assist for certs and Oakley groups
4666686 Patch libike with 4/8/2002 SSH patches
4687237 ssh_fatal() calls abort()
4704460 ikeadm:  strcpy() should be replaced by strlcpy()
4739746 single-buffer memory leak in start_ike_servers()
4745493 More patches from SSH Inc.
4745709 SSH IKE code leaks hostent structures

(from 115261-01)

4671563 RFE: ikecert -lv should list algorithm signature
4673338 IKE should support HW storage of private keys and certificates
4731575 IKE should work with IPv6
4742619 HW-IKE should be more robust when choosing pkcs11 slots
4752466 Race in in.iked causes coredump in add_new_sa().
4823665 in.iked becomes confused about sender and receiver
4832562 certdb malformed cert causes core dump
4842368 Memory leak for rsa_encryption initiator

Revision History: 

114435-05 114435-01 114435-03 114435-06 114435-08 114435-04 114435-02 114435-07

Patch Installation Instructions: 

--------------------------------
 
For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.
 
For Solaris 7-10 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/104945-02
 
The following example removes a patch from a standalone system:
 
       example# patchrm 104945-02
 
For additional examples please see the appropriate man pages.

Special Install Instructions: 

-----------------------------
 
NOTE 1:  To get the complete Hardware Acceleration for IKE feature, please
         also install the following patch:

         114436-01 (or greater)  config.sample

NOTE 2:  To get the complete Hardware Key Storage for IKE and
         Ike for IPV6 feature, please also install the following patch:

         114337-08 (or greater)  ip patch
         114978-01 (or greater)  ipsecah Patch

README -- Last modified date:  Monday, May 1, 2006