denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,458 Commits 1 Branch 0 Tags
070cd12dfb074ca31cf6508986b3f0a6f479aa7d
Commit Graph
13626 Commits
Author SHA1 Message Date
Martin Willi 7e3f6299d5 leak-detective: call tzset() explicitly before enabling leak detective 
tzset() is hard to whitelist on some systems, as there is no symbol involved.
Call tzset() explicitly before initialization to avoid false positives.
 2013-05-06 15:15:24 +02:00
Martin Willi 17211b6b9a leak-detective: override malloc functions instead of using deprecated hooks 
malloc hooks have become deprecated, and their use has always been problematic,
especially in multi-threaded applications. Replace the functionality by
overriding all malloc functions and query the system allocator functions
using dlsym() with RTLD_NEXT.
 2013-05-06 15:15:24 +02:00
Martin Willi 0be946dce3 Use the GEN silent rule when generating files with sed 2013-05-06 15:04:56 +02:00
Martin Willi f932677f0c Use the GEN silent rule when generating oid database with perl 2013-05-06 15:04:56 +02:00
Martin Willi 9f1dfd88c8 Use the GEN silent rule when generating gperf files 2013-05-06 15:04:56 +02:00
Martin Willi 5f55fd6e61 Introduce an optional logger_t.vlog() method with format string and arguments 
To have more flexibility in the logging backend, receiving the original format
string and do printf() substitution in the logger may be preferable. An
additional but optional logger method does not touch the behavior of existing
loggers.
 2013-05-06 15:00:15 +02:00
Martin Willi e93f386dbb Raise an ALERT_PROPOSAL_MISMATCH_CHILD also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi 00080d2b8b Raise an ALERT_PROPOSAL_MISMATCH_IKE also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi aea7ce3c64 eap-radius: add an option to disable accounting for tunnels without virtual IP 2013-05-06 14:56:01 +02:00
Martin Willi 69620a48e8 eap-radius: use IKE_SA unique id instead of peer identity to manage virtual IPs 
Fixes some corner cases if multiple tunnels use the same peer identity.
 2013-05-06 14:56:01 +02:00
Martin Willi a3854d8371 Don't unset IKE_SA on bus before we released virtual IPs and attributes 2013-05-06 14:56:01 +02:00
Tobias Brunner 55321dcfb6 New Android release after adding AES-GCM, IPv6-in-IPv4 and using kernel-netlink 
libipsec now supports AES-GCM, IPv6 tunnels over IPv4 are supported,
native x86 libraries are built (requires a new Vstr build script).
Also, the existing kernel-netlink plugin now provides the kernel-net
implementation, which should be more stable in case multiple interfaces
are up and have IP addresses installed on them.
 2013-05-03 16:02:39 +02:00
Tobias Brunner 79f42ded50 libipsec: Fix memory leak in event relay 2013-05-03 16:02:39 +02:00
Tobias Brunner 740aedfec1 android: Use stronger ESP proposal including AES-GCM 2013-05-03 16:02:39 +02:00
Tobias Brunner 051fc25d92 libipsec: Add support for AES-GCM 2013-05-03 15:13:57 +02:00
Tobias Brunner 24a8d1253f libipsec: Wrap traditional algorithms in AEAD wrapper 2013-05-03 15:13:57 +02:00
Tobias Brunner 61fb3267b2 android: Remove unused methods on NetworkManager/network_manager_t 2013-05-03 15:11:20 +02:00
Tobias Brunner 70dfac4459 android: Ignore interface 'lo' 
Android adds a default route via 'lo' if no connectivity is available
causing charon to send packets via lo and triggering DPD.
 2013-05-03 15:11:20 +02:00
Tobias Brunner 18dab76bfa android: Repurpose android-net to simply handle connectivity events 
Using the events by NetworkManager/ConnectivityManager to trigger roam events
instead of the events generated by the kernel-netlink plugin the noise level
is much lower.
 2013-05-03 15:11:20 +02:00
Tobias Brunner 37873f9994 kernel-netlink: Add an option to disable roam events 2013-05-03 15:11:19 +02:00
Tobias Brunner 3b7f25906e android: Replace android-net plugin with kernel-netlink 
Virtual IPs are not handled by the kernel-netlink plugin and tun devices are
ignored.
 2013-05-03 15:11:19 +02:00
Tobias Brunner 67332b4e22 android: Set strongswan.conf options before initializing other libraries 2013-05-03 15:11:19 +02:00
Tobias Brunner 0b9ce21b5e kernel-netlink: Define defaults for routing table and prio 2013-05-03 15:11:19 +02:00
Tobias Brunner 2d7b55bf9b openssl: Define a default for FIPS_MODE 2013-05-03 15:11:19 +02:00
Martin Willi 9312fbc73d In memwipe_check(), don't put magic on stack when calling do_magic() 
Otherwise the magic might be on the stack while checking it.
 2013-05-03 14:17:37 +02:00
Martin Willi 1657b4ef26 Dump stack if memwipe() check fails 2013-05-03 11:41:51 +02:00
Andreas Steffen 9fab0a58d3 fixed a 64bit time_t issue 2013-04-21 16:07:13 +02:00
Andreas Steffen 70a7917e72 destroy SQL query 2013-04-21 16:00:23 +02:00
Andreas Steffen 6c998b8b9e Keep last AR ID 2013-04-21 08:19:30 +02:00
Andreas Steffen 2d902d7e7c fixed typo 2013-04-19 18:33:41 +02:00
Martin Willi e6ba688a35 During libstrongswan initialization, check if memwipe() works as expected 2013-04-18 13:05:37 +02:00
Andreas Steffen f4de6496a2 support of OpenSSL FIPS-140-2 library 2013-04-16 12:37:04 +02:00
Tobias Brunner 73da6c88a4 Fix checksum calculation with DESTDIR installations 2013-04-15 16:48:46 +02:00
Andreas Steffen 654c88bca8 Added charon.initiator_only option which causes charon to ignore IKE initiation requests by peers 2013-04-14 19:57:49 +02:00
Martin Willi cf1696cab9 Allow SHA1_Init()/SHA1_Update() to fail if OpenSSL version >= 1.0 2013-04-10 18:10:30 +02:00
Martin Willi b52771fbb2 Check RSA_public_decrypt() length before constructing and comparing a chunk 
If decryption fails, it returns -1. chunk_equals() should catch that error,
but be more explicit in error checking.
 2013-04-10 18:10:30 +02:00
Martin Willi 97d975b7bb RSA_check_key() may return -1 if it fails 2013-04-10 18:10:30 +02:00
Martin Willi 96a09ce226 RAND_bytes/RAND_pseudo_bytes returns -1 if it is not supported by RAND method 2013-04-10 18:10:30 +02:00
Martin Willi 0faaab20cd Check return value of ECDSA_Verify() correctly 2013-04-10 18:10:30 +02:00
Martin Willi b2b99e61c8 eap-radius: Add an option to exclude ports from Called/Calling-Station-Id 2013-04-10 13:48:03 +02:00
Andreas Steffen 12fa1784d0 emit a single assig_vips bus message for all VIPs 2013-04-06 14:16:30 +02:00
Andreas Steffen ba2880d569 ifmap plugin subscribes to assing_vip bus signal 2013-04-06 11:09:41 +02:00
Tobias Brunner 5cb4f5519b Added missing sasl Doxygen group 2013-04-05 16:03:39 +02:00
Tobias Brunner 14edee56bf unity: Check IKE_SA in only after enumerating virtual IPs 2013-04-05 16:03:10 +02:00
Andreas Steffen 2a4915e87a cleaned up XML code in tnccs-11 plugin 2013-04-04 17:12:07 +02:00
Martin Willi 9c84bbcbc0 duplicheck: track multiple IKE_SAs in checking state to avoid any races 
When two consequent duplicates have been detected, track state of each checking
IKE_SA separately, avoiding potential race conditions between the active SA
and the different SAs in checking state.
 2013-04-04 15:51:48 +02:00
Andreas Steffen 93f53a78b5 fixed memory leak 2013-04-03 21:38:04 +02:00
Andreas Steffen 3ea6fcb593 properly handle orphaned renewSession jobs 2013-04-03 21:38:04 +02:00
Andreas Steffen 91503c2112 support chunked HTTP responses 2013-04-03 21:38:04 +02:00
Andreas Steffen 1044710b04 implemented periodic IF-MAP RenewSession request 2013-04-03 21:38:04 +02:00