denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,326 Commits 1 Branch 0 Tags
1c306c0ee908291aa5a665367a935110289731b9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 1c306c0ee9 libcharon: Remove unused charon->name 2014-02-12 14:34:33 +01:00
Tobias Brunner 9222bfc695 charon-tkm: Use lib->ns instead of charon->name 2014-02-12 14:34:32 +01:00
Tobias Brunner d223fe807a libcharon: Use lib->ns instead of charon->name 2014-02-12 14:34:32 +01:00
Tobias Brunner 10c4f4e1fd libhydra: Remove unused hydra->daemon 2014-02-12 14:34:32 +01:00
Tobias Brunner d347a130f5 libhydra: Use lib->ns instead of hydra->daemon 2014-02-12 14:34:32 +01:00
Tobias Brunner 409adef43c libtls: Move settings to <ns>.tls with fallback to libtls 2014-02-12 14:34:32 +01:00
Tobias Brunner eb9b375aa1 attr-sql: Use namespace for attr-sql config, with fallback 2014-02-12 14:34:32 +01:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Tobias Brunner 7a684aece4 lib: Add default config fallback for configured namespace 
All settings in the configured global namespace fall back to libstrongswan.
 2014-02-12 14:34:32 +01:00
Tobias Brunner dbed07782b unit-tests: Test how settings_t handles some invalid data 2014-02-12 14:34:32 +01:00
Tobias Brunner 1713d88278 settings: Add method that allows to define fallback sections for other sections 
The fallbacks are currently only used for single value lookups.
Enumerators are not affected by them.
 2014-02-12 14:34:32 +01:00
Tobias Brunner ef72d4cc3f settings: Make print_key() not rely on null-terminated beginning of key buffer 
The key to print (e.g. until the next .) still has to be
null-terminated.
 2014-02-12 14:34:32 +01:00
Tobias Brunner 24d2bb7793 unit-tests: Add tests for includes and file loading in settings_t 2014-02-12 14:34:32 +01:00
Tobias Brunner 25ee33ba65 settings: Allow empty strings in section key 2014-02-12 14:34:32 +01:00
Tobias Brunner 9f9a6b0681 unit-tests: Add tests for enumerators in settings_t 2014-02-12 14:34:32 +01:00
Tobias Brunner cd0523e0a4 unit-tests: Add tests for setters in settings_t 2014-02-12 14:34:31 +01:00
Tobias Brunner 9f2870216d unit-tests: Add basic tests for settings_t 2014-02-12 14:34:31 +01:00
Tobias Brunner 34d3bfcf14 lib: Add global config namespace 2014-02-12 14:34:31 +01:00
Tobias Brunner 4f8bd6d404 pool: Typo in Makefile fixed 2014-02-12 14:34:09 +01:00
Tobias Brunner b84b5410a4 Merge branch 'sql-install' 
SQL schemas and example data (IMV) are now part of the distribution and
installed in $prefix/share/strongswan.  This way no extra copy is needed
for the test suite and distributions can easily pack those files together
with the plugins.
 2014-02-12 14:27:21 +01:00
Tobias Brunner 6e288ed19c pool: Install SQL schemas from src/pool 
This allows us to install the schemas if either the attr-sql or sql
plugin is enabled, since both use the same schema (at least in parts).
 2014-02-12 14:21:26 +01:00
Tobias Brunner b2cd0870a3 sql: Set default values for some fields in addresses table 2014-02-12 14:08:34 +01:00
Tobias Brunner 9942e43dc6 testing: Use installed PTS SQL schema and data instead of local copy 2014-02-12 14:08:34 +01:00
Tobias Brunner 96e8715e32 testing: Use installed SQL schema instead of local copy 2014-02-12 14:08:34 +01:00
Tobias Brunner de7f5305d9 libimcv: Install SQL files in /usr/share/strongswan/templates/database 2014-02-12 14:08:34 +01:00
Tobias Brunner 9ca9d99bc4 sql: Install SQL schemas in /usr/share/strongswan/templates/database 2014-02-12 14:08:34 +01:00
Tobias Brunner 68539c38e2 sql: Remove unused cred.sql snippet 2014-02-12 14:08:34 +01:00
Tobias Brunner ebc665be4d asn1: Support dates before 1970-01-01 (i.e. when time_t gets negative) 
On x86 we allow "overflows" around 1969/1970 but not for other dates.

Fixes #509.
 2014-02-12 13:54:05 +01:00
Tobias Brunner addc34d5f0 asn1: Add additional validation for parsed ASN.1 date/time values 2014-02-12 13:53:57 +01:00
Tobias Brunner 9e1ce63915 ikev1: Fix config switching due to failed authentication during Aggressive mode 
The encoded ID payload gets destroyed by the authenticator, which caused
a segmentation fault after the switch.

Fixes #501.
 2014-02-12 13:53:03 +01:00
Tobias Brunner 822b22c96f kernel-pfroute: Don't cache route entries if installation fails 2014-02-12 13:52:25 +01:00
Tobias Brunner f0f78b74d4 kernel-netlink: Don't cache route entries if installation fails 
Fixes #500.
 2014-02-12 13:52:01 +01:00
Tobias Brunner 5e75f50b70 identification: Fix printing of empty RDNs on FreeBSD 
On FreeBSD (null) is printed for NULL even if the precision is 0.
 2014-02-12 13:45:42 +01:00
Tobias Brunner f8c9c03de0 tests: Fix test for printing NULL on FreeBSD 2014-02-12 13:45:42 +01:00
Tobias Brunner 44e6dbf04d testing: Add ssh script to distribution 2014-02-12 10:53:17 +01:00
Tobias Brunner 3114cecdbe pki: Declare correct section in pki --issue man page 2014-01-24 16:17:46 +01:00
Tobias Brunner fa9b6e88a0 Merge branch 'unity-fixes' 
Improves compatibility with the Cisco and Shrew clients.

Fixes #445.
 2014-01-23 11:19:38 +01:00
Tobias Brunner 21c18f536d unity: Send all traffic selectors in a single UNITY_SPLIT_INCLUDE attribute 
Cisco clients only handle the first such attribute.
 2014-01-23 10:35:21 +01:00
Tobias Brunner f8262aa1a6 unity: Change local TS to 0.0.0.0/0 as responder 
Cisco clients and Shrew expect a remote TS of 0.0.0.0/0 if Unity is
used, otherwise Quick Mode fails.
 2014-01-23 10:35:21 +01:00
Tobias Brunner 685579d6d8 unity: Send UNITY_SPLIT_INCLUDE attributes with proper padding 
The additional 6 bytes are not actually padding but are parsed by the
Cisco client as protocol and src and dst ports (each two bytes but
strangely only the first two in network order).
 2014-01-23 10:35:21 +01:00
Tobias Brunner 6b95565767 Merge branch 'ipcomp' 
Fixes compatibility issues between firewall rules (leftfirewall=yes)
and IPComp (compress=yes), plus issues with IPComp when used with
multiple subnets in left|rightsubnet.

Fixes #436.
 2014-01-23 10:31:04 +01:00
Tobias Brunner 571025a609 testing: Add ikev2/host2host-transport-nat scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 62e050e0ef testing: Add ipv6/rw-compress-ikev2 scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 6055e347f8 testing: Add ikev2/compress-nat scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 1fde30cc23 testing: Enable firewall for ikev2/compress scenario 
Additionally, send a regular (small) ping as the kernel does not
compress small packets and handles those differently inbound.
 2014-01-23 10:27:13 +01:00
Tobias Brunner fe2a2d1885 kernel-netlink: Set selector on transport mode IPComp SAs 2014-01-23 10:27:13 +01:00
Tobias Brunner cc04a6db3e kernel-netlink: Selectively add selector on SAs that use IPComp 
Don't add a selector to tunnel mode SAs, these might serve multiple
traffic selectors but with only one selector on the SA only the traffic
matching the first one would actually get tunneled.
 2014-01-23 10:27:12 +01:00
Tobias Brunner 7e3bbcf77a updown: Increase buffer size for script and environment variables 2014-01-23 10:27:12 +01:00
Tobias Brunner 6d1198e71d updown: Allow IPIP traffic if IPComp was negotiated 
The kernel implicitly creates an IPIP SA if an IPComp SA is installed.
This SA is used inbound for small packets that are not compressed.

Since the addresses are different (they are the tunnel addresses not
those of the tunneled traffic) additional rules are required if the
traffic selector does not cover the tunnel addresses (e.g. due to a NAT).

For SAs with multiple traffic selectors duplicate rules will get installed.
 2014-01-23 10:27:12 +01:00
Tobias Brunner cf4a7395aa updown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated 2014-01-23 10:27:12 +01:00
Tobias Brunner 72a92d4f7d curl: Replace spaces in URIs with %20 
cURL requires the URIs to be URL-encoded. Apparently, some CAs encode CRL
URIs with spaces in them.

Fixes #454.
 2014-01-23 10:19:30 +01:00
Tobias Brunner ccb6758e5b utils: Add strreplace function 2014-01-23 10:18:23 +01:00
Tobias Brunner f44b1eb444 stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated 
Otherwise a malicious user could send an unterminated string to cause
unterminated reads.
 2014-01-23 10:15:07 +01:00
Tobias Brunner 5ab03863b0 stroke: Add an option to prevent log level changes via stroke socket 2014-01-23 10:15:07 +01:00
Tobias Brunner 040cf911a6 pki: Make sure no command registers too many options 2014-01-23 10:12:24 +01:00
Tobias Brunner 079e6c2b04 pki: Increase MAX_COMMANDS to cover all currently available commands 
Fixes #452.
 2014-01-23 10:12:15 +01:00
Tobias Brunner 2b8224fce3 pki: Print a warning if MAX_COMMANDS is too low 2014-01-23 10:10:53 +01:00
Tobias Brunner b0e14fcba6 pki: Properly use ?: when defining option arrays 2014-01-23 10:10:53 +01:00
Tobias Brunner 2d7852d29a configure: Add -Wno-format-security to default CFLAGS 
Either due to a change in Ubuntu 13.10 or GCC 4.8 -Wno-format has no
effect if -Wformat-security is enabled (which it is on Ubuntu) so we
also disable the latter by default.
 2014-01-23 10:08:53 +01:00
Tobias Brunner 54ca25800c agent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket 
This is also required if charon-cmd is used with capability dropping.
 2014-01-23 10:08:23 +01:00
Tobias Brunner 53d2164c5d ike: Simplify error handling if name resolution failed 
This avoids a second name resolution attempt just to determine if %any
etc. was configured.

Fixes #440.
 2014-01-23 10:04:19 +01:00
Tobias Brunner be8af56e7a ike: Use proper hostname(s) when name resolution failed 
Was wrong since 0edce68767.

Fixes #440.
 2014-01-23 10:03:50 +01:00
Tobias Brunner 72ffb20318 ikev2: Wipe (optional) shared secret during CHILD_SA key derivation 2014-01-23 09:54:18 +01:00
Tobias Brunner e465c006e5 checksum must be the last subdir included 
Otherwise charon-cmd will not yet be installed when the checksums are
calculated (now from the install dir, not the build dir).

Fixes #496.
 2014-01-23 09:43:45 +01:00
Tobias Brunner a40c66194e checksum: Read executables from DESTDIR 
This allows to recreate the checksums after the installed binaries have
been modified e.g. with strip.

Fixes #491.
 2014-01-21 14:53:46 +01:00
Tobias Brunner 303ec3956c unit-tests: Add environment variable to reduce the number of generated keys 
If TESTS_REDUCED_KEYLENGTHS is set RSA and ECDSA keys are only generated
for the lowest configured key length.

Fixes #474.
 2014-01-20 15:40:15 +01:00
Tobias Brunner 3d097e1024 unit-tests: Generate RSA key with 768 bits not 786 2014-01-20 15:40:09 +01:00
Tobias Brunner 2ff62bee04 checksum: Set rpath including DESTDIR for checksum_builder 
This way libraries to which checksum_builder does not itself link,
like libtls and libradius, are found during DESTDIR installs.

Fixes #476.
 2014-01-08 11:24:24 +01:00
Tobias Brunner 94e10f15e5 test-asn1: Fix skipping of >2038 tests on i386 
The two constants overflow time_t on i386 (they also produced a compiler
warning without type suffix) so the comparison with TIME_32_BIT_SIGNED_MAX
did not work as intended.

Fixes #477.
 2014-01-06 18:23:40 +01:00
Tobias Brunner d62a6ec3f9 chunk: Fix chunk_mac/hash tests on big-endian systems 
Our SipHash-2-4 implementation returns the result in host order, while
the test vectors are little-endian.  Use a custom comparison function to
account for this.

Fixes #478.
 2014-01-06 17:31:07 +01:00
Tobias Brunner 13f2d3a2f6 utils: Fix %T printf hook on big-endian systems 
The cast to a bool* cut of the actual value on big-endian systems
if bool was shorter than int because the bool argument to printf gets
promoted to an int.

Fixes #479.
 2014-01-06 15:30:02 +01:00
Tobias Brunner 0773c7fd71 checksum: Delay building of checksum_builder until required by make install 
This ensures PLUGINDIR includes any DESTDIR set during make install.
 2014-01-06 14:38:34 +01:00
Tobias Brunner 5d826357b8 checksum: Remove unnecessary pluto symbol 2014-01-06 13:37:12 +01:00
Tobias Brunner 261fd9d33b stroke: Fix error message if parsing leftsourceip fails 2014-01-06 12:55:45 +01:00
Tobias Brunner bfa2201537 tun-device: Include system headers before our own 
On CentOS 6.5 the sys/capability.h header file defines _LINUX_TYPES_H
without actually including that header, preventing its later inclusion
here.

As library.h (via which the capabilities headers are included) is not
actually required in tun_device.[ch], moving the inclusion of tun_device.h
would not strictly be necessary.  But it's probably a good idea to
include our own headers after system headers anyway, for if one of the
recursively included files at a later point includes library.h we'd have
the same problem again.
 2013-12-20 11:33:16 +01:00
Tobias Brunner 7c4629060a aes-test: Fix compiler warnings from older versions of GCC 2013-12-19 11:02:23 +01:00
Tobias Brunner f1e12da7ef unit-tests: Don't use priority for destructor that unregisters testable functions 
This fixes coverage reports, at least if leak detective is disabled.
If it is enabled the plugins are not unloaded so the destructor is not
executed until the process is destroyed, which seems not to be covered
by gcov.
 2013-12-04 20:33:00 +01:00
Tobias Brunner d5a0abfa92 unit-tests: Export ntru_drbg_create as testable function so no linking is required 
This way the plugin does not have to be linked explicitly to the test
runner, which otherwise would require that the plugin is either always
enabled to build the tests or that ifdefs are added to the Makefile.
 2013-12-04 20:32:59 +01:00
Tobias Brunner 4cea186b64 unit-tests: Add facility to register testable functions 
These can be defined in plugins, or other parts of the tested libraries.
They can even be static.
 2013-12-04 20:32:59 +01:00
Tobias Brunner a24eec4649 unit-tests: Move ntru_test_rng_t to a utility class in libtest 2013-12-04 20:32:59 +01:00
Tobias Brunner 6354466a5b unit-tests: Fix apidoc for libtest 2013-12-04 20:32:59 +01:00
Tobias Brunner 3e8a44c2aa ntru: Fix compiler warning caused by ++/-- on righthand side of an assignment 
The behavior of stuff like x = --x; (or x++) is not defined.
 2013-12-04 20:32:59 +01:00
Tobias Brunner 7c7148b038 ike: Log SK_p consistently on level 4 2013-11-28 19:04:47 +01:00
Tobias Brunner e9b49d412b Merge branch 'nm-psk' 
This adds support for PSK authentication to the NetworkManager frontend.
 2013-11-27 18:37:11 +01:00
Tobias Brunner 0b506edb19 nm: Require the PSK to be at least 20 characters long 2013-11-27 18:36:58 +01:00
Tobias Brunner 692a421aa0 nm: German translation updated 2013-11-27 18:36:58 +01:00
Tobias Brunner 5ae822cfcd nm: Handle PSK option in NM backend 2013-11-27 18:36:58 +01:00
Tobias Brunner 594878e552 nm: Add PSK option to auth-dialog 2013-11-27 18:36:58 +01:00
Tobias Brunner 63528ebd3f nm: Add pre-shared key option in GUI 2013-11-27 18:36:58 +01:00
Tobias Brunner cfaec93111 nm: Make intltool recognize glade files properly 2013-11-27 18:36:58 +01:00
Tobias Brunner 228db0433d configure: Remove obsolete --enable-unit-tests option 2013-11-27 18:35:44 +01:00
Tobias Brunner f5feeb04f3 charon-tkm: Don't run tests automatically during 'make check' 
Due to the external dependencies these tests are quite inconvenient.
They can be run from the charon-tkm directory with 'make check-tkm'.
 2013-11-27 18:35:44 +01:00
Tobias Brunner d6032bff8b charon-tkm: Migrate tests to our own test runner 
Due to problems with the external libraries tkm_init/deinit can't be
called for each test case.  Because of this leak detective has to be
disabled for these tests.
 2013-11-27 18:35:44 +01:00
Tobias Brunner 70f4461359 charon-tkm: Support for out-of-tree build added 2013-11-27 18:35:44 +01:00
Tobias Brunner 20a48e4be3 chunk: Fix signedness warnings caused by chunk_from_* macros 
There are countless other such warnings because e.g. chunk_create() is called
with char*, but at least we prevent users from causing such warnings
inadvertently when using these macros.
 2013-11-27 18:28:44 +01:00
Tobias Brunner c61ca66a39 trap-manager: Reset IKE_SA on bus_t if initiating fails 2013-11-21 13:43:31 +01:00
Tobias Brunner bb492d80b5 trap-manager: Prevent deadlock when installing trap policies 
Because the write lock was held while calling add_policies() on
child_sa_t, which finishes with a call to child_state_change() on bus_t,
a deadlock would ensue if CHILD_SAs are concurrently being established,
which also causes a call to child_state_change() that will require
the read lock in trap_manager_t.

No locks are now being held while creating the CHILD_SA and installing the
trap policies.
 2013-11-21 11:12:59 +01:00
Tobias Brunner 906a4fd16b coverage: Report branch coverage 2013-11-21 11:10:39 +01:00
Tobias Brunner 8071c2a5e3 testing: Config for Linux kernel 3.12 
The most significant change is that CONFIG_ACPI_PROC_EVENT is now
finally removed (after being deprecated for a long time).

So to successfully shutdown the guests via ACPI the CONFIG_INPUT_EVDEV
option is now enabled.
 2013-11-19 17:15:12 +01:00
Tobias Brunner 3bff80aee3 openssl: Verify that a peer's ECDH public value is a point on the elliptic curve 
This check is mandated by RFC 6989.  Since we don't reuse DH secrets,
it is mostly a sanity check.
 2013-11-19 15:00:28 +01:00