denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,131 Commits 1 Branch 0 Tags
20a48e4be31db0423845a8d700390df8a215489f
Commit Graph
422 Commits
Author SHA1 Message Date
Tobias Brunner 20a48e4be3 chunk: Fix signedness warnings caused by chunk_from_* macros 
There are countless other such warnings because e.g. chunk_create() is called
with char*, but at least we prevent users from causing such warnings
inadvertently when using these macros.
 2013-11-27 18:28:44 +01:00
Martin Willi 07ca25909b printf-hook-builtin: Don't use %P to print uppercase hex pointers 
We use %P as custom printf specifier for proposals.
 2013-11-20 16:57:28 +01:00
Martin Willi 7a13990964 backtrace: Support backtracing even if library is not initialized 
But of course backtracing must be initialized anyway using backtrace_init().
 2013-11-06 10:31:00 +01:00
Martin Willi 56866ecf3d leak-detective: Call {gm,local}time_r() to allocate static buffer 
On OS X Mavericks, these functions use a static allocation and are hard
to whitelist using other means.
 2013-11-06 10:30:59 +01:00
Martin Willi ef6d78d6ef leak-detective: Register OS X specific hooks just once 
If we initialize libstrongswan more than once in the same process, we may
not register the hooks twice.
 2013-11-06 10:30:59 +01:00
Martin Willi f192526c3f leak-detective: Reset leak list during cleanup 
This resets leak detective state should it get created/destroyed more than once.
 2013-11-06 10:30:59 +01:00
Martin Willi a426851f63 leak-detective: Use callback functions to report leaks and usage information 
This is more flexible than printing reports to a FILE.
 2013-11-06 10:30:59 +01:00
Martin Willi 7f4a13fffb identification: Properly check length before comparing for binary DN equality 
Fixes CVE-2013-6075.
 2013-10-31 21:57:07 +01:00
Tobias Brunner 5ac29360fc utils: Include stdio.h for fmemopen() replacement 
This might now be required because Vstr is not necessarily required
anymore, which means stdio.h might not be pulled in by prinf_hook.h.
 2013-10-29 16:18:35 +01:00
Martin Willi 9df621d21f utils: Fix check for fmemopen() fallback implementation 2013-10-24 15:58:49 +02:00
Martin Willi e71c57467c printf-hook-builtin: Don't rely on isinf() return value signedness 
Many systems don't return a negative value for negative infinities; so do
a separate check.
 2013-10-24 15:37:20 +02:00
Martin Willi 2077d996a9 utils: Provide a fmemopen(3) fallback using BSD funopen() 2013-10-24 13:17:05 +02:00
Tobias Brunner 46cded2627 chunk: Add helper function to create a chunk from data read from a file descriptor 2013-10-23 17:20:39 +02:00
Tobias Brunner 812ae898bf utils: Add utility function to calculate padding length 2013-10-17 10:25:34 +02:00
Tobias Brunner 3473cbab9c vstr: Forward actual field width 
fmt_field_width is a flag that indicates if a field width
is defined in obj_field_width.
 2013-10-11 15:12:16 +02:00
Martin Willi 795cbb98c6 printf-hook-builtin: Print NaN/Infinity floating point values as such 2013-10-11 11:06:09 +02:00
Martin Willi 8af9bf70f5 printf-hook-builtin: Correctly round up floating point values 2013-10-11 11:06:09 +02:00
Martin Willi edc7a3d02f printf-hook-builtin: Add some preliminary floating point support 
This minimalistic implementation has no aspiration for completeness or
accuracy, and just provides what we need.
 2013-10-11 11:06:09 +02:00
Martin Willi 7e6a4cdc84 printf-hook-builtin: Support GNU %m specifier 2013-10-11 11:06:09 +02:00
Martin Willi cabe5c0ff4 printf-hook-builtin: Add a new "builtin" backend using its own printf() routines 
Overloads printf C library functions by a self-contained implementation,
based on klibc. Does not yet feature all the required default formatters,
including those for floating point values.
 2013-10-11 11:06:02 +02:00
Martin Willi 243048248b printf-hook: Move glibc/vstr printf hook backends to separate files 2013-10-11 11:05:30 +02:00
Tobias Brunner ed72f2d65e printf-hook: Write to output stream instead of the FD directly when using Vstr 
This avoids problems when other stdio functions are used (fputs,
fwrite) as writes via Vstr/FD were always unbuffered.
 2013-09-24 08:44:00 +02:00
Andreas Steffen 7bda0f0c8b Added tzset memory leak to whitelist 2013-08-28 22:51:17 +02:00
Tobias Brunner f0c54e8c15 chunk: Print chunks without separator if + modifier is used 2013-08-24 16:22:51 +02:00
Tobias Brunner 32a145fdbd utils: Add case-insensitive version of strpfx() 2013-08-24 16:22:51 +02:00
Martin Willi a24515c515 backtrace: rename clone() method clashing with system call 
Fixes #376.
 2013-08-09 09:13:39 +02:00
Martin Willi 84044f9c73 utils: add round_up/down() helper functions 2013-07-29 09:00:48 +02:00
Tobias Brunner cfdd23b967 capabilities: Proper error handling when reading groups 2013-07-24 10:54:26 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi cb6c4e0430 identification: parse identities having a "@@" prefix as ID_RFC822_ADDR 
Original patch by Gerald Richter.
 2013-07-18 16:45:10 +02:00
Tobias Brunner 027676f750 capabilities: Add function to check if a capability is held, without keeping it 
This can be useful if capabilities are not required anymore after
dropping privileges.
 2013-07-18 15:25:35 +02:00
Martin Willi 1e54e40f5d leak-detective: remove hdr entry when reallocating zero bytes 2013-07-12 20:00:16 +02:00
Martin Willi c93cf85356 leak-detective: print total of allocated/leaked bytes in usage/report 2013-07-12 20:00:14 +02:00
Martin Willi 81959e6406 leak-detective: add a usage threshold option based on the number of allocations 2013-07-10 17:28:45 +02:00
Martin Willi 82d0317be6 leak-detective: set_state() only affects the calling thread 
The only user (bfd backtraces) is fine with that, and we really should not
mess the enable flag while doing allocations with other threads.
 2013-07-10 17:28:32 +02:00
Martin Willi f960b39061 leak-detective: take a copy of backtrace while printing traces 
As we don't want to hold the lock, we must make sure backtraces keep valid
while printing them.
 2013-07-10 17:28:24 +02:00
Martin Willi d9c459e855 backtrace: add a clone() method 2013-07-10 17:28:18 +02:00
Martin Willi 3b26f04cf4 leak-detective: remove hdr from the allocation list during realloc() 
If realloc moves an allocation, the original allocation gets freed. We
therefore must remove the hdr from the list, as it is invalid. We can add it
afterwards once it has been updated, allowing us to unlock the list during
reallocation.
 2013-07-10 16:37:08 +02:00
Tobias Brunner f460facdca utils: Add helper function to check a string for a given prefix 2013-07-08 18:49:30 +02:00
Tobias Brunner 985dcab1c2 utils: Convert string helper macros to static inline functions 2013-07-08 18:49:29 +02:00
Tobias Brunner f95205f580 integrity-checker: Use chunk_hash_static() to calculate checksums 2013-06-28 17:00:29 +02:00
Tobias Brunner ed235dbbf2 chunk: Add predictable hash function 
Since chunk_hash() is randomized its output is not predictable, that is,
it is only within the same process.
 2013-06-28 17:00:29 +02:00
Tobias Brunner 75ff252324 integrity-checker: Fix checksum calculation after randomizing chunk_hash() 2013-06-27 15:34:08 +02:00
Tobias Brunner ac2ffde4ae capabilities: Return effective UID/GID if user did not configure anything 2013-06-25 17:16:33 +02:00
Tobias Brunner 5e80e387bd capabilities: Report effective UID/GID after dropping capabilities 2013-06-25 17:16:33 +02:00
Tobias Brunner 1937538440 capabilities: Handle CAP_CHOWN specially as it might not be required 2013-06-25 17:16:33 +02:00
Tobias Brunner 9c354c659f capabilities: Check effective UID as fallback if capabilities are not supported 2013-06-25 17:16:33 +02:00
Tobias Brunner 6f15f5e632 dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets 2013-06-25 17:16:32 +02:00
Tobias Brunner 1dd61bf13d socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024 
Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.
 2013-06-25 17:16:32 +02:00
Tobias Brunner 41b8546ac0 capabilities: Only plugins that require CAP_NET_ADMIN demand it 
The daemon as such does not require this capability.
 2013-06-25 17:16:32 +02:00