Tobias Brunner
45ee7c9429
testing: ssh script accepts IP addresses instead of host names
2013-03-05 17:40:13 +01:00
Tobias Brunner
5057455674
testing: ssh script forwards arguments to ssh command
...
This allows to execute commands on a virtual host.
2013-03-05 17:40:12 +01:00
Andreas Steffen
d7eec03815
removed unneeded DS files
2013-03-05 09:08:25 +01:00
Andreas Steffen
1a9dee5d22
instead of cloning use extract_buf() method
2013-03-04 23:21:21 +01:00
Martin Willi
b668f1417d
Don't invoke addr2line if dladdr() did not yield a filename
2013-03-04 15:50:21 +01:00
Martin Willi
1f69412b4d
When receiving critical signals, additionally log backtraces to syslog/files
2013-03-04 15:46:34 +01:00
Martin Willi
fe03f51302
backtrace_t.log() takes a NULL file pointer to log to registered dbg() hook
2013-03-04 15:45:03 +01:00
Martin Willi
8b24863b1f
Don't use color escapes when printing backtraces to a non-TTY file
2013-03-04 15:07:03 +01:00
Martin Willi
4d17427205
Add a utility function to resolve TTY color escape codes dynamically
2013-03-04 15:04:56 +01:00
Andreas Steffen
c88104aa25
make TNC Access Requestor ID available to IMVs
2013-03-03 17:18:09 +01:00
Andreas Steffen
1fc609fed3
updated NEWS
2013-03-03 17:17:08 +01:00
Andreas Steffen
7b11a1dcdc
upgraded KVM test suite to Linux 3.8 kernel
2013-03-03 11:59:07 +01:00
Andreas Steffen
f7580a5a67
added openssl-ikev2/alg-aes-gcm scenario
2013-03-03 11:43:52 +01:00
Andreas Steffen
81419b9748
use DNs in tnc/tnccs-20-tls scenario
2013-03-03 10:47:17 +01:00
Andreas Steffen
c9418d4fd3
added getpwuid_r and initgroups to whitelist
2013-03-03 09:04:49 +01:00
Andreas Steffen
eeb69761ae
third parameter was not copied
2013-03-02 22:03:07 +01:00
Tobias Brunner
11adf114c1
Fixed Doxygen comments after scanning complete src directory
2013-03-02 18:31:53 +01:00
Tobias Brunner
b42f2cacac
Include the whole src directory in apidoc and make source files browsable
...
But still only scan header files as Doxygen can't figure out how they
are related to source files (at least not for class methods).
2013-03-02 18:31:53 +01:00
Tobias Brunner
cd612784e4
Prevent Doxygen from processing __attribute__(...)
...
Doxygen produces additional members/classes from these attributes.
2013-03-02 18:31:52 +01:00
Tobias Brunner
b6a387f7b0
Updated Doxyfile.in with a recent version of Doxygen
2013-03-02 18:28:18 +01:00
Tobias Brunner
9804fccea3
Removed backend for old Android frontend patch
...
Moved the remaining DNS handler to a new plugin.
2013-03-02 18:27:23 +01:00
Andreas Steffen
b038c62e4a
added ERX_SUPPORTED IKEv2 Notify
2013-03-02 17:18:37 +01:00
Andreas Steffen
de218eb09c
added some new TCG IF-M message subtypes and attributes
2013-03-02 17:03:37 +01:00
Andreas Steffen
9e9e12bbf8
version bump to 5.0.3dr3
2013-03-02 16:19:57 +01:00
Tobias Brunner
e88b529a30
android: Mitigate race condition on reauthentication
...
If the TUN device gets recreated while another thread in handle_plain()
has not yet called select(2) but already stored the file descriptor of the
old TUN device in its FD set, select() will fail with EBADF.
Fixes #301 .
2013-03-01 17:06:01 +01:00
Tobias Brunner
4c969f7906
openssl: The EVP GCM interface requires at least OpenSSL 1.0.1
2013-03-01 16:57:45 +01:00
Martin Willi
4dd8d5430d
Merge branch 'multi-eap'
...
Fixes the use of EAP methods in the non-first authentication round if the
initiator demands mutual EAP. Also mutual EAP can now be enforced when the
initiator sets rightauth=eap, not only with rightauth=any.
2013-03-01 11:36:41 +01:00
Martin Willi
e82deaf6ce
Merge branch 'multi-cert'
...
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
2013-03-01 11:35:32 +01:00
Martin Willi
adf239abca
Merge branch 'systime'
...
Add a systime-fix plugin allowing an embedded system to validate certificates
if the system time has not been synchronized after boot. Certificates of
established tunnels can be re-validated after the system time gets valid.
2013-03-01 11:33:47 +01:00
Martin Willi
b611d8ba48
Merge branch 'ikev1-rekeying'
...
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
2013-03-01 11:32:02 +01:00
Martin Willi
ec1b4e6638
Merge branch 'vip-shunts'
...
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.
Conflicts:
src/libcharon/plugins/unity/unity_handler.c
2013-03-01 11:30:13 +01:00
Martin Willi
a36b49f3cb
Merge branch 'opaque-ports'
...
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
2013-03-01 11:27:12 +01:00
Martin Willi
53fcc70acc
When running with an unprivileged user, initialize supplementary groups
2013-03-01 11:27:01 +01:00
Martin Willi
21dd4c4bea
Without MOBIKE, update remote host only if it is behind NAT
2013-03-01 11:26:47 +01:00
Martin Willi
00683b6864
Merge branch 'ikev1-mm-retransmits'
...
Fixes retransmit of the last Main Mode or IKE_AUTH message, and correctly
queues Main Mode messages when processing of the last message is still in
progress.
2013-03-01 11:24:42 +01:00
Martin Willi
d634109f1d
Merge branch 'tfc-notify'
...
Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if
kernel does not support it.
2013-03-01 11:16:58 +01:00
Martin Willi
5c55be4915
Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it
2013-03-01 11:12:17 +01:00
Martin Willi
53e62f5d0c
Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend
2013-03-01 11:11:51 +01:00
Martin Willi
76f7d80e80
Introduce "features" for the kernel backends returning kernel capabilities
2013-03-01 11:11:24 +01:00
Tobias Brunner
9a70fe8412
testing: Add a script to easily connect to a host via SSH
...
This doesn't require any entries in /etc/hosts and the correct SSH
config is used to allow password-less access.
2013-02-28 18:21:14 +01:00
Tobias Brunner
81f9cd39fd
openssl: Provide AES-GCM implementation
2013-02-28 18:17:42 +01:00
Tobias Brunner
a89ebab62e
Fix cleanup in crypto_tester if AEAD implementation fails
2013-02-28 18:17:42 +01:00
Tobias Brunner
5f7f4fa398
Order of arguments in Doxygen comment fixed
2013-02-28 18:17:42 +01:00
Tobias Brunner
8656f35ae1
Fix auth_cfg_t.clone() for single-valued auth rules
...
By using the default list enumerator and adding the rules with the public
add() method, clones of auth_cfg_t objects would return the values for
single-valued auth rules in the wrong order (i.e. the oldest instead of the
newest value was returned). Using the internal enumerator (which the comment
already suggested) fixes this, but the clone will not be a full clone as
it does not contain any old values for single-valued auth rules. Since
these will never be used anyway, this should be fine.
2013-02-28 18:11:38 +01:00
Tobias Brunner
6e935c6fe0
Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT
...
In other cases (i.e. when functions return DESTROY_ME) the event should
already be triggered, but not in this forced situation.
2013-02-28 18:07:29 +01:00
Martin Willi
d8a94c18c6
Apply a mutual EAP auth_cfg not before the EAP method completes
2013-02-26 13:15:27 +01:00
Martin Willi
cc787697b8
Be a little more verbose why a peer_cfg is inacceptable
2013-02-26 13:15:27 +01:00
Martin Willi
289b9b7b31
Refactor auth_cfg applying to a common function
2013-02-26 13:15:27 +01:00
Tobias Brunner
bc07fef09c
Use SIGUSR2 for SIG_CANCEL on Android
...
SIGRTMIN is defined as 32 while sigset_t is defined as
unsigned long (i.e. holds 32 signals). Hence, the signal
could never be blocked. Sending the signal still canceled
threads, but sometimes in situations where they shouldn't
have been canceled (e.g. while holding a lock).
Fixes #298 .
2013-02-26 11:40:34 +01:00
Tobias Brunner
0ac34e9e6a
Android.mk updated to latest Makefiles
...
Fixes #300 .
2013-02-26 10:11:36 +01:00
Tobias Brunner