denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,427 Commits 1 Branch 0 Tags
48ac56e2aaea6cb1cae15c78644f3cfd4ed74e28
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 0a8c399a21 pki: When dispatching commands, don't look beyond non-null-terminated array 2014-03-19 09:37:46 +01:00
Martin Willi 87e53819a6 pki: Check length of commands array before accessing command in --help 
As --help is counted as command as well, the array is not null-terminated
and we have to check for MAX_COMMANDS.

Fixes #550.
 2014-03-19 09:25:29 +01:00
Martin Willi 1c667bce3f pki: Make cmds array static, ensuring that it is zero-initialized 
As pki --help relies on a zero-terminated array, make the actually non-public
cmds array static to ensure initialization.
 2014-02-20 11:45:51 +01:00
Martin Willi 961409b668 lookip: Disconnect asynchronously to avoid dead-locking watcher unregistration 
While it really would be desirable to allow stream destruction during on_read()
callbacks, this does not work anymore since e49b2998. Until we have a proper
solution for this issue, use asynchronous disconnects for the only user doing
so.

Fixes #518.
 2014-02-17 09:48:55 +01:00
Martin Willi 7707357227 rdrand: Provide get_features() regardless of RDRAND availability 
As having no get_features() raises a deprecated warning, we return no features
instead.
 2014-02-10 11:22:16 +01:00
Martin Willi 144f1d7041 rdrand: Move RDRAND detection log to level 2 
When having RDRAND support, these log messages might be confusing when using
pki or other tools.
 2014-02-10 11:07:50 +01:00
Martin Willi ac2dc3b726 updown: Return an empty DNS server enumerator if no IKE_SA available 
The one existing caller does not handle a NULL return and always expects
an enumerator; and returning FALSE does not make sense anyway.
 2014-02-06 16:38:39 +01:00
Martin Willi fe40c47547 Merge branch 'cmd-proposals' 
Introduce --ike/esp/ah-proposal options to offer custom proposals, and requests
an IPv6 virtual IP if an IPv6 --remote-ts is given.

Fixes #508.
 2014-02-06 15:58:41 +01:00
Martin Willi e2de972c55 charon-cmd: Request an IPv6 virtual IP if an IPv6 remote subnet given 2014-02-06 15:58:13 +01:00
Martin Willi fe7269c089 charon-cmd: Document new proposal options in manpage 2014-02-06 15:58:13 +01:00
Martin Willi c9e85424a8 charon-cmd: Add --esp/--ah-proposal options to specify CHILD_SA proposals 2014-02-06 15:58:07 +01:00
Martin Willi 2796cf59bc charon-cmd: Add an --ike-proposal option to specify non-default IKE proposals 2014-02-06 15:57:36 +01:00
Martin Willi 1df1430146 charon-cmd: Block SIGUSR1 on worker threads 
To properly shut down charon-cmd with leak reports, only the main thread
should catch SIGUSR1 to shut down the application. Work threads should ignore
SIGUSR1 to avoid any hard application termination.
 2014-02-06 15:57:36 +01:00
Martin Willi 0c5dfb741f testing: Fetch the FreeRADIUS tarball from the "old" directory 
Fixes #483.
 2014-01-31 17:51:45 +01:00
Martin Willi 1f4883008e unit-tests: Add some test cases for HTTP GET/POST fetches 2014-01-31 12:18:32 +01:00
Martin Willi 1691b19900 unit-tests: Fix test_runner_run() apidoc 2014-01-29 13:38:10 +01:00
Martin Willi 0cec570a4b NEWS: Add unit testing improvements 2014-01-24 13:19:55 +01:00
Martin Willi d048a319df ike: Restart inactivity counter after doing a CHILD_SA rekey 
When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity
job is queued for a time unrelated to the rekey time, so it might happen
that the inactivity job gets executed just after rekeying. If this happens,
inactivity is detected even if we had traffic on the rekeyed CHILD_SA just
before rekeying.

This change implies that inactivity checks can't handle inactivity timeouts
for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter
than the rekey time to have any effect.
 2014-01-23 16:19:22 +01:00
Martin Willi 763e035335 child-sa: Add a getter for CHILD_SA install time 2014-01-23 16:19:22 +01:00
Martin Willi 76d073c5ab Merge branch 'pam-session' 
Add support for PAM session management in xauth-pam.
 2014-01-23 16:14:46 +01:00
Martin Willi 572582f5de NEWS: Introduce PAM session management 2014-01-23 16:11:54 +01:00
Martin Willi c5dc94dc8a man: Document xauth-pam session option 2014-01-23 16:07:04 +01:00
Martin Willi 7dc8bf495b xauth-pam: Sanitize XAuth attributes before passing them to PAM 2014-01-23 16:07:04 +01:00
Martin Willi 5770e28e96 Merge branch 'vendor-ids' 
Refactors IKEv2 vendor ID handling, and introduces some IDs seen when talking
to Cisco devices.
 2014-01-23 16:04:48 +01:00
Martin Willi c7c2e24a56 ikev2: Add Cisco FRAGMENTATION vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:04:04 +01:00
Martin Willi 2c6d204bec ikev2: Add Cisco Copyright vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:04:01 +01:00
Martin Willi f84d1cb2f9 ikev2: Add Cisco Delete Reason vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:03:55 +01:00
Martin Willi a8d8e631f9 ikev2: Use a more dynamic vendor ID database, as we use with IKEv1 2014-01-23 16:02:18 +01:00
Martin Willi 6a620f9936 Merge branch 'chunk-mmap' 
Introduces file mmap/munmap() wrappers and provides a fallback if mmap() is not
supported. Replaces all mmap() uses by the new functions.
 2014-01-23 15:57:45 +01:00
Martin Willi 853498155e libpts: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi 7ae878c357 tnccs: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi 88fa7f62be pem: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi ecdef634aa stroke: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b8d0103e31 radattr: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi 39badc53cd libfast: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi 69be6a9e05 integrity-checker: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b9ee059ca9 chunk: Externalize error reporting in chunk_write() 
This avoids passing that arbitrary label just for error messages, and gives
greater flexibility in handling errors.
 2014-01-23 15:55:32 +01:00
Martin Willi 37374a292a chunk: Provide a fallback chunk_map() if mmap is not available 2014-01-23 15:55:32 +01:00
Martin Willi 1c4a3459f7 chunk: Use dynamically allocated buffer in chunk_from_fd() 
When acting on files, we can use fstat() to estimate the buffer size. On
non-file FDs, we dynamically increase an allocated buffer.

Additionally we slightly change the function signature to properly handle
zero-length files and add appropriate unit tests.
 2014-01-23 15:55:32 +01:00
Martin Willi 595b6d9a82 chunk: Add functions to map file contents to a chunk 2014-01-23 15:55:32 +01:00
Martin Willi b034131555 unit-tests: Pass a test suite collection name to print during test execution 
As we except to get more and more test runners for the different components,
we add a name to easily identify them on the test output.
 2014-01-22 15:34:53 +01:00
Martin Willi 589fab2260 array: Add an array_get() function 2014-01-22 15:34:53 +01:00
Martin Willi 027cf7ddcf watcher: Don't complain if select() syscall got interrupted 2014-01-22 15:34:53 +01:00
Martin Willi e49b299867 stream: Make sure no watcher callback is active while changing stream callbacks 
When changing async callbacks on streams, we have to make sure the watcher
callback is not currently active and has temporarily disabled callbacks. This
could have been the case, as we didn't explicitly removed any pending
watcher registration if both callbacks are NULL.

By enforcing the watcher unregistration, we are sure the watcher callback is
not active and currently is not mangling the callback hooks. This should make
sure we avoid any races for the callback variables.
 2014-01-22 15:34:53 +01:00
Martin Willi 2e89bc4b66 printf-hook-builtin: Correctly calculate written bytes in print_in_hook() 
The hook data counts remaining buffer bytes, not used ones. Counting them
correctly fixes a crash for long hexdumps.

Further, print_in_hook() must return the number of bytes that would have been
written, not the actually written bytes. This is important, as we allocate a
dynamic buffer in bus that relies on the exact byte count. Fixes long hexdumps
that got truncated.
 2014-01-15 18:28:43 +01:00
Martin Willi 1cbe4e6ce4 tun-device: Include <linux/types.h> before <linux/if_tun.h> 
Fixes a build error on CentOS 6.4.
 2013-11-22 09:09:06 +01:00
Martin Willi 07ca25909b printf-hook-builtin: Don't use %P to print uppercase hex pointers 
We use %P as custom printf specifier for proposals.
 2013-11-20 16:57:28 +01:00
Martin Willi 27467a6881 Merge branch 'unit-tests' 
Replace the "check" based libstrongswan unit test framework with our own,
giving us more flexibility for our specific needs.

The new framework is more portable and uses complete libstrongswan init/deinit
cycles for each test to properly catch leaks. It fully supports multi-threaded
tests, and brings many of them for all threading primitives, watcher and
streams.

The --enable-unit-tests option is not required anymore for libstrongswan tests,
but still is for the still "check" based charon-tkm tests.
 2013-11-06 10:31:07 +01:00
Martin Willi 09d0c9030a unit-tests: Separate test runner to a library, reusable by other tests 
Other users may make use of the noinst libtest.la helper library to implement
unit tests. For libstrongswan, tests.[ch] provide the configuration for test
runner to perform unit tests in a simple manner.
 2013-11-06 10:31:07 +01:00
Martin Willi 5a3230a250 unit-tests: Use some include magic to define test suite constructors 
Avoid editing of several files when creating test suites by using a single
header file to define test suite constructor functions.
 2013-11-06 10:31:07 +01:00
Martin Willi d9d0eef92b unit-tests: Check printing of strings having zero length 2013-11-06 10:31:07 +01:00
Martin Willi 61934203e2 unit-tests: Add some basic tests if PRI* printf specifiers work as expected 2013-11-06 10:31:06 +01:00
Martin Willi a4cbda35ce unit-tests: Add a semaphore wait cancel test 2013-11-06 10:31:06 +01:00
Martin Willi fae1b85223 unit-tests: Add a semaphore absolute timed wait test 2013-11-06 10:31:06 +01:00
Martin Willi a14935ea4b unit-tests: Add a semaphore timed wait test case 2013-11-06 10:31:06 +01:00
Martin Willi ffab2e0c95 unit-tests: Add a simple semaphore test 2013-11-06 10:31:06 +01:00
Martin Willi b1bfe59560 unit-tests: Add a spinlock test case 2013-11-06 10:31:06 +01:00
Martin Willi 478dc0257c unit-tests: Add a rwlock condvar thread cancel test 2013-11-06 10:31:05 +01:00
Martin Willi b92c173b28 unit-tests: Add a rwlock condvar absolute timed wait test 2013-11-06 10:31:05 +01:00
Martin Willi af19213c54 unit-tests: Add a rwlock condvar wait test 2013-11-06 10:31:05 +01:00
Martin Willi 1032f52d68 unit-tests: Add a rwlock condvar broadcast test 2013-11-06 10:31:05 +01:00
Martin Willi f644b9e853 unit-tests: Add a rwlock condvar test 2013-11-06 10:31:05 +01:00
Martin Willi dac31fe1a0 unit-tests: Add a rwlock test case 2013-11-06 10:31:05 +01:00
Martin Willi 8b25b5c36f unit-tests: Add a condvar test where wait gets cancelled 2013-11-06 10:31:04 +01:00
Martin Willi b7db393d01 unit-tests: Add a condvar test working on a recursive mutex 2013-11-06 10:31:04 +01:00
Martin Willi 8699a32b74 unit-tests: Add a condvar absolute timed wait test 2013-11-06 10:31:04 +01:00
Martin Willi 31f9f777b3 unit-tests: Add a condvar timed wait test 2013-11-06 10:31:04 +01:00
Martin Willi 9a0a891e6b unit-tests: Add condvar broadcast test 2013-11-06 10:31:04 +01:00
Martin Willi 13183a74d4 unit-tests: Add a simple condvar test 2013-11-06 10:31:04 +01:00
Martin Willi 21df985148 unit-tests: Add a thread local storage cleanup test 2013-11-06 10:31:03 +01:00
Martin Willi 0b00e63e49 unit-tests: Add a thread local storage fuzzer test 2013-11-06 10:31:03 +01:00
Martin Willi fd26b7ff1b unit-tests: Add a thread cleanup pop test 2013-11-06 10:31:03 +01:00
Martin Willi 4aec0c5543 unit-tests: Add cleanup test cases for different thread exit situations 2013-11-06 10:31:03 +01:00
Martin Willi e5b34086f1 unit-tests: Add a test for thread_cancellation_point() 2013-11-06 10:31:03 +01:00
Martin Willi 49e6848bd0 unit-tests: Add thread cancellability testing 2013-11-06 10:31:03 +01:00
Martin Willi 855747eab7 unit-tests: Add a simple thread_cancel() test 2013-11-06 10:31:02 +01:00
Martin Willi c320c61160 unit-tests: Add thread_exit() tests to both join and detach test cases 2013-11-06 10:31:02 +01:00
Martin Willi 274e6beb00 unit-tests: Add a simple thread detach test 2013-11-06 10:31:02 +01:00
Martin Willi 5d4a882f45 unit-tests: Add a simple thread join() test 2013-11-06 10:31:02 +01:00
Martin Willi b942528419 unit-tests: Add test suite for streams and services 2013-11-06 10:31:02 +01:00
Martin Willi 8eda87af86 unit-tests: Add a few test cases for watcher 2013-11-06 10:31:02 +01:00
Martin Willi 23b8f9bf86 unit-tests: Support testing multi-threaded code 2013-11-06 10:31:01 +01:00
Martin Willi f23fd4c59b unit-tests: Use a home-brew thread barrier to remove pthread dependency 2013-11-06 10:31:01 +01:00
Martin Willi b74b8addf8 unit-tests: Show how many test vectors have failed on test failure 2013-11-06 10:31:01 +01:00
Martin Willi b4d43a542f unit-tests: Skip fmemopen() based printf() tests if not available 2013-11-06 10:31:01 +01:00
Martin Willi 45766923b8 unit-tests: Avoid name clash with clone() from <sched.h> 2013-11-06 10:31:01 +01:00
Martin Willi 1254ad01b9 unit-tests: Fix a compiler warning in identification tests 2013-11-06 10:31:01 +01:00
Martin Willi 382fa8b419 unit-tests: Clean up memory in new asn1 unit tests 
Test runner checks for leaks when leak detective is enabled.
 2013-11-06 10:31:00 +01:00
Martin Willi 712940d161 unit-tests: Pass linked_list->invoke* varargs as uintptr_t 
Passing integers of unspecified length may result in passing an integer shorter
than uintptr_t. When reading them back, we might get more data than passed,
resulting in a failure.
 2013-11-06 10:31:00 +01:00
Martin Willi f7b8396af0 unit-tests: Initialize backtracing before printing any backtraces 2013-11-06 10:31:00 +01:00
Martin Willi bbb62267e0 thread: Note that tread_cancellation_point temporarily activates cancelability 2013-11-06 10:31:00 +01:00
Martin Willi 7a13990964 backtrace: Support backtracing even if library is not initialized 
But of course backtracing must be initialized anyway using backtrace_init().
 2013-11-06 10:31:00 +01:00
Martin Willi a5860cddae unit-tests: Enable libstrongswan tests even if --enable-unit-tests not set 
As we don't depend on the check framework anymore, we can enable the unit tests
by default. These are built/executed with "make check" only, so it makes no
sense to disable them.
 2013-11-06 10:31:00 +01:00
Martin Willi 6531afb557 automake: Don't use parallel test harness being the default with automake 1.13 
We have no need for the parallel test harness, and we prefer to have the output
of make check on the console
 2013-11-06 10:30:59 +01:00
Martin Willi 35e8eb93a0 unit-tests: Implement testing framework without "check" 2013-11-06 10:30:59 +01:00
Martin Willi 56866ecf3d leak-detective: Call {gm,local}time_r() to allocate static buffer 
On OS X Mavericks, these functions use a static allocation and are hard
to whitelist using other means.
 2013-11-06 10:30:59 +01:00
Martin Willi ef6d78d6ef leak-detective: Register OS X specific hooks just once 
If we initialize libstrongswan more than once in the same process, we may
not register the hooks twice.
 2013-11-06 10:30:59 +01:00
Martin Willi f192526c3f leak-detective: Reset leak list during cleanup 
This resets leak detective state should it get created/destroyed more than once.
 2013-11-06 10:30:59 +01:00
Martin Willi a426851f63 leak-detective: Use callback functions to report leaks and usage information 
This is more flexible than printing reports to a FILE.
 2013-11-06 10:30:59 +01:00
Martin Willi 9ae1140118 unit-tests: Move test suites to its own subfolder 2013-11-06 10:30:58 +01:00