denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,447 Commits 1 Branch 0 Tags
5807f9cfcdd9b85d1dc7baab8ef2e6868b52acfd
Commit Graph
8116 Commits
Author SHA1 Message Date
Martin Willi 5807f9cfcd Add a stroke command timeout option, and report status of completed command 2013-03-07 11:59:30 +01:00
Tobias Brunner 58fd1f3eef Don't use pointer to a union member in host_create_from_string_and_family() 2013-01-25 13:18:50 +01:00
Tobias Brunner 572a707765 Properly check MSB in openssl plugin's PKCS#7 implementation 2013-01-24 23:36:02 +01:00
Tobias Brunner 9ccfeb8ca1 Use proper buffer sizes for parse_smartcard() 2013-01-24 23:35:42 +01:00
Tobias Brunner 677812dc66 Cast first argument for %.*s to int 2013-01-24 23:35:42 +01:00
Tobias Brunner bacbf91c5c Removed unused command name when printing usage info for lookip 2013-01-24 23:35:41 +01:00
Tobias Brunner d7bd0ad7df Removed unused argument 2013-01-24 23:35:34 +01:00
Tobias Brunner 4cd3fb788d Properly read data from stream in pki --pkcs7 2013-01-24 19:13:41 +01:00
Tobias Brunner 27a814b527 Properly destroy mem_cred object on pki --pkcs7 --help 2013-01-24 19:13:41 +01:00
Tobias Brunner 39896d92ed Try to determine OS type if name and version are configured 2013-01-24 19:13:41 +01:00
Tobias Brunner 24cdf5340e Add missing va_end() call 2013-01-24 19:13:41 +01:00
Tobias Brunner 69c6a60176 g_thread_init() is deprecated since Glib 2.23 2013-01-24 19:13:40 +01:00
Tobias Brunner 2ec3552fce Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled 
Setting the responder SPI to 0 can only be done while generating the
response, otherwise we'd fail to check in the IKE_SA again in case the
hash table is enabled.  That's because we use the responder SPI as hash
value since 5.0.0.
 2013-01-24 19:13:40 +01:00
Adrian-Ken Rueegsegger a25047e412 Return SS_RC_INITIALIZATION_FAILED if pid file exists 
Let charon return SS_RC_INITIALIZATION_FAILED if an existing pid file is found.
Starter only terminates itself if the result code of the daemon is a valid
SS_RC_* value.
 2013-01-23 15:59:21 +01:00
Tobias Brunner 4eb09d14e2 Avoid a deadlock when installing a trap policy failed 2013-01-23 15:51:47 +01:00
Martin Willi 8d631ebabd Encode IETF Numeric Version Service Pack Version with two byte words 2013-01-22 14:45:56 +01:00
Adrian-Ken Rueegsegger 113ff13322 starter: Add --attach-gdb option to usage text 2013-01-22 11:03:19 +01:00
Adrian-Ken Rueegsegger cf3c72c480 Fix IKE SA inherit API doc 2013-01-22 11:02:20 +01:00
Martin Willi 325efdaca8 Filter TS list for Split-Includes before printing them to debug log 2013-01-21 12:15:51 +01:00
Tobias Brunner ae82265a46 Add the ability to use a named pool for conftest configs 2013-01-21 11:46:20 +01:00
Martin Willi 1449e6dd55 Reseed rdrand after every 128bit sample only 2013-01-15 17:41:54 +01:00
Tobias Brunner 30abe1fd19 android: Properly escape apostrophes in Ukrainian translation 2013-01-14 17:23:52 +01:00
Tobias Brunner b9cda4f3e1 android: Implement kernel_net_t.get_interface via JNI 
This is now required to properly accept/install a virtual IP address.

Fixes #275.
 2013-01-14 17:22:56 +01:00
Tobias Brunner 53ce5c4c91 android: Moved chunk_from_byte_array and byte_array_from_chunk helper functions 2013-01-14 17:19:58 +01:00
Tobias Brunner ecff0e5685 android: Set OPENSSL_NO_CMS in Android.mk as it is not set in opensslconf.h on Android 2013-01-14 17:16:18 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Martin Willi c4a49008e8 Don't handle right=%any6 as "loose" identity, but as %any 2013-01-14 10:33:14 +01:00
Martin Willi 426f34baf9 Respect given address family when resolving "%any" 2013-01-14 10:26:12 +01:00
Tobias Brunner 37fb404833 Android.mk of libstrongswan updated 2013-01-14 09:16:33 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Martin Willi 54a1a75b2f Don't use bio_writer_t.skip() to write length field when appending more data 
If the writer reallocates its buffer, the length pointer might not be valid
anymore, or even worse, point to an arbitrary allocation.
 2013-01-11 14:57:08 +01:00
Martin Willi 2cd6c5115b Use raw opcodes for rdrand to build with older binutils 2013-01-11 10:45:14 +01:00
Martin Willi 19ae23452a Provide RNG_TRUE quality in rdrand by mixing reseeded outputs using AES 2013-01-11 10:45:14 +01:00
Martin Willi b9148ea232 Provide RNG_STRONG quality in rdrand by forcing PRNG reseed after every sample 2013-01-11 10:45:14 +01:00
Martin Willi 9fe24b004d Provide RNG_WEAK quality random generator in rdrand 2013-01-11 10:45:14 +01:00
Martin Willi ed8dc6f132 Add a rdrand plugin stub detecting availability of RDRAND instructions 2013-01-11 10:45:14 +01:00
Martin Willi 1954cc7720 Streamline debug output when receiving intermediate CA certificates in IKEv1 2013-01-11 10:24:23 +01:00
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Volker Rümelin 6d3e7a64a0 IKEv1 support for PKCS#7 wrapped certificates 2013-01-11 10:21:56 +01:00
Volker Rümelin 10eee5fcba Fixed some typos in comments 2013-01-11 10:21:51 +01:00
Pavel Kopchyk 3365bddccf Fixed some typos in Ukrainian translation 2013-01-09 05:30:55 +01:00
Thomas Klute 13c177852f conftest: Add support for time_format and ike_name options in log sections 
Both options are well supported for normal operation but were completely
ignored by conftest, which used hard coded defaults. File options are
still missing but could be added in a similar way.
 2013-01-08 11:12:44 +01:00
Thomas Klute b78698f755 conftest: Fix log level settings for stdout 
This patch fixes bug #272 ("conftest ignores log settings for stdout").
http://wiki.strongswan.org/issues/272

According to the documentation of add_logger in src/libcharon/bus/bus.h,
the relevant log levels of a logger are registered with the logging
subsystem when adding the logger. If the log levels change later, the
logger must be re-added to propagate the new settings. In conftest.c,
the stdout logger is initialized and added before reading the logging
settings, but wasn't re-added after reading the settings.
 2013-01-08 11:12:10 +01:00
Thomas Klute 4e51cf895e conftest: Make outgoing sequence number set by reset_seq configurable 
This is useful for certain test cases. Passing the sequence number to
the callback requires a new struct that contains both the number and the
xfrm_usersa_id. The new configuration parameter is called oseq in
accordance with the kernel name, see the comment in the reset_cb
callback function for details.
 2013-01-08 11:10:13 +01:00
Martin Willi ff318ad3e1 Include opensslconf.h before checking its defines 2013-01-03 11:12:05 +01:00
Martin Willi 2b9e597b54 Don't build OpenSSL PKCS#7 code if OPENSSL_NO_CMS defined 2013-01-03 11:05:49 +01:00