denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,397 Commits 1 Branch 0 Tags
5eb094df1103cc7d527c1b6c280f5b5e259e8b69
Commit Graph
352 Commits
Author SHA1 Message Date
Tobias Brunner 5eb094df11 proposal: Print all algorithms even those with currently unknown transform types 2018-03-05 12:05:36 +01:00
Tobias Brunner 0d06cbd66e unit-tests: Ignore binaries of renamed test runners 
Fixes: 9cc61baaf5 ("unit-tests: Rename targets for libstrongswan and kernel-netlink")
 2018-03-02 17:11:27 +01:00
Tobias Brunner c1c63a400e appveyor: Allow events to trigger early in threading unit tests 
The timed wait functions tested in the threading unit tests often but
randomly trigger a bit early on AppVeyor Windows containers.  We allow this
if it is not earlier than 5ms.
 2018-02-22 09:19:14 +01:00
Tobias Brunner d9c9b7b832 proposal: Add method to move a given DH group to the front 
This way a responder (like strongSwan) selecting a proposal first and
then checking if the KE payload matches sees the peer's preferred group
first.
 2018-02-09 10:20:05 +01:00
Eyal Birger 2389168388 ipsec-types: Don't mask the mark value if it is one of the 'unique' values 
Support for mark=%unique/%unique-dir is implemented by using designated
magic mark values.

Use of masks is orthogonal to the 'unique' feature, as it is useful to be
able to designate portions of the packet mark for other purposes, while
still using different marks for different connections.

When these magic values are masked, their magic meaning is lost.

Perform masking only on explicit mark values.

Closes strongswan/strongswan#87.
 2017-12-07 09:36:53 +01:00
Tobias Brunner 2307bffe56 proposal: Move proposal_t from libcharon to libstrongswan 
This allows us to use it without having to initialize libcharon, which
was required for the logging (we probably could have included debug.h
instead of daemon.h to workaround that but this seems more correct).
 2017-11-17 18:09:54 +01:00
Thomas Egerer 9cc61baaf5 unit-tests: Rename targets for libstrongswan and kernel-netlink 
libstrongswan and kernel-netlink are the only two components which do
not adhere to the naming scheme used for all other tests. If the tests
are run by an external application this imposes problems due to clashing
names.

Signed-off-by: Thomas Egerer <[email protected]>
 2017-11-09 09:11:42 +01:00
Tobias Brunner fde0c763b6 auth-cfg: Add RSA/PSS schemes for pubkey and rsa if enabled in strongswan.conf 
Also document the rsa/pss prefix.
 2017-11-08 16:48:10 +01:00
Tobias Brunner eae80fdedc signature-params: Add helpers to parse/build ASN.1 algorithmIdentifier for signature schemes 2017-11-08 16:48:10 +01:00
Tobias Brunner 6f97c0d50b ikev2: Enumerate RSA/PSS schemes and use them if enabled 2017-11-08 16:48:10 +01:00
Tobias Brunner 634c6ba8ce auth-cfg: Parse rsa/pss auth tokens 2017-11-08 16:48:10 +01:00
Tobias Brunner 54f8d09261 auth-cfg: Store signature schemes as signature_params_t objects 
Due to circular references the hasher_from_signature_scheme() helper
does not take a signature_params_t object.
 2017-11-08 16:48:10 +01:00
Tobias Brunner c2935b03c4 signature-params: Add helper struct for signature scheme and parameters 2017-11-08 16:48:10 +01:00
Tobias Brunner 414f255561 unit-tests: Add RSA-PSS signature tests with specific salts 2017-11-08 16:48:10 +01:00
Tobias Brunner fa7f5e2d0c unit-tests: Warn if we skip RSA tests due to dependencies 2017-11-08 16:48:10 +01:00
Tobias Brunner 4c5dd39aa3 unit-tests: Add ability to issue a warning message for a test case 
This way we can warn if we e.g. skipped actually doing something due to
dependencies (otherwise the test case would just appear to have succeeded).
 2017-11-08 16:48:10 +01:00
Tobias Brunner 00d161f2db unit-tests: Add FIPS 186-4 RSASSA-PSS test vectors 
Since not all implementations allow setting a specific salt value when
generating signatures (e.g. OpenSSL doesn't), we are often limited to
only using the test vectors with salt length of 0.

We also exclude test vectors with SHA-1, SHA-224 and SHA-384.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 89015dff9e unit-tests: Create and verify some RSA PSS signatures 2017-11-08 16:48:10 +01:00
Tobias Brunner a994407d50 unit-tests: Add FIPS 186-4 RSA test vectors 
Excluding SHA-224 and the stuff from FIPS 186-2 (SHA-1, 1024 bit keys).
 2017-11-08 16:48:10 +01:00
Tobias Brunner a22316520b signature-params: Add functions to parse/build ASN.1 RSASSA-PSS params 2017-11-08 16:48:10 +01:00
Tobias Brunner ffd0eeecf0 asn1: Add function to generate an ASN.1 integer from an uint64_t 2017-11-08 16:48:10 +01:00
Tobias Brunner de280c2e03 private-key: Add optional parameters argument to sign() method 2017-11-08 16:48:10 +01:00
Tobias Brunner a413571f3b public-key: Add optional parameters argument to verify() method 2017-11-08 16:48:10 +01:00
Tobias Brunner 43b59d1323 ikev2: Don't use SHA-1 for RFC 7427 signature authentication 
RFC 8247 demoted it to MUST NOT.

References #2427.
 2017-11-08 16:47:24 +01:00
Tobias Brunner b93ebb4ea9 utils: Add helper function to parse time spans from strings 2017-11-02 10:04:03 +01:00
Tobias Brunner 9cf2920512 traffic-selector: Use single buffer for both address families 
The generic field of size 0 in the union that was used previously
triggered index-out-of-bounds errors with the UBSAN sanitizer that's
used on OSS-Fuzz.  Since the two family specific union members don't
really provide any advantage, we can just use a single buffer for both
families to avoid the errors.
 2017-08-17 12:34:40 +02:00
Tobias Brunner ca280574ba Fixed some typos, courtesy of codespell 2017-08-07 17:22:01 +02:00
Tobias Brunner 95ecc11774 unit-tests: Double escape backslashes in Windows paths in settings test 
That's required when these are used as include paths in settings file
strings.
 2017-07-28 11:22:40 +02:00
Tobias Brunner 65064cc33b unit-tests: iv_gen_seq has a dependency on RNG_STRONG 
We currently don't have an RNG in Windows builds.
 2017-07-28 11:18:59 +02:00
Andreas Steffen f2f9edbbc0 unit-tests: Updated asn1-parser tests 2017-05-29 11:05:04 +02:00
Tobias Brunner 2e4d110d1e linked-list: Change return value of find_first() and signature of its callback 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 8a2e4d4a8b linked-list: Change interface of callback for invoke_function() 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 5cafea6edd linked-list: invoke_offset() doesn't take any additional arguments anymore 2017-05-26 13:56:44 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 2cbb2271aa unit-tests: Fix test_chunk_eq() if arguments have side-effects 2017-05-24 09:34:17 +02:00
Andreas Steffen cfdccc93f5 utils: chunk_from_hex() skips optional 0x prefix 2017-03-06 18:54:09 +01:00
Tobias Brunner 2283c8148a host: Don't log port if it is zero 2017-03-02 08:27:30 +01:00
Tobias Brunner 2e52bbb4b2 traffic-selector: Allow calling set_address() for any traffic selector 
Users may check is_host(), is_dynamic() or includes() before calling this
if restrictions are required (most actually already do).
 2017-02-27 18:21:02 +01:00
Thomas Egerer 8a0bbb9355 unit-tests: Allow default test timeout to be configured via compile option 
Signed-off-by: Thomas Egerer <[email protected]>
 2017-02-14 10:41:42 +01:00
Andreas Steffen 4f19112b1f Moved Ed25519 tests to libstrongswan 2016-12-14 11:57:36 +01:00
Andreas Steffen e9c2b6658b unit-tests: Completed coverage of hasher, crypter and libnttfft 2016-12-14 11:15:48 +01:00
Andreas Steffen 40f2589abf gmp: Support of SHA-3 RSA signatures 2016-09-22 17:34:31 +02:00
Tobias Brunner 11140e717f unit-tests: MGF1 tests depend on an XOF implementation not just a hash function 
If the mgf1 plugin was not enabled (e.g. with the default configure
options) the tests failed.
 2016-09-21 18:36:28 +02:00
Andreas Steffen 188b190a70 mgf1: Refactored MGF1 as an XOF 2016-09-21 06:40:52 +02:00
Tobias Brunner b104b2a737 unit-tests: Defining TESTS_RUNNERS allows to only run specific test runners 2016-06-17 18:48:01 +02:00
Martin Willi 518a5b2ece configure: Check for and explicitly link against -latomic 
Some C libraries, such as uClibc, require an explicit link for some atomic
functions. Check for any libatomic, and explcily link it.
 2016-06-14 14:27:20 +02:00
Tobias Brunner b82b5f6398 chunk: Skip all leading zero bytes in chunk_skip_zero() not just the first 2016-04-04 15:39:42 +02:00
Tobias Brunner 85597f2983 string: Gracefully handle NULL in str*eq() macros 2016-04-04 10:43:46 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Andreas Steffen 1d86d1d65a Implemented IPv4/IPv6 subnet and range identities 
The IKEv1 IPV4_ADDR_SUBNET, IPV6_ADDR_SUBNET, IPV4_ADDR_RANGE and
IPV6_ADDR_RANGE identities have been fully implemented and can be
used as owners of shared secrets (PSKs).
 2016-03-10 13:59:37 +01:00