denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,235 Commits 1 Branch 0 Tags
6055e347f864ce54610a7f6d84d5304b1fc40a1f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 6055e347f8 testing: Add ikev2/compress-nat scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 1fde30cc23 testing: Enable firewall for ikev2/compress scenario 
Additionally, send a regular (small) ping as the kernel does not
compress small packets and handles those differently inbound.
 2014-01-23 10:27:13 +01:00
Tobias Brunner fe2a2d1885 kernel-netlink: Set selector on transport mode IPComp SAs 2014-01-23 10:27:13 +01:00
Tobias Brunner cc04a6db3e kernel-netlink: Selectively add selector on SAs that use IPComp 
Don't add a selector to tunnel mode SAs, these might serve multiple
traffic selectors but with only one selector on the SA only the traffic
matching the first one would actually get tunneled.
 2014-01-23 10:27:12 +01:00
Tobias Brunner 7e3bbcf77a updown: Increase buffer size for script and environment variables 2014-01-23 10:27:12 +01:00
Tobias Brunner 6d1198e71d updown: Allow IPIP traffic if IPComp was negotiated 
The kernel implicitly creates an IPIP SA if an IPComp SA is installed.
This SA is used inbound for small packets that are not compressed.

Since the addresses are different (they are the tunnel addresses not
those of the tunneled traffic) additional rules are required if the
traffic selector does not cover the tunnel addresses (e.g. due to a NAT).

For SAs with multiple traffic selectors duplicate rules will get installed.
 2014-01-23 10:27:12 +01:00
Tobias Brunner cf4a7395aa updown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated 2014-01-23 10:27:12 +01:00
Tobias Brunner 72a92d4f7d curl: Replace spaces in URIs with %20 
cURL requires the URIs to be URL-encoded. Apparently, some CAs encode CRL
URIs with spaces in them.

Fixes #454.
 2014-01-23 10:19:30 +01:00
Tobias Brunner ccb6758e5b utils: Add strreplace function 2014-01-23 10:18:23 +01:00
Tobias Brunner f44b1eb444 stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated 
Otherwise a malicious user could send an unterminated string to cause
unterminated reads.
 2014-01-23 10:15:07 +01:00
Tobias Brunner 5ab03863b0 stroke: Add an option to prevent log level changes via stroke socket 2014-01-23 10:15:07 +01:00
Tobias Brunner 040cf911a6 pki: Make sure no command registers too many options 2014-01-23 10:12:24 +01:00
Tobias Brunner 079e6c2b04 pki: Increase MAX_COMMANDS to cover all currently available commands 
Fixes #452.
 2014-01-23 10:12:15 +01:00
Tobias Brunner 2b8224fce3 pki: Print a warning if MAX_COMMANDS is too low 2014-01-23 10:10:53 +01:00
Tobias Brunner b0e14fcba6 pki: Properly use ?: when defining option arrays 2014-01-23 10:10:53 +01:00
Tobias Brunner 2d7852d29a configure: Add -Wno-format-security to default CFLAGS 
Either due to a change in Ubuntu 13.10 or GCC 4.8 -Wno-format has no
effect if -Wformat-security is enabled (which it is on Ubuntu) so we
also disable the latter by default.
 2014-01-23 10:08:53 +01:00
Tobias Brunner 54ca25800c agent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket 
This is also required if charon-cmd is used with capability dropping.
 2014-01-23 10:08:23 +01:00
Tobias Brunner 53d2164c5d ike: Simplify error handling if name resolution failed 
This avoids a second name resolution attempt just to determine if %any
etc. was configured.

Fixes #440.
 2014-01-23 10:04:19 +01:00
Tobias Brunner be8af56e7a ike: Use proper hostname(s) when name resolution failed 
Was wrong since 0edce68767.

Fixes #440.
 2014-01-23 10:03:50 +01:00
Tobias Brunner 72ffb20318 ikev2: Wipe (optional) shared secret during CHILD_SA key derivation 2014-01-23 09:54:18 +01:00
Tobias Brunner e465c006e5 checksum must be the last subdir included 
Otherwise charon-cmd will not yet be installed when the checksums are
calculated (now from the install dir, not the build dir).

Fixes #496.
 2014-01-23 09:43:45 +01:00
Tobias Brunner a40c66194e checksum: Read executables from DESTDIR 
This allows to recreate the checksums after the installed binaries have
been modified e.g. with strip.

Fixes #491.
 2014-01-21 14:53:46 +01:00
Tobias Brunner 303ec3956c unit-tests: Add environment variable to reduce the number of generated keys 
If TESTS_REDUCED_KEYLENGTHS is set RSA and ECDSA keys are only generated
for the lowest configured key length.

Fixes #474.
 2014-01-20 15:40:15 +01:00
Tobias Brunner 3d097e1024 unit-tests: Generate RSA key with 768 bits not 786 2014-01-20 15:40:09 +01:00
Tobias Brunner 2ff62bee04 checksum: Set rpath including DESTDIR for checksum_builder 
This way libraries to which checksum_builder does not itself link,
like libtls and libradius, are found during DESTDIR installs.

Fixes #476.
 2014-01-08 11:24:24 +01:00
Tobias Brunner 94e10f15e5 test-asn1: Fix skipping of >2038 tests on i386 
The two constants overflow time_t on i386 (they also produced a compiler
warning without type suffix) so the comparison with TIME_32_BIT_SIGNED_MAX
did not work as intended.

Fixes #477.
 2014-01-06 18:23:40 +01:00
Tobias Brunner d62a6ec3f9 chunk: Fix chunk_mac/hash tests on big-endian systems 
Our SipHash-2-4 implementation returns the result in host order, while
the test vectors are little-endian.  Use a custom comparison function to
account for this.

Fixes #478.
 2014-01-06 17:31:07 +01:00
Tobias Brunner 13f2d3a2f6 utils: Fix %T printf hook on big-endian systems 
The cast to a bool* cut of the actual value on big-endian systems
if bool was shorter than int because the bool argument to printf gets
promoted to an int.

Fixes #479.
 2014-01-06 15:30:02 +01:00
Tobias Brunner 0773c7fd71 checksum: Delay building of checksum_builder until required by make install 
This ensures PLUGINDIR includes any DESTDIR set during make install.
 2014-01-06 14:38:34 +01:00
Tobias Brunner 5d826357b8 checksum: Remove unnecessary pluto symbol 2014-01-06 13:37:12 +01:00
Tobias Brunner 261fd9d33b stroke: Fix error message if parsing leftsourceip fails 2014-01-06 12:55:45 +01:00
Tobias Brunner bfa2201537 tun-device: Include system headers before our own 
On CentOS 6.5 the sys/capability.h header file defines _LINUX_TYPES_H
without actually including that header, preventing its later inclusion
here.

As library.h (via which the capabilities headers are included) is not
actually required in tun_device.[ch], moving the inclusion of tun_device.h
would not strictly be necessary.  But it's probably a good idea to
include our own headers after system headers anyway, for if one of the
recursively included files at a later point includes library.h we'd have
the same problem again.
 2013-12-20 11:33:16 +01:00
Tobias Brunner 7c4629060a aes-test: Fix compiler warnings from older versions of GCC 2013-12-19 11:02:23 +01:00
Tobias Brunner f1e12da7ef unit-tests: Don't use priority for destructor that unregisters testable functions 
This fixes coverage reports, at least if leak detective is disabled.
If it is enabled the plugins are not unloaded so the destructor is not
executed until the process is destroyed, which seems not to be covered
by gcov.
 2013-12-04 20:33:00 +01:00
Tobias Brunner d5a0abfa92 unit-tests: Export ntru_drbg_create as testable function so no linking is required 
This way the plugin does not have to be linked explicitly to the test
runner, which otherwise would require that the plugin is either always
enabled to build the tests or that ifdefs are added to the Makefile.
 2013-12-04 20:32:59 +01:00
Tobias Brunner 4cea186b64 unit-tests: Add facility to register testable functions 
These can be defined in plugins, or other parts of the tested libraries.
They can even be static.
 2013-12-04 20:32:59 +01:00
Tobias Brunner a24eec4649 unit-tests: Move ntru_test_rng_t to a utility class in libtest 2013-12-04 20:32:59 +01:00
Tobias Brunner 6354466a5b unit-tests: Fix apidoc for libtest 2013-12-04 20:32:59 +01:00
Tobias Brunner 3e8a44c2aa ntru: Fix compiler warning caused by ++/-- on righthand side of an assignment 
The behavior of stuff like x = --x; (or x++) is not defined.
 2013-12-04 20:32:59 +01:00
Tobias Brunner 7c7148b038 ike: Log SK_p consistently on level 4 2013-11-28 19:04:47 +01:00
Tobias Brunner e9b49d412b Merge branch 'nm-psk' 
This adds support for PSK authentication to the NetworkManager frontend.
 2013-11-27 18:37:11 +01:00
Tobias Brunner 0b506edb19 nm: Require the PSK to be at least 20 characters long 2013-11-27 18:36:58 +01:00
Tobias Brunner 692a421aa0 nm: German translation updated 2013-11-27 18:36:58 +01:00
Tobias Brunner 5ae822cfcd nm: Handle PSK option in NM backend 2013-11-27 18:36:58 +01:00
Tobias Brunner 594878e552 nm: Add PSK option to auth-dialog 2013-11-27 18:36:58 +01:00
Tobias Brunner 63528ebd3f nm: Add pre-shared key option in GUI 2013-11-27 18:36:58 +01:00
Tobias Brunner cfaec93111 nm: Make intltool recognize glade files properly 2013-11-27 18:36:58 +01:00
Tobias Brunner 228db0433d configure: Remove obsolete --enable-unit-tests option 2013-11-27 18:35:44 +01:00
Tobias Brunner f5feeb04f3 charon-tkm: Don't run tests automatically during 'make check' 
Due to the external dependencies these tests are quite inconvenient.
They can be run from the charon-tkm directory with 'make check-tkm'.
 2013-11-27 18:35:44 +01:00
Tobias Brunner d6032bff8b charon-tkm: Migrate tests to our own test runner 
Due to problems with the external libraries tkm_init/deinit can't be
called for each test case.  Because of this leak detective has to be
disabled for these tests.
 2013-11-27 18:35:44 +01:00
Tobias Brunner 70f4461359 charon-tkm: Support for out-of-tree build added 2013-11-27 18:35:44 +01:00
Tobias Brunner 20a48e4be3 chunk: Fix signedness warnings caused by chunk_from_* macros 
There are countless other such warnings because e.g. chunk_create() is called
with char*, but at least we prevent users from causing such warnings
inadvertently when using these macros.
 2013-11-27 18:28:44 +01:00
Tobias Brunner c61ca66a39 trap-manager: Reset IKE_SA on bus_t if initiating fails 2013-11-21 13:43:31 +01:00
Tobias Brunner bb492d80b5 trap-manager: Prevent deadlock when installing trap policies 
Because the write lock was held while calling add_policies() on
child_sa_t, which finishes with a call to child_state_change() on bus_t,
a deadlock would ensue if CHILD_SAs are concurrently being established,
which also causes a call to child_state_change() that will require
the read lock in trap_manager_t.

No locks are now being held while creating the CHILD_SA and installing the
trap policies.
 2013-11-21 11:12:59 +01:00
Tobias Brunner 906a4fd16b coverage: Report branch coverage 2013-11-21 11:10:39 +01:00
Tobias Brunner 8071c2a5e3 testing: Config for Linux kernel 3.12 
The most significant change is that CONFIG_ACPI_PROC_EVENT is now
finally removed (after being deprecated for a long time).

So to successfully shutdown the guests via ACPI the CONFIG_INPUT_EVDEV
option is now enabled.
 2013-11-19 17:15:12 +01:00
Tobias Brunner 3bff80aee3 openssl: Verify that a peer's ECDH public value is a point on the elliptic curve 
This check is mandated by RFC 6989.  Since we don't reuse DH secrets,
it is mostly a sanity check.
 2013-11-19 15:00:28 +01:00
Tobias Brunner 38a4f1964e kernel-netlink: Enable TFC padding only for tunnel mode ESP SAs 
The kernel does not allow them for transport mode SAs or IPComp SAs (and
of course not for AH SAs).

Fixes #446.
 2013-11-19 12:44:16 +01:00
Tobias Brunner 85adb98daf android: New release based on 5.1.1 
This fixes issues with IVs and padding in ESP handling and removes the
Vstr dependency.
 2013-11-13 17:41:24 +01:00
Tobias Brunner 20c99edab9 android: Remove dependency on libvstr 2013-11-13 11:40:47 +01:00
Tobias Brunner 334f44cd29 unit-tests: Initialize tests with a callback 2013-11-06 10:31:07 +01:00
Tobias Brunner 8d2450d8b8 plugin-loader: Convenience function added to add plugin dirs in build tree 2013-11-06 10:31:07 +01:00
Tobias Brunner c49c3f3208 ikev2: Properly free DH secret in case of errors during IKE key derivation 
Fixes #437.
 2013-11-06 10:24:19 +01:00
Tobias Brunner 19046552b6 ipsec: Updated ipsec(8) 2013-10-29 17:22:45 +01:00
Tobias Brunner 71687f4fad ipsec: Remove unused distro.txt 2013-10-29 16:34:10 +01:00
Tobias Brunner 5ac29360fc utils: Include stdio.h for fmemopen() replacement 
This might now be required because Vstr is not necessarily required
anymore, which means stdio.h might not be pulled in by prinf_hook.h.
 2013-10-29 16:18:35 +01:00
Tobias Brunner 60ddf6284f Use exact mask when calling umask(2) 
Due to the previous negation the high bits of the mask were set, which
at least some versions of the Android build system prevent with a compile-time
check.
 2013-10-29 16:01:55 +01:00
Tobias Brunner 348b9d82b4 libtnccs: Add dummy entry to pb_tnc_tcg_msg_infos 
That's required because the first message type in pb_tnc_tcg_msg_type_t
is 1 not 0.
 2013-10-29 13:36:15 +01:00
Tobias Brunner 751670a93b swid: Properly clean up after reading SWID tag 2013-10-29 13:18:05 +01:00
Tobias Brunner bb49dfb02e man: strongswan.conf(5) updated 2013-10-29 11:45:25 +01:00
Tobias Brunner 1dd58b0e21 Fixed some typos 2013-10-29 11:44:23 +01:00
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner 46cded2627 chunk: Add helper function to create a chunk from data read from a file descriptor 2013-10-23 17:20:39 +02:00
Tobias Brunner 8e8e97d10d kernel-netlink: Check existence of linux/fib_rules.h, don't include it in distribution 
This reverts commit b0761f1f0a.
 2013-10-18 09:52:54 +02:00
Tobias Brunner 3ea7165a27 Merge branch 'icmp' 
Improves handling of ICMP[v6] traffic selectors that specify message type and
code.

Fixes #421.
 2013-10-17 16:59:07 +02:00
Tobias Brunner 6956061197 ipsec.conf.5: Note about ICMP[v6] message type/code added 2013-10-17 16:57:39 +02:00
Tobias Brunner 4c185d11ad updown: Properly configure ICMP[v6] message type and code in firewall rules 2013-10-17 16:57:39 +02:00
Tobias Brunner 9739a0bf67 updown: Pass ICMP[v6] message type and code to updown script 
The type is passed in $PLUTO_MY_PORT and the code in $PLUTO_PEER_PORT.
 2013-10-17 16:57:39 +02:00
Tobias Brunner 59213396fa kernel-pfkey: Install ICMP[v6] type/code as expected by the Linux kernel 2013-10-17 16:57:39 +02:00
Tobias Brunner 406a504ca7 kernel-netlink: Convert ports in acquires to ICMP[v6] type and code 2013-10-17 16:57:39 +02:00
Tobias Brunner ddc2d3c8e4 kernel-netlink: Properly install policies with ICMP[v6] types and codes 2013-10-17 16:57:39 +02:00
Tobias Brunner 000235f1c5 traffic-selector: Print ICMP[v6] message type and code in a more readable way 2013-10-17 16:57:39 +02:00
Tobias Brunner 4bebe45abb traffic-selector: Store ICMP[v6] message type and code properly 
We now store them as defined in RFC 4301, section 4.4.1.1.
 2013-10-17 16:57:39 +02:00
Tobias Brunner d6a1960d34 traffic-selector: Move class to its own Doxygen group 2013-10-17 16:57:38 +02:00
Tobias Brunner 5eb802ab18 Merge branch 'ecc-brainpool' 
Adds support for ECC Brainpool curves for DH exchanges.
 2013-10-17 16:56:31 +02:00
Tobias Brunner 7313499914 proposal: Add ECC Brainpool DH groups to the default proposal 2013-10-17 13:36:09 +02:00
Tobias Brunner 606aae3aa1 openssl: Add workaround if ECC Brainpool curves are not defined 2013-10-17 13:36:08 +02:00
Tobias Brunner 3c29d2822f openssl: Add support for ECC Brainpool curves for DH, if defined by OpenSSL 
OpenSSL does not include them in releases before 1.0.2.
 2013-10-17 13:36:08 +02:00
Tobias Brunner be97277bdb unit-tests: Make test for bio_writer_t more portable 2013-10-17 11:44:03 +02:00
Tobias Brunner f6cadb7f54 libipsec: Don't print ciphertext with ICV in log message 2013-10-17 11:43:58 +02:00
Tobias Brunner f5c5fd6f74 libipsec: Properly calculate padding length especially for AES-GCM 2013-10-17 11:42:45 +02:00
Tobias Brunner 812ae898bf utils: Add utility function to calculate padding length 2013-10-17 10:25:34 +02:00
Tobias Brunner 32fef0c6e9 stroke: Reuse reqids of established CHILD_SAs when routing connections 2013-10-17 10:23:32 +02:00
Tobias Brunner 6278e64230 trap-manager: Make sure a config is not trapped twice 2013-10-17 10:23:32 +02:00
Tobias Brunner dd438ee22c Doxygen fixes 2013-10-15 11:25:55 +02:00
Tobias Brunner d14ba7e7fd testing: Add libipsec/host2host-cert scenario 2013-10-11 18:04:48 +02:00
Tobias Brunner d9020264f4 checksum: The pool utility was moved to its own directory 2013-10-11 17:42:29 +02:00
Tobias Brunner 0f6f7ba22c ccm: Add missing comma in get_iv_gen method signature 2013-10-11 17:42:25 +02:00
Tobias Brunner bfeb8b5c47 iv-gen: Add missing header files to Makefile.am 2013-10-11 17:42:05 +02:00
Tobias Brunner 1c1ba803ac NEWS: Updates for the recent merges 2013-10-11 16:20:41 +02:00