denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,132 Commits 1 Branch 0 Tags
70f44613597a32a16e79806670c254d2d5984e0b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 1cbe4e6ce4 tun-device: Include <linux/types.h> before <linux/if_tun.h> 
Fixes a build error on CentOS 6.4.
 2013-11-22 09:09:06 +01:00
Martin Willi 07ca25909b printf-hook-builtin: Don't use %P to print uppercase hex pointers 
We use %P as custom printf specifier for proposals.
 2013-11-20 16:57:28 +01:00
Martin Willi 27467a6881 Merge branch 'unit-tests' 
Replace the "check" based libstrongswan unit test framework with our own,
giving us more flexibility for our specific needs.

The new framework is more portable and uses complete libstrongswan init/deinit
cycles for each test to properly catch leaks. It fully supports multi-threaded
tests, and brings many of them for all threading primitives, watcher and
streams.

The --enable-unit-tests option is not required anymore for libstrongswan tests,
but still is for the still "check" based charon-tkm tests.
 2013-11-06 10:31:07 +01:00
Martin Willi 09d0c9030a unit-tests: Separate test runner to a library, reusable by other tests 
Other users may make use of the noinst libtest.la helper library to implement
unit tests. For libstrongswan, tests.[ch] provide the configuration for test
runner to perform unit tests in a simple manner.
 2013-11-06 10:31:07 +01:00
Martin Willi 5a3230a250 unit-tests: Use some include magic to define test suite constructors 
Avoid editing of several files when creating test suites by using a single
header file to define test suite constructor functions.
 2013-11-06 10:31:07 +01:00
Martin Willi d9d0eef92b unit-tests: Check printing of strings having zero length 2013-11-06 10:31:07 +01:00
Martin Willi 61934203e2 unit-tests: Add some basic tests if PRI* printf specifiers work as expected 2013-11-06 10:31:06 +01:00
Martin Willi a4cbda35ce unit-tests: Add a semaphore wait cancel test 2013-11-06 10:31:06 +01:00
Martin Willi fae1b85223 unit-tests: Add a semaphore absolute timed wait test 2013-11-06 10:31:06 +01:00
Martin Willi a14935ea4b unit-tests: Add a semaphore timed wait test case 2013-11-06 10:31:06 +01:00
Martin Willi ffab2e0c95 unit-tests: Add a simple semaphore test 2013-11-06 10:31:06 +01:00
Martin Willi b1bfe59560 unit-tests: Add a spinlock test case 2013-11-06 10:31:06 +01:00
Martin Willi 478dc0257c unit-tests: Add a rwlock condvar thread cancel test 2013-11-06 10:31:05 +01:00
Martin Willi b92c173b28 unit-tests: Add a rwlock condvar absolute timed wait test 2013-11-06 10:31:05 +01:00
Martin Willi af19213c54 unit-tests: Add a rwlock condvar wait test 2013-11-06 10:31:05 +01:00
Martin Willi 1032f52d68 unit-tests: Add a rwlock condvar broadcast test 2013-11-06 10:31:05 +01:00
Martin Willi f644b9e853 unit-tests: Add a rwlock condvar test 2013-11-06 10:31:05 +01:00
Martin Willi dac31fe1a0 unit-tests: Add a rwlock test case 2013-11-06 10:31:05 +01:00
Martin Willi 8b25b5c36f unit-tests: Add a condvar test where wait gets cancelled 2013-11-06 10:31:04 +01:00
Martin Willi b7db393d01 unit-tests: Add a condvar test working on a recursive mutex 2013-11-06 10:31:04 +01:00
Martin Willi 8699a32b74 unit-tests: Add a condvar absolute timed wait test 2013-11-06 10:31:04 +01:00
Martin Willi 31f9f777b3 unit-tests: Add a condvar timed wait test 2013-11-06 10:31:04 +01:00
Martin Willi 9a0a891e6b unit-tests: Add condvar broadcast test 2013-11-06 10:31:04 +01:00
Martin Willi 13183a74d4 unit-tests: Add a simple condvar test 2013-11-06 10:31:04 +01:00
Martin Willi 21df985148 unit-tests: Add a thread local storage cleanup test 2013-11-06 10:31:03 +01:00
Martin Willi 0b00e63e49 unit-tests: Add a thread local storage fuzzer test 2013-11-06 10:31:03 +01:00
Martin Willi fd26b7ff1b unit-tests: Add a thread cleanup pop test 2013-11-06 10:31:03 +01:00
Martin Willi 4aec0c5543 unit-tests: Add cleanup test cases for different thread exit situations 2013-11-06 10:31:03 +01:00
Martin Willi e5b34086f1 unit-tests: Add a test for thread_cancellation_point() 2013-11-06 10:31:03 +01:00
Martin Willi 49e6848bd0 unit-tests: Add thread cancellability testing 2013-11-06 10:31:03 +01:00
Martin Willi 855747eab7 unit-tests: Add a simple thread_cancel() test 2013-11-06 10:31:02 +01:00
Martin Willi c320c61160 unit-tests: Add thread_exit() tests to both join and detach test cases 2013-11-06 10:31:02 +01:00
Martin Willi 274e6beb00 unit-tests: Add a simple thread detach test 2013-11-06 10:31:02 +01:00
Martin Willi 5d4a882f45 unit-tests: Add a simple thread join() test 2013-11-06 10:31:02 +01:00
Martin Willi b942528419 unit-tests: Add test suite for streams and services 2013-11-06 10:31:02 +01:00
Martin Willi 8eda87af86 unit-tests: Add a few test cases for watcher 2013-11-06 10:31:02 +01:00
Martin Willi 23b8f9bf86 unit-tests: Support testing multi-threaded code 2013-11-06 10:31:01 +01:00
Martin Willi f23fd4c59b unit-tests: Use a home-brew thread barrier to remove pthread dependency 2013-11-06 10:31:01 +01:00
Martin Willi b74b8addf8 unit-tests: Show how many test vectors have failed on test failure 2013-11-06 10:31:01 +01:00
Martin Willi b4d43a542f unit-tests: Skip fmemopen() based printf() tests if not available 2013-11-06 10:31:01 +01:00
Martin Willi 45766923b8 unit-tests: Avoid name clash with clone() from <sched.h> 2013-11-06 10:31:01 +01:00
Martin Willi 1254ad01b9 unit-tests: Fix a compiler warning in identification tests 2013-11-06 10:31:01 +01:00
Martin Willi 382fa8b419 unit-tests: Clean up memory in new asn1 unit tests 
Test runner checks for leaks when leak detective is enabled.
 2013-11-06 10:31:00 +01:00
Martin Willi 712940d161 unit-tests: Pass linked_list->invoke* varargs as uintptr_t 
Passing integers of unspecified length may result in passing an integer shorter
than uintptr_t. When reading them back, we might get more data than passed,
resulting in a failure.
 2013-11-06 10:31:00 +01:00
Martin Willi f7b8396af0 unit-tests: Initialize backtracing before printing any backtraces 2013-11-06 10:31:00 +01:00
Martin Willi bbb62267e0 thread: Note that tread_cancellation_point temporarily activates cancelability 2013-11-06 10:31:00 +01:00
Martin Willi 7a13990964 backtrace: Support backtracing even if library is not initialized 
But of course backtracing must be initialized anyway using backtrace_init().
 2013-11-06 10:31:00 +01:00
Martin Willi a5860cddae unit-tests: Enable libstrongswan tests even if --enable-unit-tests not set 
As we don't depend on the check framework anymore, we can enable the unit tests
by default. These are built/executed with "make check" only, so it makes no
sense to disable them.
 2013-11-06 10:31:00 +01:00
Martin Willi 6531afb557 automake: Don't use parallel test harness being the default with automake 1.13 
We have no need for the parallel test harness, and we prefer to have the output
of make check on the console
 2013-11-06 10:30:59 +01:00
Martin Willi 35e8eb93a0 unit-tests: Implement testing framework without "check" 2013-11-06 10:30:59 +01:00
Martin Willi 56866ecf3d leak-detective: Call {gm,local}time_r() to allocate static buffer 
On OS X Mavericks, these functions use a static allocation and are hard
to whitelist using other means.
 2013-11-06 10:30:59 +01:00
Martin Willi ef6d78d6ef leak-detective: Register OS X specific hooks just once 
If we initialize libstrongswan more than once in the same process, we may
not register the hooks twice.
 2013-11-06 10:30:59 +01:00
Martin Willi f192526c3f leak-detective: Reset leak list during cleanup 
This resets leak detective state should it get created/destroyed more than once.
 2013-11-06 10:30:59 +01:00
Martin Willi a426851f63 leak-detective: Use callback functions to report leaks and usage information 
This is more flexible than printing reports to a FILE.
 2013-11-06 10:30:59 +01:00
Martin Willi 9ae1140118 unit-tests: Move test suites to its own subfolder 2013-11-06 10:30:58 +01:00
Martin Willi 10900ed7e7 charon-xpc: Set AUTH_RULE_IDENTITY_LOOSE on responder config 
This allows the server to use a different IKE identity as long as the
configured hostname is contained in the certificate.
 2013-11-01 12:05:48 +01:00
Martin Willi b76e96e2ef ike: Don't immediately DPD after deferred DELETEs following IKE_SA rekeying 
Some peers seem to defer DELETEs a few seconds after rekeying the IKE_SA, which
is perfectly valid. For short(er) DPD delays, this leads to the situation where
we send a DPD request during set_state(), but the IKE_SA has no hosts set yet.
Avoid that DPD by resetting the INBOUND timestamp during set_state().
 2013-11-01 11:33:29 +01:00
Martin Willi 7f4a13fffb identification: Properly check length before comparing for binary DN equality 
Fixes CVE-2013-6075.
 2013-10-31 21:57:07 +01:00
Martin Willi ed3eb62723 unit-tests: Additionally do reverse match checking with empty identities 2013-10-31 21:57:07 +01:00
Martin Willi e02b12e374 unit-tests: Test matching against some empty data identities 2013-10-31 21:57:07 +01:00
Martin Willi df12b3a61f unit-tests: Test for equality against some empty data identities 2013-10-31 21:57:07 +01:00
Martin Willi c409be2506 unit-tests: Let identity equality test fail if a->equals(b) != b->equals(a) 2013-10-31 21:57:07 +01:00
Martin Willi d402e87d16 whitelist: Read multiple commands until client closes connection 
This restores the same behavior we had before e11c02c8, and fixes the whitelist
add/remove-from command.
 2013-10-29 14:22:52 +01:00
Martin Willi 1ba47fa565 charon-xpc: Load missing eap-md5 plugin after enabling it 2013-10-28 15:18:11 +01:00
Martin Willi 9f2a4d3315 charon-xpc: Disable warnings about deprecated functions 
This avoids all the deprecated warnings when using OpenSSL functins.
 2013-10-28 14:51:59 +01:00
Martin Willi f5ea7d781f charon-xpc: Avoid -all_load linker flag 
This seems to be not required anymore with the LLVM 5 toolchain.
 2013-10-28 14:51:51 +01:00
Martin Willi a1c2ed8820 charon-xpc: Properly xpc_retain() connections we xpc_release() 2013-10-28 14:51:40 +01:00
Martin Willi 888d8d73ab charon-xpc: Properly cast SA identifier to uintptr representation 2013-10-28 14:51:28 +01:00
Martin Willi 3e40dbb128 charon-xpc: Don’t build against libvstr anymore 
We now have our own printf backend and use it instead of Vstr.
 2013-10-28 14:51:03 +01:00
Martin Willi 6a3cfbdc0d charon-xpc: Build with EAP-MD5 support 2013-10-28 14:49:19 +01:00
Martin Willi 9df621d21f utils: Fix check for fmemopen() fallback implementation 2013-10-24 15:58:49 +02:00
Martin Willi 8465514157 unit-tests: Set sa_len in sockaddr template data, if required 2013-10-24 15:37:21 +02:00
Martin Willi e71c57467c printf-hook-builtin: Don't rely on isinf() return value signedness 
Many systems don't return a negative value for negative infinities; so do
a separate check.
 2013-10-24 15:37:20 +02:00
Martin Willi 5ce3c9b15a watcher: Rebuild fdset when select() fails 
This should make sure we refresh the fdset if a user closes an FD it just
removed. Some selects() seem to complain about the bad FD before signaling the
notification pipe.
 2013-10-24 15:37:20 +02:00
Martin Willi 1a20a22d09 rwlock: Disable thread cancelability while waiting in (fallback) rwlock 
An rwlock wait is not a thread cancellation point. As a canceled thread
would not have released the mutex, the rwlock would have been left in unusable
state.
 2013-10-24 14:53:53 +02:00
Martin Willi 181d071363 rwlock: Don't use buggy pthread_rwlock on OS X 
Recursive read locks don't seem to work properly, at least on 10.9.
 2013-10-24 14:53:47 +02:00
Martin Willi 2077d996a9 utils: Provide a fmemopen(3) fallback using BSD funopen() 2013-10-24 13:17:05 +02:00
Martin Willi b08292a520 semaphore: Support cancellation in wait functions of semaphore fallback 
Semaphore wait functions should be a thread cancellation point, but did
not properly release the mutex in the fallback implementation.
 2013-10-23 16:08:40 +02:00
Martin Willi 47c76c1b05 rwlock: Re-acquire rwlock even if condvar wait times out 
A caller expects that the associated rwlock is held, whether the condvar
gets signaled or the wait times out.
 2013-10-23 11:52:26 +02:00
Martin Willi fc566632da unit-tests: support testing when leak-detective has not been enabled 2013-10-11 15:12:16 +02:00
Martin Willi 390d2b50b3 NEWS: Updates for the ah, libipsec-usestats and printf-hook merges 2013-10-11 11:42:13 +02:00
Martin Willi 5900d6d469 Merge branch 'printf-hook' 
Adds a custom printf hook implementation as a fallback if neither the glibc
style hooks nor vstr is available. This can avoid the Vstr dependency on some
systems at the cost of slower and less complete printf functions.
 2013-10-11 11:12:38 +02:00
Martin Willi 795cbb98c6 printf-hook-builtin: Print NaN/Infinity floating point values as such 2013-10-11 11:06:09 +02:00
Martin Willi 8af9bf70f5 printf-hook-builtin: Correctly round up floating point values 2013-10-11 11:06:09 +02:00
Martin Willi edc7a3d02f printf-hook-builtin: Add some preliminary floating point support 
This minimalistic implementation has no aspiration for completeness or
accuracy, and just provides what we need.
 2013-10-11 11:06:09 +02:00
Martin Willi 7e6a4cdc84 printf-hook-builtin: Support GNU %m specifier 2013-10-11 11:06:09 +02:00
Martin Willi cabe5c0ff4 printf-hook-builtin: Add a new "builtin" backend using its own printf() routines 
Overloads printf C library functions by a self-contained implementation,
based on klibc. Does not yet feature all the required default formatters,
including those for floating point values.
 2013-10-11 11:06:02 +02:00
Martin Willi ebca34d782 printf-hook: Add some basic printf() string/integer test functions 2013-10-11 11:05:37 +02:00
Martin Willi 243048248b printf-hook: Move glibc/vstr printf hook backends to separate files 2013-10-11 11:05:30 +02:00
Martin Willi 11282d0054 Merge branch 'libipsec-usestats' 
Brings SA usage statistics and volume based expiration to libipsec and the
associated kernel-libipsec plugin. Additionally removes any ESPv3 style TFC
padding found in incoming packets.
 2013-10-11 10:25:35 +02:00
Martin Willi d53002f088 libipsec: Enforce byte/packet lifetimes on SAs 2013-10-11 10:23:18 +02:00
Martin Willi 12fdc2b16b kernel-libipsec: Support ESPv3 TFC padding 2013-10-11 10:23:18 +02:00
Martin Willi 293515f95c libipsec: remove extra RFC4303 TFC padding appended to inner payload 2013-10-11 10:23:17 +02:00
Martin Willi d53f9b9637 kernel-libipsec: Support query_sa() to report usage statistics 2013-10-11 10:23:17 +02:00
Martin Willi b08967d6d8 libipsec: Support usage statistics and query_sa() on IPsec SAs 2013-10-11 10:23:17 +02:00
Martin Willi d7083b6541 kernel: Use a time_t to report use time in query_policy() 2013-10-11 10:23:17 +02:00
Martin Willi c99458e94e kernel: Use a time_t to report use time in query_sa() 2013-10-11 10:23:17 +02:00
Martin Willi b59bcba2b3 Merge branch 'ah' 
Brings support for Security Associations integrity protected by the
Authentication Header protocol, both to IKEv1 and IKEv2. Currently only plain
AH is supported, but no (now deprecated) RFC2401 style AH+ESP bundles.
 2013-10-11 10:15:43 +02:00
Martin Willi 5fdbb3c6ad ipsec.conf: Add a description for the new 'ah' keyword. 2013-10-11 10:15:22 +02:00
Martin Willi fa7815538f testing: Add an IKEv1 host2host AH transport mode test case 2013-10-11 10:15:22 +02:00