denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,011 Commits 1 Branch 0 Tags
71c9565a3a4935f6da55fcf74fd8ec8aafdd3df5
Commit Graph
2504 Commits
Author SHA1 Message Date
Martin Willi 7e3f6299d5 leak-detective: call tzset() explicitly before enabling leak detective 
tzset() is hard to whitelist on some systems, as there is no symbol involved.
Call tzset() explicitly before initialization to avoid false positives.
 2013-05-06 15:15:24 +02:00
Martin Willi 17211b6b9a leak-detective: override malloc functions instead of using deprecated hooks 
malloc hooks have become deprecated, and their use has always been problematic,
especially in multi-threaded applications. Replace the functionality by
overriding all malloc functions and query the system allocator functions
using dlsym() with RTLD_NEXT.
 2013-05-06 15:15:24 +02:00
Martin Willi f932677f0c Use the GEN silent rule when generating oid database with perl 2013-05-06 15:04:56 +02:00
Martin Willi 9f1dfd88c8 Use the GEN silent rule when generating gperf files 2013-05-06 15:04:56 +02:00
Tobias Brunner 2d7b55bf9b openssl: Define a default for FIPS_MODE 2013-05-03 15:11:19 +02:00
Martin Willi 9312fbc73d In memwipe_check(), don't put magic on stack when calling do_magic() 
Otherwise the magic might be on the stack while checking it.
 2013-05-03 14:17:37 +02:00
Martin Willi 1657b4ef26 Dump stack if memwipe() check fails 2013-05-03 11:41:51 +02:00
Martin Willi e6ba688a35 During libstrongswan initialization, check if memwipe() works as expected 2013-04-18 13:05:37 +02:00
Andreas Steffen f4de6496a2 support of OpenSSL FIPS-140-2 library 2013-04-16 12:37:04 +02:00
Martin Willi cf1696cab9 Allow SHA1_Init()/SHA1_Update() to fail if OpenSSL version >= 1.0 2013-04-10 18:10:30 +02:00
Martin Willi b52771fbb2 Check RSA_public_decrypt() length before constructing and comparing a chunk 
If decryption fails, it returns -1. chunk_equals() should catch that error,
but be more explicit in error checking.
 2013-04-10 18:10:30 +02:00
Martin Willi 97d975b7bb RSA_check_key() may return -1 if it fails 2013-04-10 18:10:30 +02:00
Martin Willi 96a09ce226 RAND_bytes/RAND_pseudo_bytes returns -1 if it is not supported by RAND method 2013-04-10 18:10:30 +02:00
Martin Willi 0faaab20cd Check return value of ECDSA_Verify() correctly 2013-04-10 18:10:30 +02:00
Tobias Brunner 53ac177cde Properly handle situation if no resolver plugins are loaded 2013-04-01 13:44:04 +02:00
Tobias Brunner 419a9a4fcd Make some private functions in plugins static 
Fixes monolithic build.
 2013-03-27 07:32:55 +01:00
Tobias Brunner d307be7f6c Add a method to replace all secrets in a mem_cred_t object 2013-03-20 15:27:34 +01:00
Tobias Brunner 5e551da16b Properly cleanup libmysql 
Seems to work correctly with recent MySQL versions.
 2013-03-19 16:33:07 +01:00
Martin Willi b4d172aa8e Add Altiga Private Enterprise Numbers that Cisco uses in VPN 3000 2013-03-12 20:31:10 +01:00
Tobias Brunner 2b1e2434e4 esc() is only used if dladdr(3) is available 2013-03-08 16:45:09 +01:00
Andreas Steffen 486f4b5838 added some otherNames OIDs 2013-03-06 11:50:32 +01:00
Martin Willi b668f1417d Don't invoke addr2line if dladdr() did not yield a filename 2013-03-04 15:50:21 +01:00
Martin Willi fe03f51302 backtrace_t.log() takes a NULL file pointer to log to registered dbg() hook 2013-03-04 15:45:03 +01:00
Martin Willi 8b24863b1f Don't use color escapes when printing backtraces to a non-TTY file 2013-03-04 15:07:03 +01:00
Martin Willi 4d17427205 Add a utility function to resolve TTY color escape codes dynamically 2013-03-04 15:04:56 +01:00
Andreas Steffen c88104aa25 make TNC Access Requestor ID available to IMVs 2013-03-03 17:18:09 +01:00
Andreas Steffen c9418d4fd3 added getpwuid_r and initgroups to whitelist 2013-03-03 09:04:49 +01:00
Tobias Brunner 11adf114c1 Fixed Doxygen comments after scanning complete src directory 2013-03-02 18:31:53 +01:00
Tobias Brunner 4c969f7906 openssl: The EVP GCM interface requires at least OpenSSL 1.0.1 2013-03-01 16:57:45 +01:00
Martin Willi e82deaf6ce Merge branch 'multi-cert' 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
 2013-03-01 11:35:32 +01:00
Martin Willi adf239abca Merge branch 'systime' 
Add a systime-fix plugin allowing an embedded system to validate certificates
if the system time has not been synchronized after boot. Certificates of
established tunnels can be re-validated after the system time gets valid.
 2013-03-01 11:33:47 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 53fcc70acc When running with an unprivileged user, initialize supplementary groups 2013-03-01 11:27:01 +01:00
Tobias Brunner 81f9cd39fd openssl: Provide AES-GCM implementation 2013-02-28 18:17:42 +01:00
Tobias Brunner a89ebab62e Fix cleanup in crypto_tester if AEAD implementation fails 2013-02-28 18:17:42 +01:00
Tobias Brunner 5f7f4fa398 Order of arguments in Doxygen comment fixed 2013-02-28 18:17:42 +01:00
Tobias Brunner 8656f35ae1 Fix auth_cfg_t.clone() for single-valued auth rules 
By using the default list enumerator and adding the rules with the public
add() method, clones of auth_cfg_t objects would return the values for
single-valued auth rules in the wrong order (i.e. the oldest instead of the
newest value was returned).  Using the internal enumerator (which the comment
already suggested) fixes this, but the clone will not be a full clone as
it does not contain any old values for single-valued auth rules.  Since
these will never be used anyway, this should be fine.
 2013-02-28 18:11:38 +01:00
Tobias Brunner bc07fef09c Use SIGUSR2 for SIG_CANCEL on Android 
SIGRTMIN is defined as 32 while sigset_t is defined as
unsigned long (i.e. holds 32 signals).  Hence, the signal
could never be blocked.  Sending the signal still canceled
threads, but sometimes in situations where they shouldn't
have been canceled (e.g. while holding a lock).

Fixes #298.
 2013-02-26 11:40:34 +01:00
Tobias Brunner 0ac34e9e6a Android.mk updated to latest Makefiles 
Fixes #300.
 2013-02-26 10:11:36 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi c572b5c8c1 Print OPAQUE traffic selectors as what they are, not as port range 2013-02-21 11:52:33 +01:00
Martin Willi 7b368af61a Support "opaque" ports in traffic selector subset calculation 2013-02-21 10:51:19 +01:00
Martin Willi 7dbe1feef1 Slightly refactor traffic_selector_t.get_subset() 2013-02-21 10:48:48 +01:00
Martin Willi de5d569b24 Migrate remaining traffic selector methods to METHOD macro 2013-02-21 10:28:21 +01:00
Tobias Brunner 0d237763dc openssl: Disable PKCS#7/CMS when building against OpenSSL < 0.9.8g 
Fixes #292.
 2013-02-20 18:34:54 +01:00
Martin Willi de399f550d Add a cert_validator hook allowing plugins to provide custom lifetime checking 2013-02-19 14:31:18 +01:00
Martin Willi 790e00aaa9 Make cert_validator_t.validate optional to implement 2013-02-19 14:31:18 +01:00
Andreas Steffen a4ddc0bb26 Encode RSA public keys in RFC 3110 DNSKEY format 2013-02-19 12:25:00 +01:00
Andreas Steffen f2145c8d3a Moved configuration from resolver manager to unbound plugin 
Also streamlined log messages in unbound plugin.
 2013-02-19 12:25:00 +01:00
Reto Guadagnini cfd07978d0 unbound: Implementation of query method of unbound_resolver_t 2013-02-19 11:57:21 +01:00