denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,482 Commits 1 Branch 0 Tags
757e00c0aef8fa1af36889235784872e5c3fcc39
Commit Graph
50 Commits
Author SHA1 Message Date
Tobias Brunner 4b468126ca traffic-selector-list: Add helper class to manage a collection of TS 
Provides functions to optionally resolve dynamic TS and to narrow
them based on a list of supplied TS.
 2025-05-28 11:06:19 +02:00
Tobias Brunner f462e4b9ee traffic-selector: Add workaround for possibly bogus warning with GCC 14 
When compiling with -O3 with GCC 14, we get the following warning/error:

/usr/include/x86_64-linux-gnu/bits/string_fortified.h:29:10: error: '__builtin_memcpy' offset [0, 3] is out of the bounds [0, 0] [-Werror=array-bounds=]
   29 |   return __builtin___memcpy_chk (__dest, __src, __len,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   30 |                                  __glibc_objsize0 (__dest));
      |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~

Which seems completely bogus as that array has a fixed size of 16 and
some weird workarounds remove the warning (e.g. adding an assignment
to `subset->netbits` before the `memcpy()`).  This is also the only
place GCC complains about and we use `memcpy()` all over the place
in this file to set those addresses.

Closes strongswan/strongswan#2509
 2024-11-22 14:31:13 +01:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Tobias Brunner d71d181d28 traffic-selector: Add TS_SECLABEL type 2022-04-14 18:42:01 +02:00
Tobias Brunner 2dd60e4946 sec-label: Add enum for security label mode 2022-04-14 18:42:01 +02:00
Tobias Brunner decfe44433 sec-label: Add class to represent security labels 
In accordance with SELinux, we include the null-terminator in the encoding
for now.
 2022-04-14 18:42:01 +02:00
Tobias Brunner 3c028686de traffic-selector: Avoid out-of-bound array access when calculating range 
This happens for `/0` subnet masks.  In practice, it's not an issue because
if `bytes` is 0, then so are `netbits`, `bits` and `mask`.  So the two
incorrectly addressed array elements are not actually modified.  The first
operation is a `&= 0xff` and the second a `|= 0`, so nothing changes.
But some tools might not consider the values and report this as undefined
behavior, which it technically is.
 2022-03-16 11:54:34 +01:00
Tobias Brunner 784d96e031 Fixed some typos, courtesy of codespell 2018-09-17 18:51:44 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner a36d8097ed traffic-selector: Always print protocol if either protocol or port is set 
This helps to distinguish between port and protocol if only one of them
is set.  If no protocol is set it's printed as 0, if the traffic
selector covers any port (0-65535) the slash that separates the two values
and the port is omitted.
 2018-04-11 12:31:31 +02:00
Tobias Brunner 9cf2920512 traffic-selector: Use single buffer for both address families 
The generic field of size 0 in the union that was used previously
triggered index-out-of-bounds errors with the UBSAN sanitizer that's
used on OSS-Fuzz.  Since the two family specific union members don't
really provide any advantage, we can just use a single buffer for both
families to avoid the errors.
 2017-08-17 12:34:40 +02:00
Tobias Brunner 2e52bbb4b2 traffic-selector: Allow calling set_address() for any traffic selector 
Users may check is_host(), is_dynamic() or includes() before calling this
if restrictions are required (most actually already do).
 2017-02-27 18:21:02 +01:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner ebeb8c87c5 traffic-selector: Don't end printf'ed list of traffic selectors with a space 2015-11-10 12:13:06 +01:00
Tobias Brunner fe2443b01c traffic-selector: Use calc_netbits() in RFC 3779 constructor 
This properly detects prefixes encoded as ranges.
 2015-08-27 11:47:36 +02:00
Martin Willi 6d4649573e traffic-selector: Add a hash() method 2015-02-20 13:34:48 +01:00
Martin Willi 373a147fed traffic-selector: Add a compare function to sort traffic selectors 2015-02-20 13:34:48 +01:00
Martin Willi 922ee2c529 windows: Add a common Windows header for platform specific wrappers 
Include some more basic system headers in utils.h, so we can use that common
header on the different platforms.
 2014-06-03 12:24:34 +02:00
Tobias Brunner 000235f1c5 traffic-selector: Print ICMP[v6] message type and code in a more readable way 2013-10-17 16:57:39 +02:00
Tobias Brunner 4bebe45abb traffic-selector: Store ICMP[v6] message type and code properly 
We now store them as defined in RFC 4301, section 4.4.1.1.
 2013-10-17 16:57:39 +02:00
Tobias Brunner d6a1960d34 traffic-selector: Move class to its own Doxygen group 2013-10-17 16:57:38 +02:00
Martin Willi 21bade294b traffic-selector: inet_pton is successful only if it returns 1 2013-05-16 11:01:27 +02:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi c572b5c8c1 Print OPAQUE traffic selectors as what they are, not as port range 2013-02-21 11:52:33 +01:00
Martin Willi 7b368af61a Support "opaque" ports in traffic selector subset calculation 2013-02-21 10:51:19 +01:00
Martin Willi 7dbe1feef1 Slightly refactor traffic_selector_t.get_subset() 2013-02-21 10:48:48 +01:00
Martin Willi de5d569b24 Migrate remaining traffic selector methods to METHOD macro 2013-02-21 10:28:21 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 2e7cc07ecd Moved host_t and host_resolver_t to a new networking subfolder 2012-10-24 15:06:18 +02:00
Martin Willi fd6c0c8fb4 Add a traffic selector constructor creating a TS directly from a CIDR string 2012-10-24 13:25:02 +02:00
Tobias Brunner 4a4d20de9d Allow calls to set_address() for any host-sized TS, not only dynamic ones 
This fixes CHILD_SA updates (e.g. due to MOBIKE), which were broken
since 4cb0783.
 2012-09-12 18:14:01 +02:00
Martin Willi 4cb0783f3c Don't return a subset for a dynamic TS unless set_address has been called 2012-09-11 16:18:28 +02:00
Tobias Brunner 305d98b780 Validate netmask in traffic_selector_create_from_subnet 
Fixes #216.
 2012-08-13 13:46:19 +02:00
Martin Willi 1b40b74de0 Pass opaque data to printf hooks and print_in_hook() 2012-07-13 13:23:29 +02:00
Martin Willi 997fdd1f02 Accept non-"/0" subnet sizes for traffic selectors starting at 0.0.0.0 2012-07-02 17:25:26 +02:00
Martin Willi 764ee21d83 ts.get_subnet() returns TRUE if the selector actually is a subnet 2012-03-20 17:30:44 +01:00
Andreas Steffen 21ce22bb24 cosmetics 2011-10-02 12:09:55 +02:00
Andreas Steffen 79838a7205 Migrated traffic_selector to INIT/METHOD macros 2011-10-02 11:52:52 +02:00
Tobias Brunner e26304348c Replaced simple iterator usages. 2011-07-06 09:43:45 +02:00
Andreas Steffen abc2443a38 fixed IP range to subnet conversion in ts_to_subnet() 2011-06-03 00:24:16 +02:00
Martin Willi 64e06d4f8f Compare ending address in ts->equals, fixes redundant traffic selector elimination 2011-01-14 13:24:08 +01:00
Tobias Brunner d7e977aced Fixed some Doxygen warnings. 2010-03-24 15:45:06 +01:00
Andreas Steffen 925eadba5f do not recalculate netbits for true subnets 2009-12-22 17:07:08 +01:00
Andreas Steffen 7686f981a4 cosmetics 2009-12-22 09:53:53 +01:00
Andreas Steffen 194c3cedc5 fixed IPv6 bug in calc_range() 2009-12-22 00:49:23 +01:00
Andreas Steffen 3f4d8815a4 fixed initialization of netbits 2009-12-21 23:03:14 +01:00
Andreas Steffen 157125e4c9 traffic_selector supports RFC 3779 address range format 2009-12-21 21:29:01 +01:00
Andreas Steffen 678aab7850 this->type is set by traffic_selector_create() 2009-12-20 20:01:18 +01:00
Andreas Steffen 1125a0be81 moved traffic_selectors from charon to libstrongswan 2009-12-20 14:57:38 +01:00