denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,124 Commits 1 Branch 0 Tags
80d9a9b722bad15597ab44bc73a09743139cd304
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 80d9a9b722 Added tests for utils/enum.c 2013-06-11 11:03:13 +02:00
Tobias Brunner 9947a1f2f4 Gracefully handle NULL as argument for enum_from_name() 2013-06-11 11:03:13 +02:00
Tobias Brunner 06f6d80245 Additional tests for identification_t added 2013-06-11 11:03:13 +02:00
Tobias Brunner b1abf22bd0 Fail DN parsing if OID is unterminated 
This is the case if the last OID is not followed by a = or if the string
starts with a =.
 2013-06-11 11:03:12 +02:00
Tobias Brunner f00c350688 Fix DN printing if last RDN has an empty value 2013-06-11 11:03:12 +02:00
Tobias Brunner 10584df24f Fix DN parsing if last RDN has an empty value 2013-06-11 11:03:12 +02:00
Tobias Brunner c04498b608 Fix output of ASN.1 GN 2013-06-11 11:03:12 +02:00
Tobias Brunner 78c37de15a Use chunk_from_str in identification_from_string 
We always have a non-empty string in those cases as "" is now handled
as ID_ANY.
 2013-06-11 11:03:12 +02:00
Tobias Brunner c1be5d66cd Use local variable in chunk_from_str() 
This allows using strdup() or other string functions as argument
without calling them twice.
 2013-06-11 11:03:12 +02:00
Tobias Brunner 456a31e895 Parse empty string as ID_ANY 2013-06-11 11:03:12 +02:00
Tobias Brunner af67613ed6 Added tests for utils/utils.[ch] 2013-06-11 11:03:12 +02:00
Tobias Brunner 7b91011d6e Allow memstr() to be called with NULL arguments 2013-06-11 11:03:12 +02:00
Tobias Brunner 438a6693ca Removed unused clalloc() function 2013-06-11 11:03:12 +02:00
Tobias Brunner 819c02dbc6 timeval_add_ms() fixed 
1000000us are exactly 1s so.
 2013-06-11 11:03:12 +02:00
Tobias Brunner c2dba63bd4 Additional tests for chunk_t 2013-06-11 11:03:12 +02:00
Tobias Brunner ab73ae67d3 Also capture coverage data for tests but filter them from the result 
Otherwise calls from test cases to static inline functions are not captured.
 2013-06-11 11:03:12 +02:00
Tobias Brunner 9a8c873e90 Add tests for lib->get|set 2013-06-11 11:03:12 +02:00
Tobias Brunner 0e55270aea Remove dead code in token enumerator 
Since we always search for the nearest separator (and strip them from
the front of the next token) there can't be any separators left at the
end of a token.
 2013-06-11 11:03:12 +02:00
Tobias Brunner 7e9f6b276b Additional and improved enumerator_t tests 2013-06-11 11:03:11 +02:00
Tobias Brunner 0713c90927 Test remove and remove_at of hashtable_t if all items are in the same bucket 2013-06-11 11:03:11 +02:00
Tobias Brunner c721d6b6a3 Add test cases for invoke_* and clone_* of linked_list_t 2013-06-11 11:03:11 +02:00
Tobias Brunner afb6d9c301 Improve tests for linked_list_t.replace() 2013-06-11 11:03:11 +02:00
Tobias Brunner cca70ed331 Add additional tests for linked_list_t 2013-06-11 11:03:11 +02:00
Tobias Brunner bc90b3dd0a Improved test for linked_list_t.insert_before() 2013-06-11 11:03:11 +02:00
Tobias Brunner 01a3ba9e0f Enable coverage report for libstrongswan 2013-06-11 11:03:11 +02:00
Tobias Brunner 1f14b4a1f9 Add --enable-coverage configure option 
This configure flag enables lcov [1] coverage generation and is intended
to be used with unit tests (--enable-unit-tests is implied).

A html coverage report can be generated by issuing the following command
in the toplevel build directory:

make coverage

[1] - http://ltp.sourceforge.net/coverage/lcov.php

Based on a patch by Adrian-Ken Rueegsegger.
 2013-06-11 11:03:11 +02:00
Tobias Brunner 952073b8a7 Use proper type for enumerator_t/linked_list_t tests 
Worked with -O2 but not with -O0.
 2013-06-11 11:03:11 +02:00
Tobias Brunner de42bf35f9 Converted test for recursive mutex_t 2013-06-11 11:03:11 +02:00
Tobias Brunner bed4bc1327 Randomly allocate chunk_hash() key during first use 
This avoids hash flooding attacks.
 2013-06-11 11:03:11 +02:00
Tobias Brunner d1953fe403 Replace chunk_hash() with output from chunk_mac() 
The quality is way better, the calculation is a bit slower though.

The key is statically initialized to zero, which will be changed later
to prevent hash flooding.
 2013-06-11 11:03:11 +02:00
Tobias Brunner 1255de5a20 Adding chunk_mac() which calculates a 64-bit MAC using SipHash-2-4 2013-06-11 11:03:11 +02:00
Tobias Brunner 4e67f19528 Converted tests for chunk_t 2013-06-11 11:03:11 +02:00
Tobias Brunner e09461bf77 Converted and added tests for hashtable_t 2013-06-11 11:03:10 +02:00
Tobias Brunner 0298be5705 Converted tests for identification_t 2013-06-11 11:03:10 +02:00
Tobias Brunner 3cbacad40b Remove obsolete enumerator/linked_list tests in unit_tester plugin 2013-06-11 11:03:10 +02:00
Tobias Brunner 26e8375b14 Add tests combining linked_list_t and enumerators 2013-06-11 11:03:10 +02:00
Tobias Brunner d3b06618f8 Some minor Doxygen fixes for linked_list_t 2013-06-11 11:03:10 +02:00
Tobias Brunner ff8f12298f Add basic tests for linked_list_t 2013-06-11 11:03:10 +02:00
Tobias Brunner 0d67c8329b Redirect test runner output to stderr 
This allows redirecting stdout of 'make check' to /dev/null.
 2013-06-11 11:03:10 +02:00
Tobias Brunner f15fcdc9d8 Add tests for enumerator_t 2013-06-11 11:03:10 +02:00
Tobias Brunner 156dcbc12e Add test runner for unit tests in libstrongswan 2013-06-11 11:03:10 +02:00
Tobias Brunner 62516a7465 testing: Increase base image size so there is space for test results on winnetou 2013-06-11 11:01:26 +02:00
Tobias Brunner 053ad34959 testing: Ignore errors when searching for imcv log entries in daemon.log 2013-06-10 18:52:32 +02:00
Tobias Brunner 5d52087b54 Added missing string for full-length HMAC-SHA512 signer 2013-06-10 11:48:18 +02:00
Tobias Brunner cfae3a227d attr: Fix handling of invalid IPs listed after valid ones 
Invalid IPs listed after a valid one resulted in an attribute
of the same type but with invalid data.
 2013-06-05 17:26:24 +02:00
Tobias Brunner c480b5f458 Allow memwipe() to be called with NULL argument 2013-05-27 18:41:16 +02:00
Tobias Brunner c6e1eda6d0 testing: Set terminal title when logging in via SSH 
Since we always log in as root use a simpler command prompt. And don't
store duplicate commands in the bash command history.
 2013-05-15 10:35:48 +02:00
Tobias Brunner bd538e8c4a openssl: Only warn about unavailable FIPS mode if the user requested it 2013-05-08 15:23:14 +02:00
Tobias Brunner c1f1df4b40 Merge branch 'charon-cmd-pkcs12' 
Adds support for PKCS#12 files in charon-cmd and ipsec.secrets.

Also fixes the cleanup of the OpenSSL library in the openssl plugin.
 2013-05-08 15:19:38 +02:00
Tobias Brunner 6040eff900 stroke: Add second password if provided 2013-05-08 15:02:41 +02:00
Tobias Brunner b7aa6b789e Load pkcs7 plugin in charon (and while we are at it in nm) 2013-05-08 15:02:41 +02:00
Tobias Brunner 1c080407b2 stroke: Fail silently if another builder calls PW callback after giving up 
Also reduced the number of tries to 3.
 2013-05-08 15:02:41 +02:00
Tobias Brunner 4a64c3e9a0 stroke: Cache passwords so the user is not prompted multiple times for the same password 
To verify/decrypt a PKCS#12 container a password might be needed
multiple times.  If it was entered correctly we don't want to bother the
user again with another password prompt.
The passwords for MAC creation and encryption could be different so the
user might be prompted multiple times after all.
 2013-05-08 15:02:41 +02:00
Tobias Brunner e240b03e68 stroke: Fix prompt and error messages in passphrase callback 2013-05-08 15:02:41 +02:00
Tobias Brunner 7971278c92 stroke: Load credentials from PKCS#12 files (P12 token) 2013-05-08 15:02:41 +02:00
Tobias Brunner 904390e887 openssl: Cleanup thread specific error buffer 2013-05-08 15:02:40 +02:00
Tobias Brunner 3ee2af97bf openssl: Don't use deprecated CRYPTO_set_id_callback() with OpenSSL >= 1.0.0 2013-05-08 15:02:40 +02:00
Tobias Brunner 780900ab0e openssl: Add PKCS#12 parsing via OpenSSL 2013-05-08 15:02:40 +02:00
Tobias Brunner 651d5ab8e7 openssl: Properly cleanup OpenSSL library 2013-05-08 15:02:40 +02:00
Tobias Brunner 02116fdc2d charon-cmd: Add support for PKCS#12 files 2013-05-08 15:02:40 +02:00
Tobias Brunner 3bd498284e PEM plugin loads PKCS#12 containers from (DER-encoded) files 
It is not actually able to handle PEM encoded PKCS#12 files produced
by OpenSSL.
 2013-05-08 15:02:40 +02:00
Tobias Brunner abc04e6b3f Remove pluto specific certificate types 2013-05-08 15:02:40 +02:00
Tobias Brunner f77d6e16d2 charon-cmd: match_me/match_other are optional in callback credentials 2013-05-08 15:02:40 +02:00
Tobias Brunner 89d350f46a charon-cmd: Request password for private keys 2013-05-08 15:02:40 +02:00
Tobias Brunner 1f2a34d6d8 Add support for untruncated HMAC-SHA-512 2013-05-08 15:02:39 +02:00
Tobias Brunner d8be7d38bf Also support 128-bit RC2 2013-05-08 15:02:39 +02:00
Tobias Brunner feef637368 Add pkcs12 plugin which adds support for decoding PKCS#12 containers 2013-05-08 15:02:39 +02:00
Tobias Brunner 199fdcadae Function added to convert a hash algorithm to an HMAC integrity algorithm 2013-05-08 15:02:39 +02:00
Tobias Brunner 047fca1169 Support the PKCS#5/PKCS#12 encryption scheme used by OpenSSL for private keys 2013-05-08 15:02:39 +02:00
Tobias Brunner 0d0929fa0c Register PKCS#8 builder for KEY_ANY 2013-05-08 15:02:39 +02:00
Tobias Brunner 8e48e0009a Add support for PKCS#7/CMS encrypted-data 2013-05-08 15:02:39 +02:00
Tobias Brunner d41e54c68d Move PKCS#12 key derivation to a separate file 2013-05-08 15:02:39 +02:00
Tobias Brunner 594d847f79 PKCS#5 wrapper can decrypt PKCS#12-like schemes 2013-05-08 15:02:38 +02:00
Tobias Brunner cb38e2f30a Add test vectors for RC2 2013-05-08 15:02:38 +02:00
Tobias Brunner 162c06f2f5 Fix cleanup in crypto_tester if a crypter fails 2013-05-08 15:02:38 +02:00
Tobias Brunner 9d4fc8677f Add implementation of the RC2 block cipher (RFC 2268) 2013-05-08 15:02:34 +02:00
Tobias Brunner c734c2d875 Extract function to convert ASN.1 INTEGER object to u_int64_t 2013-05-08 14:53:08 +02:00
Tobias Brunner 4076e3ee91 Extract PKCS#5 handling from pkcs8 plugin to separate helper class 2013-05-08 14:53:08 +02:00
Tobias Brunner b715176ec4 Merge branch 'charon-cmd-agent' 
Adds support for authentication via ssh-agent to charon-cmd (RSA and ECDSA keys
are currently supported).

The new sshkey plugin parses SSH public keys in RFC 4253 format.

SSH public keys can be configured with the left|rightsigkey ipsec.conf option,
which replaces left|rightrsasigkey and takes a public key in one of three
formats: SSH (RFC 4253, ssh: prefix), DNSKEY (RFC 3110, dns: prefix, not the
full RR, only the actual RSA key), or PKCS#1 (the default, no prefix).
As before the keys are either encoded in hex (0x) or base64 (0s).
left|rightsigkey also accepts the path to a file containing a PEM or DER
encoded public key.
 2013-05-08 14:35:05 +02:00
Tobias Brunner 4d38a698b8 charon-cmd: Changed formatting of optional arguments in usage information 
Optional arguments have to be specified with = after the option.
 2013-05-08 12:30:36 +02:00
Tobias Brunner 6a6d0ea7cd charon-cmd: --agent optionally takes the path to an ssh-agent socket 
If not given it is read from the SSH_AUTH_SOCK environment variable.
 2013-05-08 12:30:36 +02:00
Tobias Brunner efb4cb0bf9 charon-cmd: Stop processing options if an argument is missing or an option not recognized 2013-05-08 12:30:33 +02:00
Tobias Brunner 410abbd35f charon-cmd: Properly initialize options with no additional lines 2013-05-07 17:08:31 +02:00
Tobias Brunner e07e489d5f agent: Use sshkey plugin to parse keys, adds support for ECDSA 2013-05-07 17:08:31 +02:00
Tobias Brunner dd9e366814 sshkey: Add support for ECDSA keys 2013-05-07 17:08:31 +02:00
Tobias Brunner 87692be215 Load any type (RSA/ECDSA) of public key via left|rightsigkey 2013-05-07 17:08:31 +02:00
Tobias Brunner fa1d3d39dc left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly 
The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.
 2013-05-07 15:38:28 +02:00
Tobias Brunner cc4408abcb sshkey: Added builder for SSHKEY RSA keys 2013-05-07 15:38:28 +02:00
Tobias Brunner 584d656b77 Add sshkey plugin stub that will parse RFC 4253 public keys 2013-05-07 14:08:51 +02:00
Tobias Brunner c0bbddfa42 Try to load raw keys from ipsec.conf as PKCS#1 blob first 
The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.
 2013-05-07 14:08:51 +02:00
Tobias Brunner ee7b73832c charon-cmd: Add --agent option to authenticate using ssh-agent(1) 
The socket path is read from the SSH_AUTH_SOCK environment variable.
So using this with sudo might require the -E command line (or an appropriate
sudoers config) to preserve the environment.
 2013-05-07 14:08:51 +02:00
Tobias Brunner 4dc50bf9de charon-cmd: Use loose matching of gateway identity 2013-05-07 13:53:48 +02:00
Tobias Brunner 8372b8fc54 charon-cmd: Load pubkey plugin to load raw keys 2013-05-07 13:46:02 +02:00
Tobias Brunner e74bca9e19 testing: Don't run tests when building tkm 
The problem with XML/Ada described in 9c2aba27 actually occurs when
running the tests here.

Really fixes #336.
 2013-05-07 10:19:37 +02:00
Tobias Brunner 9c2aba2735 testing: Don't run tests when building tkm-rpc 
There are issues with some versions of the XML/Ada library on i386,
blocking the build of the testing environment when these tests are run.
TKM tests won't work in such a case but at least make-testing does not
block with this patch.

Fixes #336.
 2013-05-06 18:17:58 +02:00
Tobias Brunner 55321dcfb6 New Android release after adding AES-GCM, IPv6-in-IPv4 and using kernel-netlink 
libipsec now supports AES-GCM, IPv6 tunnels over IPv4 are supported,
native x86 libraries are built (requires a new Vstr build script).
Also, the existing kernel-netlink plugin now provides the kernel-net
implementation, which should be more stable in case multiple interfaces
are up and have IP addresses installed on them.
 2013-05-03 16:02:39 +02:00
Tobias Brunner 79f42ded50 libipsec: Fix memory leak in event relay 2013-05-03 16:02:39 +02:00
Tobias Brunner 740aedfec1 android: Use stronger ESP proposal including AES-GCM 2013-05-03 16:02:39 +02:00
Tobias Brunner 051fc25d92 libipsec: Add support for AES-GCM 2013-05-03 15:13:57 +02:00
Tobias Brunner 24a8d1253f libipsec: Wrap traditional algorithms in AEAD wrapper 2013-05-03 15:13:57 +02:00