denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,039 Commits 1 Branch 0 Tags
9cf292051265f511a9a2154f48891099b4814728
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 9cf2920512 traffic-selector: Use single buffer for both address families 
The generic field of size 0 in the union that was used previously
triggered index-out-of-bounds errors with the UBSAN sanitizer that's
used on OSS-Fuzz.  Since the two family specific union members don't
really provide any advantage, we can just use a single buffer for both
families to avoid the errors.
 2017-08-17 12:34:40 +02:00
Tobias Brunner 936db031c7 testing: Make removal of SWID tags work with different releases 
The regid.2004-03.org.strongswan directory might not exist in new images.
 2017-08-16 10:51:15 +02:00
Tobias Brunner bf31485e1e fuzzing: Also run input that previously caused crashes 2017-08-15 10:35:20 +02:00
Tobias Brunner 17840fa18e configure: Detect mpz_powm_sec() when built with -Werror 2017-08-15 10:35:20 +02:00
Tobias Brunner 7421884da1 travis: Use the same ASAN_OPTIONS as used by OSS-Fuzz 2017-08-15 10:35:20 +02:00
Tobias Brunner ed13c60c4f plugin-loader: Move indent variables into !USE_FUZZING block 
This avoids compile errors on Travis.
 2017-08-15 10:35:20 +02:00
Tobias Brunner 1ce2721d90 travis: Run fuzz targets 2017-08-15 10:35:20 +02:00
Tobias Brunner 9f2e74cfbb fuzzing: Run local fuzz targets on given corpora during make check 
The base directory of the corpora must be set in FUZZING_CORPORA.
 2017-08-15 10:35:20 +02:00
Tobias Brunner be1beea7a4 fuzzing: Add driver to run fuzz targets on a given list of files 
This is enabled if the path to libFuzzer.a is not specified when running
the configure script.
 2017-08-15 10:35:20 +02:00
Tobias Brunner 7cc4a92d0b NEWS: Add info about CVE-2017-11185 2017-08-14 08:49:33 +02:00
Tobias Brunner ef5c37fcdf gmp: Fix RSA signature verification for m >= n 
By definition, m must be <= n-1, we didn't enforce that and because
mpz_export() returns NULL if the passed value is zero a crash could have
been triggered with m == n.

Fixes CVE-2017-11185.
 2017-08-14 08:49:33 +02:00
Tobias Brunner f237bfcb9e NEWS: Added some news 2017-08-08 20:05:30 +02:00
Tobias Brunner e66c3d41bc conf: Descriptions of several settings updated 2017-08-08 17:28:01 +02:00
Tobias Brunner eb3239b921 libimcv: Cast chunk length to int when printing as string 2017-08-08 15:32:08 +02:00
Tobias Brunner cbade9b6b9 sw-collector: Cast chunk length to int when printing as string 2017-08-08 15:31:56 +02:00
Tobias Brunner 0392f76804 sw-collector: Fix memory leak after failing to open DB 2017-08-08 15:30:44 +02:00
Tobias Brunner d093488b96 sw-collector: Use correct variable to report failure to open history file 2017-08-08 15:29:41 +02:00
Tobias Brunner 3abb6a231d Revert "apidoc: Update Doxyfile" 
This reverts commit 8ec979fd64.

Mainly because Travis is still on Trusty and this generates lots of
warnings.
 2017-08-07 18:29:51 +02:00
Tobias Brunner e64cdb15c5 sw-collector: Add missing Doxygen group 
Fix location of two classes.
 2017-08-07 17:37:00 +02:00
Tobias Brunner 5d65aad8a6 libimcv: Add missing Doxgen group for SWIMA-related classes 
Fix location of swima_error_t.
 2017-08-07 17:36:48 +02:00
Tobias Brunner 8ec979fd64 apidoc: Update Doxyfile 2017-08-07 17:27:31 +02:00
Tobias Brunner ca280574ba Fixed some typos, courtesy of codespell 2017-08-07 17:22:01 +02:00
Tobias Brunner c11d13c4b9 testing: Add -v option to do-tests to prefix commands with timestamps 2017-08-07 16:55:45 +02:00
Tobias Brunner f058804df8 testing: Move collector.db in tnc/tnccs-20-ev-pt-tls scenario to /etc/db.d 
Also move initialization to the pretest script (it's way faster in the
in-memory database).
 2017-08-07 16:55:45 +02:00
Tobias Brunner 6fadc6a859 kernel-netlink: Wipe buffer used to read Netlink messages 
When querying SAs the keys will end up in this buffer (the allocated
messages that are returned are already wiped). The kernel also returns
XFRM_MSG_NEWSA as response to XFRM_MSG_ALLOCSPI but we can't distinguish
this here as we only see the response.

References #2388.
 2017-08-07 16:55:40 +02:00
Tobias Brunner 1a75514b76 sha2: Write final hash directly to output buffer 
This avoids having the last output in internal memory that's not wiped.

References #2388.
 2017-08-07 16:55:33 +02:00
Tobias Brunner e0c78d7516 prf-plus: Wipe seed and internal buffer 
The buffer contains key material we handed out last and the seed can
contain the DH secret.

References #2388.
 2017-08-07 16:55:28 +02:00
Tobias Brunner 00498d78a8 conf: Match more characters in _ and ** 
\w does not match e.g. / but \S does.
 2017-08-07 14:22:27 +02:00
Tobias Brunner 1a8226429a trap-manager: Don't require that remote is resolvable during installation 
Initiation might later fail, of course, but we don't really
require an IP address when installing, that is, unless the remote
traffic selector is dynamic. As that would result in installing a
0.0.0.0/0 remote TS which is not ideal when a single IP is expected as
remote.
 2017-08-07 14:22:13 +02:00
Tobias Brunner 7bcd48d1b1 child-create: Don't log CHILD_SA initiation until we know the unique ID 2017-08-07 14:22:13 +02:00
Tobias Brunner 663b749c9f child-rekey: Add CHILD_SA name and unique ID to collision log messages 2017-08-07 14:22:13 +02:00
Tobias Brunner 859dae255c child-sa: Suppress CHILD_SA state changes if there is no change 2017-08-07 14:22:13 +02:00
Tobias Brunner 11ddda2ecd Merge commit 'child-sa-rekey-tkm' 
This fixes CHILD_SA rekeying with TKM and changes how we switch to the
outbound IPsec SA with Netlink/XFRM (using SPIs on the outbound policy
instead of installing the outbound SA delayed).

For charon-tkm it changes when esa_select() and esa_reset() are called,
now with the outbound policy and the inbound SA, respectively, instead
of the outbound SA in both cases.

Also fixed is a potential traffic loss when a rekey collision is lost.
 2017-08-07 10:46:45 +02:00
Tobias Brunner 772957778c charon-tkm: Call esa_reset() when the inbound SA is deleted 
After a rekeying the outbound SA and policy is deleted immediately, however,
the inbound SA is not removed until a few seconds later, so delayed packets
can still be processed.

This adds a flag to get_esa_id() that specifies the location of the
given SPI.
 2017-08-07 10:46:00 +02:00
Tobias Brunner dbaeaaf605 charon-tkm: Remove unused get_other_esa_id() method 2017-08-07 10:46:00 +02:00
Tobias Brunner 15e745cf4d child-rekey: Don't install outbound SA in case of lost collisions 
This splits the SA installation also on the initiator, so we can avoid
installing the outbound SA if we lost a rekey collision, which might
have caused traffic loss depending on the timing of the DELETEs that are
sent in both directions.
 2017-08-07 10:46:00 +02:00
Tobias Brunner f0d051f192 testing: Also capture stderr during test cases 
The output was not correct otherwise due to the reordering of commands.
 2017-08-07 10:44:05 +02:00
Tobias Brunner 87c6247e0d testing: Clearly mark the tests that failed 2017-08-07 10:44:05 +02:00
Tobias Brunner 5163bd4b86 testing: Add tkm/xfrmproxy-rekey scenario 
Similar to the xfrmproxy-expire scenario but here the TKM host is the
responder to a rekeying.
 2017-08-07 10:44:05 +02:00
Tobias Brunner a721b9c53d testing: Add pfkey/net2net-rekey scenario 2017-08-07 10:44:05 +02:00
Tobias Brunner 37a91758c9 testing: Add ikev2/net2net-rekey scenario 2017-08-07 10:44:05 +02:00
Tobias Brunner 99cf64e960 testing: Add support for counting matching lines in tests 
Specifying an integer instead of YES in evaltest.dat causes the number to get
compared against the actual number of lines matching the pattern.

This may be used to count matching packets or log lines.
 2017-08-07 10:44:05 +02:00
Tobias Brunner f9fbcbb1a0 bus: Don't trigger child_updown() for rekeyed CHILD_SAs 
We don't trigger it either when they are deleted individually.
 2017-08-07 10:44:05 +02:00
Tobias Brunner d24b831fe7 charon-tkm: Don't select new outbound SA until the policy is installed 
This tries to avoid packet loss during rekeying by delaying the usage of
the new outbound IKE_SA until the old one is deleted.

Note that esa_select() is a no-op in the current TKM implementation. And
the implementation also doesn't benefit from the delayed deletion of the
inbound SA as it calls esa_reset() when the outbound SA is deleted.
 2017-08-07 10:44:05 +02:00
Tobias Brunner 0d42a76275 charon-tkm: Claim to support SPIs on policies 
This fixes rekeying as the delayed installation of the outbound SA
caused the nonce context to be expired already.
 2017-08-07 10:44:05 +02:00
Tobias Brunner a146b4c9ef child-sa: Install outbound SA immediately if kernel supports SPIs on policies 2017-08-07 10:44:05 +02:00
Tobias Brunner 2c116ef589 child-sa: Use flags to track installation of outbound SA and policies separately 2017-08-07 10:44:05 +02:00
Tobias Brunner 2699c8387a kernel-netlink: Set SPI on outbound policy 
This should cause the right SA to get used if there are multiple outbound
SAs and the policies are installed properly.
 2017-08-07 10:44:05 +02:00
Tobias Brunner a46d233c0e kernel-interface: Not all kernel interfaces support SPIs on policies 2017-08-07 10:44:05 +02:00
Tobias Brunner 8f63a36b34 Merge branch 'appveyor' 
Build and run unit tests on AppVeyor Windows containers.
 2017-08-02 16:51:40 +02:00
Tobias Brunner 096626286a appveyor: Build against OpenSSL 
This is mainly for the RNG needed for the exchange tests.
 2017-07-28 11:23:23 +02:00
Tobias Brunner 95ecc11774 unit-tests: Double escape backslashes in Windows paths in settings test 
That's required when these are used as include paths in settings file
strings.
 2017-07-28 11:22:40 +02:00
Tobias Brunner 67ad553a2c unit-tests: Stringify direction in message asserts early 
x86_64-w64-mingw32-gcc on Windows requires this.
 2017-07-28 11:18:59 +02:00
Tobias Brunner 65064cc33b unit-tests: iv_gen_seq has a dependency on RNG_STRONG 
We currently don't have an RNG in Windows builds.
 2017-07-28 11:18:59 +02:00
Tobias Brunner 6eb7dd11ec appveyor: Run tests on AppVeyor Windows containers 
We can't enable leak detective as it is so slow then that we run into a
timeout (60 minutes).
 2017-07-28 11:18:17 +02:00
Tobias Brunner 8d4ebb3ac4 peer-cfg: Use an rwlock instead of a mutex to safely access child-cfgs 
If multiple threads want to enumerate child-cfgs and potentially lock
other locks (e.g. check out IKE_SAs) while doing so a deadlock could
be caused (as was the case with VICI configs with start_action=start).
It should also improve performance for roadwarrior connections and lots
of clients connecting concurrently.

Fixes #2374.
 2017-07-27 13:34:40 +02:00
Tobias Brunner 578d893b4a credential-manager: Log issuer identity if not found 2017-07-27 13:28:13 +02:00
Tobias Brunner 0b756fbe95 auth-cfg: Don't limit subjectAltName check to received certificates 
Otherwise this won't work if the certificate is only locally available.
 2017-07-27 13:27:19 +02:00
Tobias Brunner 4272a3e9d7 swanctl: Read default socket from swanctl.socket option 
Also read from swanctl.plugins.vici.socket so we get
libstrongswan.plugins.vici.socket if it is defined.

Fixes #2372.
 2017-07-27 13:22:57 +02:00
Tobias Brunner ae48325a59 swanctl: Include config snippets from conf.d subdirectory 
Fixes #2371.
 2017-07-27 13:20:24 +02:00
Tobias Brunner fb8c9b3d08 conf: Add support to generate include statements in .conf files 2017-07-27 13:19:38 +02:00
Tobias Brunner 67402ec77b curl: Enable following redirects 
The maximum number of redirects can be limited. The functionality can also
be disabled.

Fixes #2366.
 2017-07-27 13:15:43 +02:00
Tobias Brunner 791cfe82a1 ikev2: AES-CMAC-PRF-128 only uses the first 64 bits of each nonce 
References #2377.
 2017-07-27 13:09:26 +02:00
Tobias Brunner ed926a73df error-notify: Don't stop sending notifies after removing a disconnected listener 
This prevented new listeners from receiving notifies if they joined
after another listener disconnected previously, and if they themselves
disconnected their old connection would prevent them again from getting
notifies.
 2017-07-27 13:07:24 +02:00
Tobias Brunner 6138b8d629 farp: Only remove one tracked entry 
Multiple CHILD_SAs sharing the same traffic selectors (e.g. during
make-before-break reauthentication) also have the same reqid assigned.
If all matching entries are removed we could end up without entry even
though an SA exists that still uses these traffic selectors.

Fixes #2373.
 2017-07-27 13:07:23 +02:00
Tobias Brunner a0cde76958 ike: Trigger CHILD_INSTALLED state change after corresponding log message 
This way we get the log message in stroke and swanctl as last message
when establishing a connection. It's already like this for the IKE_SA
where IKE_ESTABLISHED is set after the corresponding log message.

Fixes #2364.
 2017-07-27 13:07:23 +02:00
Tobias Brunner 6b69a66379 swima-collector: Fix compile error if SWID_DIRECTORY is not defined 2017-07-24 11:34:39 +02:00
Tobias Brunner bf565b650c libimcv: Add missing files to Android.mk 2017-07-24 11:31:19 +02:00
Tobias Brunner 49917f0028 testing: Support running multiple tests with * as wildcard (e.g. ikev2/ocsp-*) 2017-07-07 09:23:14 +02:00
Tobias Brunner d7dc677ee5 x509: Correctly encode nonce in OCSP request 
The nonce value is encoded as OCTET STRING, however, the extension
values themselves must also be encoded as OCTET STRING.
 2017-07-07 08:57:14 +02:00
Tobias Brunner 93e0898f60 swanctl: Document eap_id in remote sections 2017-07-05 18:08:04 +02:00
Tobias Brunner fd0a7b4795 kernel-pfroute: Make sure there is a netmask when enumerating subnets 2017-07-05 10:21:25 +02:00
Tobias Brunner ef6b710f19 pki: Load pubkey plugin to print public keys 
Since 3317d0e77b the public keys are printed via certificate printer,
but that only works if the public key is actually wrapped, which
requires the pubkey plugin.

Fixes: 3317d0e77b ("Standardized printing of certificate information")
 2017-07-05 10:15:45 +02:00
Tobias Brunner 609457e4c8 pki: Fix typo in --print man page 2017-07-05 10:15:45 +02:00
Tobias Brunner 7aa30575d5 sql: Use qualified names in SQL query statements 
VIRTUAL is a new reserved keyword in MySQL 5.7.6 that caused some of these
queries to fail.

Fixes #2359.
 2017-07-05 10:13:39 +02:00
Tobias Brunner a3bcbb4c64 stroke: Don't load configs with invalid proposals 
References #2347.
 2017-07-05 10:08:36 +02:00
Tobias Brunner 5d580ae063 ikev1: Determine transform ID before mapping integrity algorithm ID 
Due to the lookup based on the mapped algorithm ID the resulting AH
proposals were invalid.

Fixes #2347.

Fixes: 8456d6f5a8 ("ikev1: Don't require AH mapping for integrity algorithm when generating proposal")
 2017-07-05 10:08:20 +02:00
Tobias Brunner 1aba82bfd7 eap-aka-3gpp: Add plugin that implements 3GPP MILENAGE algorithm in software 
This is similar to the eap-aka-3gpp2 plugin. K (optionally concatenated
with OPc) may be configured as binary EAP secret in ipsec.secrets or
swanctl.conf.

Based on a patch by Thomas Strangert.

Fixes #2326.
 2017-07-05 10:03:38 +02:00
Tobias Brunner 7004a59a4c utils: Make second argument to memxor() const 2017-07-05 10:02:05 +02:00
Tobias Brunner 909d7dca17 android: New release after fixing issues with older Android versions and DB upgrade 2017-07-04 11:55:04 +02:00
Tobias Brunner ccb6e9f1b0 android: Fix database update from older versions 2017-07-04 11:55:04 +02:00
Tobias Brunner a63b0f9982 android: Fix version string on older Android releases 
SECURITY_PATCH is apparently only available since Android 6.
 2017-07-04 11:54:57 +02:00
Tobias Brunner 480d56da5f android: New release after fixing crash with existing profiles 2017-07-03 13:44:49 +02:00
Tobias Brunner ebf369c483 android: Fix null pointer dereference with existing profiles 2017-07-03 13:43:53 +02:00
Tobias Brunner 64c2d3ca3e android: Only show disconnect button if actually connected 2017-07-03 12:11:30 +02:00
Tobias Brunner 1b1060821e android: New release after adding lots of new stuff 2017-07-03 10:47:43 +02:00
Tobias Brunner c0990c187b Merge branch '2309-android-disconnect-button' 
Adds a disconnect button to the permanent notification.

Fixes #2309.
 2017-07-03 10:40:37 +02:00
Tobias Brunner 6333a756ee android: Close activity when dialog is canceled if it was not visible before 
onPause/onResume() won't work because onPause() is called right before
onNewIntent().
 2017-07-03 10:39:26 +02:00
Tobias Brunner 1265b353d4 android: Allow disconnecting via MainActivity but display a confirmation dialog 2017-07-03 10:39:26 +02:00
Tobias Brunner d0ed8ee89e android: Add disconnect button to notification 2017-07-03 10:39:23 +02:00
Tobias Brunner aea901bbbe Merge branch 'android-certreq' 
This adds an option that allows disabling certificate requests during
IKE_AUTH.
 2017-07-03 10:37:21 +02:00
Tobias Brunner 8ae7f8b7a2 android: Make sending certificate requests configurable in the GUI 2017-07-03 10:37:09 +02:00
Tobias Brunner 11eb7e0898 android: Import the flag to suppress certificate requests 2017-07-03 10:37:09 +02:00
Tobias Brunner 3f0592d0fd android: Add flag to suppress sending certificate requests 2017-07-03 10:37:09 +02:00
Tobias Brunner 0204374e21 android: Add property for simple flags 2017-07-03 10:37:09 +02:00
Tobias Brunner 6f0888c872 Merge branch '2365-android-nat-keepalive' 
This makes the NAT-T keepalive interval configurable per connection.

Fixes #2365.
 2017-07-03 10:33:52 +02:00
Tobias Brunner aa4b6eda59 android: Import NAT-T keepalive interval 2017-07-03 10:33:29 +02:00
Tobias Brunner a2aa0ca0e4 android: Make NAT-T keepalive interval configurable in the GUI 2017-07-03 10:33:29 +02:00
Tobias Brunner db599d6b28 android: Use configured NAT-T keepalive interval 2017-07-03 10:33:29 +02:00
Tobias Brunner a28302317f android: Add property for NAT-T keepalive interval 2017-07-03 10:33:29 +02:00