denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,415 Commits 1 Branch 0 Tags
a6dc7bf287c0d6bd792cc2fb2ca91d2fdc9448db
Commit Graph
15415 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 885646acd3 constraints: Add certificate policy and policy mapping unit tests 2014-10-30 11:32:19 +01:00
Martin Willi 34fed1538b Merge branch 'id-type-prefix' 
Introduce generic identity prefixes to enforce a specific type.
 2014-10-30 11:21:22 +01:00
Martin Willi 045501d598 NEWS: Mention identity prefixes 2014-10-30 11:21:01 +01:00
Martin Willi 9da2b19189 swanctl: Document identity type prefixes 2014-10-30 11:07:10 +01:00
Martin Willi 9388bf1363 man: Document identification type prefixes in ipsec.conf(5) 2014-10-30 11:07:10 +01:00
Martin Willi 6528338753 identification: Support custom types in string constructor prefixes 2014-10-30 11:07:08 +01:00
Martin Willi c0da835a9f identification: Support prefixes in string constructors for an explicit type 2014-10-30 11:05:44 +01:00
Martin Willi 46001e1131 unit-tests: Re-align identification_create_from_string() unit test table data 2014-10-30 11:03:48 +01:00
Martin Willi 61e29aca0d threading: Support rwlock try_write_lock() on Windows 
We explicitly avoided TryAcquireSRWLockExclusive() because of crashes. This
issue was caused by a MinGW-w64 bug (mingw-w64 fix 46f77afc). Using a newer
toolchain works fine.

While try_write_lock() obviously can fail, not supporting it is not really an
option, as some algorithms depend on occasionally successful calls. Certificate
caching in the certificate manager and the cred_set cache rely on successful
try_write_lock()ing.
 2014-10-30 10:45:24 +01:00
Martin Willi 6a3f0467e4 threading: Add a more explicit rwlock try_write_lock() testing 2014-10-30 10:45:24 +01:00
Tobias Brunner b089169752 message: Include encrypted fragment payload in payload (order) rules 
Otherwise fragmented CREATE_CHILD_SA exchanges won't get accepted
because they don't contain an SA payload.

It also prevents a warning when ordering payloads.

Fixes #752.
 2014-10-29 15:51:38 +01:00
Tobias Brunner a9f87d118e cert-cache: Prevent that a cached issuer is freed too early 
Previously we got no reference to the cached issuer certificate
before releasing the lock of the cache line, this allowed other
threads, or even the same thread if it replaces a cache line, to
destroy that issuer certificate in cache() (or flush()) before
get_ref() for the issuer certificate is finally called.
 2014-10-24 11:23:04 +02:00
Tobias Brunner e7c582e652 unit-tests: Fix internet checksum tests on big-endian systems 
We actually need to do a byte-swap, which ntohs() only does on
little-endian systems.

Fixes #747.
 2014-10-23 11:13:54 +02:00
Tobias Brunner eb218ff80b chunk: Fix internet checksum calculation on big-endian systems 
ntohs() might be defined as noop (#define ntohs(x) (x)) so we have
to manually shorten the negated value (gets promoted to an int).

Fixes #747.
 2014-10-23 11:13:28 +02:00
Martin Willi 4736ba0657 updown: Explicitly pass caller PATH to updown script 
When invoking /bin/sh, its default PATH is used. On some systems, that does
not include the PATH where the ipsec script is installed, as charon is invoked
with a custom PATH. Explicitly setting the PATH of charon should fix this
case, properly invoking the (default) updown script.

Fixes #745.
 2014-10-22 14:53:36 +02:00
Tobias Brunner 9e20fdbaf6 ip-packet: Fix length in IPv6 header of generated packets 2014-10-20 15:33:35 +02:00
Andreas Steffen a521ef3b8e Increased fragment size to 1400 in ipv6/net2net-ikev1 scenario 2014-10-18 14:05:53 +02:00
Andreas Steffen 09b46cdb6a Enabled IKEv2 fragmentation in ipv6/net2net-ikev2 scenario 2014-10-18 14:05:18 +02:00
Andreas Steffen 4b1b91913a Version bump to 5.2.1 2014-10-18 12:12:17 +02:00
Andreas Steffen 05b835c587 Remove unneeded get_count() method 2014-10-17 17:59:43 +02:00
Andreas Steffen 1c2416013c Process TCG/PTS File Measurement attribute incrementally 2014-10-17 16:11:40 +02:00
Andreas Steffen 82d2142f98 Exempt TCG/SEG attributes from unsupported case statement 2014-10-16 13:38:51 +02:00
Andreas Steffen 08385de6e2 Request IF-M segmentation contract for TCG/PTS subtype 2014-10-16 07:49:42 +02:00
Martin Willi cbb86a2df3 tls: Fix an invalid free on CBC encryption failure 2014-10-15 14:26:03 +02:00
Martin Willi 867d04b72e tls: Fix a memory leak if AEAD encryption fails 2014-10-15 14:21:01 +02:00
Martin Willi c0bf721357 tls: Check all bytes of the padding if they equal the padding length 2014-10-15 14:21:01 +02:00
Tobias Brunner fdeda63df0 android: Fix PA-TNC construction based on data passed via JNI 2014-10-15 13:55:13 +02:00
Tobias Brunner da241b6c75 libimcv: Add generic constructor for PA-TNC attributes 2014-10-15 13:55:13 +02:00
Tobias Brunner c71e6820ab backtrace: Fix symbol lookup in dynamic symtab via libbfd 2014-10-14 17:26:48 +02:00
Tobias Brunner 6de42cd323 swid-inventory: Remove unused variable end_of_tag 2014-10-14 17:11:41 +02:00
Tobias Brunner f8dc376c77 swanctl: Fix man page build on FreeBSD 
BSD make seems to only evaluate $< for certain rules (like the suffix rule
used to generate the config template).
 2014-10-14 16:49:40 +02:00
Martin Willi 76dc329e47 thread: Test for pending cancellation requests before select()ing on OS X 
This fixes some vici test cases on OS X, where the test thread tries to cancel
the watcher thread during cleanup, but fails as select() does not honor the
pre-issued cancellation request.
 2014-10-14 16:34:44 +02:00
Martin Willi bdfbecb3e6 vici: Return default value for get_int() if message value is empty string 
This is the behavior of some strtol() implementations, and it makes sense,
so force it.
 2014-10-14 16:33:10 +02:00
Martin Willi 784916e28d process: Don't use the shells built-in echo in tests 
On OS X, the /bin/sh built-in echo does not support -n.
 2014-10-14 16:33:10 +02:00
Martin Willi b16ea3415f process: Don't use absolute path names for true/false/cat in unit tests 
But use the (builtin) shell commands instead, as on OS X true/false are under
/usr/bin.
 2014-10-14 16:33:10 +02:00
Martin Willi 4e37bdbf57 kernel-pfroute: Check for RTM_IFANNOUNCE availability 
This message is not available on OS X.
 2014-10-14 16:33:10 +02:00
Martin Willi 5b2d89b3c3 process: Include missing <signal.h> for raise(3) 
Fixes OS X build.
 2014-10-14 16:33:10 +02:00
Tobias Brunner 9d75a28820 ike: Add IKEv2 in description of fragment_size option in strongswan.conf 2014-10-14 15:41:52 +02:00
Tobias Brunner 15dee933de ip-packet: Fix removal of TFC padding for IPv6 
The IPv6 length field denotes the payload length after the 40 bytes header.

Fixes: 293515f95c ("libipsec: remove extra RFC4303 TFC padding appended to inner payload")
 2014-10-14 14:10:33 +02:00
Tobias Brunner 283229bcb7 vici: Add vici.gemspec.in and vici.rb to distribution 2014-10-14 11:26:41 +02:00
Martin Willi 05a3f349a7 travis: Build-test updown and ext-auth plugins for Windows 2014-10-14 11:11:34 +02:00
Tobias Brunner 3307de1f8d android: Implement get_contracts() method in IMC state object 2014-10-14 10:37:55 +02:00
Tobias Brunner f4e6f89aa9 android: libpts does not exist anymore, don't attempt to load it 2014-10-14 10:12:16 +02:00
Tobias Brunner bed09f2baf android: Update receive_message() to new imc_msg_t.receive() signature 2014-10-13 18:16:47 +02:00
Tobias Brunner 668fbd4907 libimcv: Add fallback if IPSEC_SCRIPT is not defined 
This is the case on Android.
 2014-10-13 18:16:47 +02:00
Tobias Brunner ba0355c4ae libimcv: Updated Android.mk to latest Makefile.am 2014-10-13 18:16:40 +02:00
Tobias Brunner f502e503fb android: Remove references to libpts 2014-10-13 17:18:06 +02:00
Tobias Brunner ffa800ce9d libimcv: Remove reference to libpts 2014-10-13 17:17:45 +02:00
Tobias Brunner 17eed801e7 libimcv: Fix Doxygen comments after merging libpts into libimcv 2014-10-13 17:11:57 +02:00
Tobias Brunner 4bae9ec8d1 watcher: Doxygen comment fixed 2014-10-13 16:56:30 +02:00