denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,223 Commits 1 Branch 0 Tags
af494268fb792e86db67e0d088313480a82bbf90
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 3d2b36b812 NEWS: Updated URL to swidGenerator 2014-07-07 17:54:02 +02:00
Tobias Brunner 44870e5313 xauth-pam: Add workaround for null-terminated passwords 
Fixes #631.
 2014-07-07 11:14:02 +02:00
Tobias Brunner 118b2879aa winhttp: Do not use countof() on pointer argument 2014-07-02 12:38:45 +02:00
Tobias Brunner 831045ef45 optionsfrom: Properly handle errors when determining file size 2014-07-02 12:38:45 +02:00
Tobias Brunner e44223dbcc windows: Fix off-by-one error in strerror_s_extended() 2014-07-02 12:38:45 +02:00
Tobias Brunner 0026600bfe windows: accept() socket handle could theoretically be 0 2014-07-02 12:38:45 +02:00
Tobias Brunner babe9e4f45 windows: Close correct socket when opening second socket fails in socketpair() 2014-07-02 12:38:44 +02:00
Tobias Brunner 0a26f39a71 windows: Make sure the string returned from ReadConsole() is null terminated 2014-07-02 12:38:44 +02:00
Tobias Brunner 32a262e7a1 windows: Remove useless assignment in put_thread() 2014-07-02 12:12:05 +02:00
Tobias Brunner 0e48f67562 backtrace: Remove name checks after SymFromAddr() calls 
The Name member is an array whose address is always defined.
 2014-07-02 12:11:59 +02:00
Tobias Brunner fbe462e1b0 pts: Avoid integer overflow when reading file names in the old IMA format 2014-07-01 17:58:36 +02:00
Tobias Brunner ecb55b4639 imv-attestation: Avoid memory leak when skipping unsupported work items 2014-07-01 17:58:36 +02:00
Tobias Brunner 530d87be1b pts: Use memchr(3) instead of strchr(3) to extract hash algorithm name 
The string read with read(2) might not be null terminated.
 2014-07-01 17:58:36 +02:00
Tobias Brunner f82d7aff85 swid: fgets(3) returns a pointer to the read string or NULL 2014-07-01 17:58:36 +02:00
Tobias Brunner 1be2b84124 parser-helper: Ensure file_next() does not remove the sentinel item 2014-07-01 17:58:36 +02:00
Tobias Brunner 8b123d2e4a man: Document replay_window ipsec.conf option 2014-06-30 14:50:32 +02:00
Tobias Brunner 28a79e4e0c stroke: Don't log unspecified options of conn and ca sections 2014-06-30 13:29:26 +02:00
Tobias Brunner e79dbda390 utils: Helper macros to define overloaded macros based on number of arguments 2014-06-30 13:29:26 +02:00
Tobias Brunner ba2805c106 pki: Document --online option for pki --verify and all exit codes 2014-06-30 13:25:13 +02:00
Tobias Brunner 33967467e2 conf: Document load-tester.crl option 2014-06-30 13:25:13 +02:00
Tobias Brunner da7cb76974 conf: Document charon.*-scripts options 2014-06-30 13:25:13 +02:00
Tobias Brunner 38f27e172c conf: Document swanctl options 2014-06-30 13:25:13 +02:00
Tobias Brunner 4d066ef7fc conf: Document aikgen options 2014-06-30 13:25:13 +02:00
Tobias Brunner 3986c1e3fd autoconf: Replace --disable-tools option with --disable-scepclient 
Since using a separate option for pki this was the only tool that was still
enabled by that option.
 2014-06-30 13:25:13 +02:00
Tobias Brunner 45f647c9cd checksum: Fix checksum generation for pki if tools are disabled 2014-06-30 13:25:13 +02:00
Tobias Brunner 01e48ddd59 doc: Remove obsolete architecture description and empty known bugs list 2014-06-30 13:16:17 +02:00
Tobias Brunner 0909bf6c0a apidoc: Include *.md and files from the complete source directory (not only src) 2014-06-30 13:16:17 +02:00
Tobias Brunner 891d332b15 Converted existing README to Markdown 2014-06-30 13:16:17 +02:00
Tobias Brunner a477d28017 Move README to README.md so it gets evaluated as Markdown 2014-06-30 13:16:17 +02:00
Tobias Brunner 2eef43f3ee swid: Fix parameter documentation in Doxygen comments 2014-06-30 13:16:17 +02:00
Tobias Brunner e351169900 windows: Fix parameter name in Doxygen comment 2014-06-30 13:16:17 +02:00
Tobias Brunner aad072d517 enum: Replace þ with p in Doxygen comments 2014-06-30 13:16:17 +02:00
Tobias Brunner 3b16c2b55d libvici: Add missing argument to Doxygen comment 2014-06-30 13:16:16 +02:00
Tobias Brunner cc7c4c3dbd starter: Add starter group and fix formatting of conf_parser_section_t enum 
Make use of the Markdown support in recent Doxygen versions.
 2014-06-30 13:16:16 +02:00
Tobias Brunner 1bd175a9ef swanctl: Fix Doxygen group assignment 2014-06-30 13:16:16 +02:00
Tobias Brunner 00729e16e7 apidoc: Updated Doxyfile.in 2014-06-30 13:16:16 +02:00
Tobias Brunner ed01c1afff Fixed some typos 2014-06-30 13:16:16 +02:00
Tobias Brunner be41910e19 testing: Add sql/shunt-policies-nat-rw scenario 2014-06-26 18:13:26 +02:00
Tobias Brunner 73211f9b74 testing: Add pfkey/shunt-policies-nat-rw scenario 2014-06-26 18:13:26 +02:00
Tobias Brunner f22add05f6 kernel-pfkey: Use address in TS to determine interface for shunt routes 2014-06-26 18:13:17 +02:00
Tobias Brunner 60f5fb2318 kernel-pfkey: Use subnet and prefix when determining nexthop for shunt policy routes 
This is basically the same as 88f125f560.
 2014-06-26 18:13:09 +02:00
Tobias Brunner b451303a6c kernel-pfkey: Install routes for shunt policies 2014-06-26 18:12:05 +02:00
Tobias Brunner 945e1df738 testing: Remove obsolete shunt-policies scenarios 2014-06-26 18:12:00 +02:00
Tobias Brunner 04ff5e58e3 starter: Ingore %default conn and ca sections 2014-06-26 12:23:05 +02:00
Tobias Brunner 4431e1e04d updown: Force subnet address to be numeric 2014-06-25 16:17:15 +02:00
Tobias Brunner cd6b2af33e kernel-netlink: Cast IPv6 address blobs to the proper type 
On Android these macros are defined as functions.
 2014-06-24 15:53:25 +02:00
Tobias Brunner 3e4ce88633 android: Define HAVE_DLADDR as plugin loader checks for it 2014-06-24 15:53:25 +02:00
Tobias Brunner 5195416d90 android: Update Android.mk files to match changes due to the Windows port 
Makes them easier to compare to the original Makefile.am.
 2014-06-24 15:53:25 +02:00
Tobias Brunner 6d4654b9f9 utils: Add wrappers for memcpy(3), memmove(3) and memset(3) 
These wrappers guarantee that calls to these functions are noops if the
number of bytes is 0, as calling them with NULL pointers is undefined
according to the C standard, even if the number of bytes is 0 (most
implementations probably ignore the pointers anyway in this case, but
lets make sure).
 2014-06-24 15:11:27 +02:00
Tobias Brunner bb91109af8 pki: Also check for MAX_COMMANDS when building getopt_long arguments 
Completes 87e53819a6 and 0a8c399a21.
 2014-06-24 15:11:27 +02:00
Tobias Brunner a4844dbc8f Merge branch 'algorithm-order' 
Restores the behavior we had before 2e22333fb (except for RNGs), that is,
algorithms are stored in the registration order again.  Which is not optimal
as we must rely on plugins to register them in a sensible order, but ordering
them by identifier definitely caused weaker algorithms to be proposed first
in the default proposal, which was even worse.
 2014-06-20 16:34:29 +02:00
Tobias Brunner aba9ef542e unit-tests: Add tests for DH factory 2014-06-20 16:21:55 +02:00
Tobias Brunner 94dbbd8079 crypto-factory: Only sort RNGs by algorithm identifier 
Others remain in the order in which they were added, grouped by
algorithm identifier and sorted by benchmarking speed, if provided.
 2014-06-20 16:21:55 +02:00
Tobias Brunner e145f27db7 unit-tests: Add test for crypto_factory_t's rng_create method 2014-06-20 16:21:55 +02:00
Tobias Brunner 90854d289f kernel-netlink: Install virtual IPv6 addresses as deprecated 
This should prevent the kernel's IPv6 source address selection algorithm
from using this address unless it is forced to by our source route.
This is helpful if split tunneling is used.

Fixes #598.
 2014-06-20 16:10:40 +02:00
Tobias Brunner 8661c56d38 vici: Install libvici in ipseclibdir like we do with other libraries 2014-06-19 14:42:07 +02:00
Tobias Brunner 93c68fcd26 Merge branch 'shunt-policies-routes' 
Fixes #599.
 2014-06-19 14:33:50 +02:00
Tobias Brunner 88f125f560 kernel-netlink: Pass prefix when looking up next hop for shunt policies 2014-06-19 14:33:40 +02:00
Tobias Brunner de7cb6de65 kernel-netlink: Add support for destination prefix when determining next hop 2014-06-19 14:33:40 +02:00
Tobias Brunner c005073d0b kernel-interface: Add destination prefix to get_nexthop() 
This allows to determine the next hop to reach a subnet, for instance, when
installing routes for shunt policies.
 2014-06-19 14:33:40 +02:00
Tobias Brunner 73b22aa842 Merge branch 'passthrough-policies-priority' 
Introduces a new priority class for policies, which allows us to install
passthrough policies with a strictly higher priority than IPsec
policies, which was not the case previously depending on the traffic
selectors.
 2014-06-19 14:24:48 +02:00
Tobias Brunner 2ef6f57456 testing: Add ikev2/shunt-policies-nat-rw scenario 2014-06-19 14:23:07 +02:00
Tobias Brunner d93987ce24 testing: Remove ikev2/shunt-policies scenario 
This scenario doesn't really apply anymore (especially its use of drop
policies).
 2014-06-19 14:23:07 +02:00
Tobias Brunner 981466251f shunt-manager: Install passthrough policies with highest priority 
This avoids conflicts with regular IPsec policies.

Similarly, use the lowest priority for drop policies.
 2014-06-19 14:20:33 +02:00
Tobias Brunner 5b883719a1 libipsec: Add support for new policy priority class 2014-06-19 14:20:33 +02:00
Tobias Brunner 77b6a145a0 kernel-pfkey: Add support for new policy priority class 2014-06-19 14:20:33 +02:00
Tobias Brunner f1675e4e29 kernel-netlink: Add support for new policy priority class 2014-06-19 14:20:33 +02:00
Tobias Brunner 479060d2d6 ipsec: Add a fourth priority class for bypass policies 2014-06-19 14:20:33 +02:00
Tobias Brunner 566d1a90cd Remove kernel-klips plugin 2014-06-19 14:20:33 +02:00
Tobias Brunner 3bf98189d7 kernel-netlink: Follow RFC 6724 when selecting IPv6 source addresses 
Instead of using the first address we find on an interface we should
consider properties like an address' scope or whether it is temporary
or public.

Fixes #543.
 2014-06-19 14:16:41 +02:00
Tobias Brunner 6364219281 Merge branch 'ipsec.conf-parser' 
Replaces the ipsec.conf parser in starter.  The new parser is also based
on flex/bison but it simply returns key/value collections of all sections.
It already resolves also= and allows overriding options in all included
sections (not only %default), options set in included section can also
be cleared again (key=).  It provides other improvements too, like quoted
strings	(with escape sequences), unlimited includes and better
whitespace/comment handling.

Fixes #423.
Fixes #560.
 2014-06-19 14:09:09 +02:00
Tobias Brunner f4d29bf16d starter: Don't directly refer to source files in Makefile for unit tests 
Older versions of automake have trouble recursively cleaning such
constructs properly.
 2014-06-19 14:00:49 +02:00
Tobias Brunner 6719c4c828 starter: Explicitly allow @# at the beginning of strings 
Since we treat everything after # as comment identities of type
ID_KEY_ID couldn't be parsed otherwise, unless quoted.
 2014-06-19 14:00:49 +02:00
Tobias Brunner 2d88617e7d starter: Add --conftest option to test ipsec.conf syntax 2014-06-19 14:00:49 +02:00
Tobias Brunner a953f3ad4a starter: Remove old parser 2014-06-19 14:00:49 +02:00
Tobias Brunner 81ba3c1a5e starter: Use new parser to read config file 2014-06-19 14:00:49 +02:00
Tobias Brunner 640c75bb2e starter: Move kw_entry_t definition 2014-06-19 14:00:49 +02:00
Tobias Brunner 8839796c3e starter: Remove unused ARG_LST argument type 2014-06-19 14:00:49 +02:00
Tobias Brunner f245ac6cc0 starter: Add tests for ipsec.conf parser 2014-06-19 14:00:48 +02:00
Tobias Brunner a1625fdc9b unit-tests: Make fixture functions optional 2014-06-19 14:00:48 +02:00
Tobias Brunner f609682e5d starter: Add new bison/flex based parser for ipsec.conf 
The parser simply returns key/value pairs of all sections, it already
resolves also= and allows overriding options in all included sections
(not only %default), options set in included section can also be cleared
again (key=).
It provides other improvements too, like quoted strings (with escape
sequences), unlimited includes and better whitespace/comment handling.
 2014-06-19 14:00:48 +02:00
Tobias Brunner 4ef86a849b starter: Remove out of date README 2014-06-19 14:00:48 +02:00
Tobias Brunner 9dbf2019e2 collections: Add interface for read-only dictionaries 2014-06-19 14:00:48 +02:00
Tobias Brunner 3c206f2e81 hashtable: Add destroy_function method 2014-06-19 14:00:48 +02:00
Tobias Brunner dcb168413f stroke: Add --daemon option 2014-06-19 13:56:38 +02:00
Tobias Brunner 02de66e1bf starter: Use stream abstraction to communicate with stroke plugin 2014-06-19 13:56:37 +02:00
Tobias Brunner 906a409608 stroke: Use stream abstraction to communicate with stroke plugin 
Without this changing charon.plugins.stroke.socket would not really
work.
 2014-06-19 13:56:37 +02:00
Tobias Brunner d6f0372daf testing: Delete accidentally committed test cases 2014-06-18 09:38:53 +02:00
Tobias Brunner abe116cdf8 ikev1: Allow late connection switching based on XAuth username 2014-06-18 09:30:07 +02:00
Tobias Brunner aba55fdffe identification: Only use either , or / to separate RDNs 
If a DN starts with a slash (or whitespace and a slash) slashes will
be used, otherwise commas.
 2014-06-18 09:24:03 +02:00
Tobias Brunner 846fd70eec sshkey: Fix loading of ECDSA keys from files 2014-06-18 09:16:24 +02:00
Tobias Brunner 1cda692110 sshkey: Add support to parse SSH public keys from files with left|rightsigkey 2014-06-18 09:16:24 +02:00
Tobias Brunner 35e08cde3c android: Add all Android.mk files to the tarball 2014-06-06 10:12:26 +02:00
Tobias Brunner acdcb91e07 testing: Cache packages downloaded with pip for strongTNC 
This way no network connections is required to rebuild the root/guest images.
 2014-06-02 17:45:42 +02:00
Tobias Brunner e14507cb71 curl: Don't set CURLOPT_FAILONERROR 
With the strongTNC REST API some errors will actually be accompanied by
a response we want to receive completely.
 2014-05-31 20:37:55 +02:00
Tobias Brunner b2b54bd71d Make sure getpass() is available 
It's not on Android for example.
 2014-05-29 12:28:53 +02:00
Tobias Brunner 95d13fcc3f starter: Fix build on Android 
While the (default) ipsec script does not work on Android starter still
passes the script's name to charon if leftfirewall is configured.
 2014-05-28 18:20:42 +02:00
Tobias Brunner e34905ce7b scripts: Ignore settings-test script 2014-05-20 18:56:43 +02:00
Tobias Brunner b9dfeb5de4 unit-tests: Sync threads with main thread in test_cleanup_cancel() 
Without synchronization threads could get canceled before they could
disable their cancelability.
 2014-05-19 16:06:52 +02:00
Tobias Brunner 403ad5dd85 pfkey: Always include stdint.h 
On some systems (e.g. on Debian/kFreeBSD) that header is required when
including ipsec.h, on Linux we require it too when including pfkeyv2.h,
so to simplify things we just always include it.
 2014-05-19 14:53:24 +02:00