denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,253 Commits 1 Branch 0 Tags
c1410cb045169c47c59459673219f2e7d878c22c
Commit Graph
3337 Commits
Author SHA1 Message Date
Tobias Brunner c1410cb045 openssl: Whitelist OPENSSL_init_crypto() and others in leak detective 
Lots of static data is allocated in this function, which isn't freed until
the library is unloaded (we can't call OPENSSL_cleanup() as initialization
would fail when calling it again later).  When enabling the leak
detective the test runner eventually crashes as all the data allocated during
initialization has an invalid size when freed after leak detective has been
unloaded.
 2016-06-29 11:09:38 +02:00
Tobias Brunner fedec33f5a openssl: Update GCM/crypter API to OpenSSL 1.1.0 2016-06-29 11:09:38 +02:00
Tobias Brunner 97b1a27f43 openssl: Update HMAC API to OpenSSL 1.1.0 2016-06-29 11:09:38 +02:00
Tobias Brunner cd08eb84cb openssl: Don't use deprecated RAND_pseudo_bytes() 2016-06-29 11:09:38 +02:00
Tobias Brunner 985d7b1c67 openssl: Update PKCS#12 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner a9f388e368 openssl: Update PKCS#7 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 989ba4b6cd openssl: Update CRL API to OpenSSL 1.1.0 
There is currently no way to compare the outer and inner algorithms
encoded in a parsed CRL.  X509_CRL_verify() does not seem to check that
either, though (unlike X509_verify()).
 2016-06-29 11:09:37 +02:00
Tobias Brunner 08d7e1f190 openssl: Update x509 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 6688f7986e openssl: Update ECDSA API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 3fb2c8edb7 openssl: Update RSA API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 375a5ed240 openssl: Make some utilities take const BIGNUM pointers 2016-06-29 11:09:37 +02:00
Tobias Brunner 6d5df086f7 openssl: Add macro to define fallback functions for non-opaque OpenSSL versions 2016-06-29 11:09:37 +02:00
Tobias Brunner 54d629b7ad openssl: Update DH API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 1b36fbedf5 openssl: Update crypter API to OpenSSL 1.1.0 
EVP_CIPHER and EVP_CIPHER_CTX are now opaque types, the getters already
existed before.
 2016-06-29 11:09:37 +02:00
Tobias Brunner faa904fb0b openssl: Fix mapping from ASN1 to chunk_t with OpenSSL 1.1.0 
ASN1_OBJECT is now opaque.
 2016-06-29 11:09:37 +02:00
Tobias Brunner e2abe7ae97 openssl: Update initialization and cleanup for OpenSSL 1.1.0 
We can't call OPENSSL_cleanup() as that would prevent us from
re-initializing the library again (which we use in the Android app, that
loads/unloads plugins).
 2016-06-29 11:09:36 +02:00
Tobias Brunner a6c43a8d8a openssl: OpenSSL 1.1.0 is thread-safe so we don't have to setup callbacks 2016-06-29 11:09:36 +02:00
Tobias Brunner 2f211ced9c proposal: Parse modpnone as MODP_NONE(0) 2016-06-17 18:48:07 +02:00
Tobias Brunner 990c62cdcc crypto-factory: Stop after successfully creating one nonce generator 
Fixes: e2fc09c186 ("Add nonce generator interface")
 2016-06-17 18:48:02 +02:00
Tobias Brunner b104b2a737 unit-tests: Defining TESTS_RUNNERS allows to only run specific test runners 2016-06-17 18:48:01 +02:00
Tobias Brunner e0c59faa68 leak-detective: Make sure to actually call malloc() from calloc() hook 
Newer versions of GCC are too "smart" and replace a call to malloc(X)
followed by a call to memset(0,X) with a call co calloc(), which obviously
results in an infinite loop when it does that in our own calloc()
implementation.  Using `volatile` for the variable storing the total size
prevents the optimization and we actually call malloc().
 2016-06-15 16:21:47 +02:00
Tobias Brunner 8f1806605d leak-detective: Whitelist __fprintf_chk as seen on newer systems 2016-06-15 11:21:39 +02:00
Martin Willi 518a5b2ece configure: Check for and explicitly link against -latomic 
Some C libraries, such as uClibc, require an explicit link for some atomic
functions. Check for any libatomic, and explcily link it.
 2016-06-14 14:27:20 +02:00
Tobias Brunner a046f929ce android: Use non-aliased cipher identifiers 
Some of these are also understood by BoringSSL.

Fixes #1510.
 2016-06-13 10:38:20 +02:00
Tobias Brunner 3c12905103 ipsec: Add function to compare two ipsec_sa_cfg_t instances 
memeq() is currently used to compare these but if there is padding that
is not initialized the same for two instances the comparison fails.
Using this function ensures the objects are compared correctly.
 2016-06-08 16:12:39 +02:00
Tobias Brunner a366fa365e identification: Compare identity types when comparing ID_FQDN/ID_RFC822_ADDR identities 
References #1380.
 2016-06-06 13:49:41 +02:00
Tobias Brunner 9aaea4dbfe x509: Properly wrap keyid in authorityKeyIdentifier in attribute certificates 
The correct encoding got lost in bdec2e4f52 ("refactored openac and
its attribute certificate factory").

Fixes #1370.
 2016-06-06 13:46:11 +02:00
Martin Willi 294ac097d6 af-alg: Silently skip probing algorithms if AF_ALG is not supported 
If the af-alg plugin is enabled, but kernel support is missing, we get
an error line during startup for each probed algorithm. This is way too
verbose, so just skip probing if AF_ALG is unsupported.
 2016-05-19 11:13:24 +02:00
Tobias Brunner 0ba905cf24 mem-cred: Fix memory leak when replacing existing CRLs 
Fixes #1442.
 2016-05-11 12:16:36 +02:00
Yannick Cann 49fa6ebf1c identification: Add support for dmdName RDN (2.5.4.54) 
It's listed in RFC 2256 but was later removed with RFC 4519, but there
are still some certs that use it.

Closes strongswan/strongswan#43.
 2016-04-25 17:06:04 +02:00
Andreas Steffen c87f428836 leak-detective: added _IO_file_doallocate to whitelist 2016-04-24 23:34:44 +02:00
Tobias Brunner 689bb34958 curl: Add TLS support if libcurl is built against BoringSSL 
We don't have to rely on the openssl plugin and its threading
initialization as BoringSSL is thread-safe out of the box.
 2016-04-15 10:32:53 +02:00
Tobias Brunner 47a46be597 openssl: BoringSSL does not support configuration 
The other initialization functions are still defined but many are
apparently no-ops (this is also true for the threading initialization).
 2016-04-15 10:32:53 +02:00
Tobias Brunner c8a219a28d openssl: The member storing the DH exponent length has been renamed in BoringSSL 2016-04-15 10:32:53 +02:00
Tobias Brunner 77df573a95 openssl: Use proper EVP macro to determine size of a hash 2016-04-15 10:32:52 +02:00
Tobias Brunner de9b3491ad curl: Handle LibreSSL like OpenSSL in regards to multi-threading 
LibreSSL is API compatible so our openssl plugin does not need any
changes and it works fine with the curl plugin.
 2016-04-15 10:31:19 +02:00
Tobias Brunner 960632ffb0 thread: Don't hold mutex when calling cleanup handlers while terminating 
This could interfere with cleanup handlers that try to acquire
mutexes while other threads holding these try to e.g. cancel the threads.

As cleanup handlers are only queued by the threads themselves we don't need
any synchronization to access the list.

Fixes #1401.
 2016-04-13 13:55:20 +02:00
Tobias Brunner 7316a13bd1 pkcs11: Skip zero-padding of r and s when preparing EC signature 
They are zero padded to fill the buffer.

Fixes #1377.
 2016-04-05 16:17:10 +02:00
Tobias Brunner b82b5f6398 chunk: Skip all leading zero bytes in chunk_skip_zero() not just the first 2016-04-04 15:39:42 +02:00
Tobias Brunner 85597f2983 string: Gracefully handle NULL in str*eq() macros 2016-04-04 10:43:46 +02:00
Tobias Brunner 90c8cf6819 byteorder: Explicitly check for htoXeXX macros 
Some platforms have XetohXX macros instead of XeXXtoh macros, in which
case we'd redefine the htoXeXX macros.
 2016-03-31 19:47:31 +02:00
Tobias Brunner e8bddd64fc proposal: Use standard integer types for static keywords 2016-03-31 09:25:19 +02:00
Tobias Brunner c545688788 utils: Remove nonsensical typedefs for standard uint types 2016-03-31 09:25:11 +02:00
Andreas Steffen aaa4e478b1 Use u_int32_t legacy type in blowfish header file 2016-03-24 20:58:32 +01:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner 17e36cd48c android: Enable build against API level 21 
While building against this level in general would break our app on
older systems, the NDK will automatically use this level for 64-bit
ABI builds (which are not supported in older levels).  So to build
against 64-bit ABIs we have to support this API level.
 2016-03-23 14:18:37 +01:00
Tobias Brunner 755d076fec Fix some Doxygen issues 2016-03-11 12:25:14 +01:00
Tobias Brunner 0fc8b1d03e identification: Make written signed to fix error checking when printing ranges 2016-03-11 10:09:02 +01:00
Andreas Steffen 1d86d1d65a Implemented IPv4/IPv6 subnet and range identities 
The IKEv1 IPV4_ADDR_SUBNET, IPV6_ADDR_SUBNET, IPV4_ADDR_RANGE and
IPV6_ADDR_RANGE identities have been fully implemented and can be
used as owners of shared secrets (PSKs).
 2016-03-10 13:59:37 +01:00
Tobias Brunner ef9171ad1e auth-cfg: Add a rule to suspend certificate validation constraints 2016-03-10 11:07:14 +01:00