denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,650 Commits 1 Branch 0 Tags
cfdd23b96710dbfe94d5d3f5bb9c23afa0b80e98
Commit Graph
395 Commits
Author SHA1 Message Date
Tobias Brunner cfdd23b967 capabilities: Proper error handling when reading groups 2013-07-24 10:54:26 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi cb6c4e0430 identification: parse identities having a "@@" prefix as ID_RFC822_ADDR 
Original patch by Gerald Richter.
 2013-07-18 16:45:10 +02:00
Tobias Brunner 027676f750 capabilities: Add function to check if a capability is held, without keeping it 
This can be useful if capabilities are not required anymore after
dropping privileges.
 2013-07-18 15:25:35 +02:00
Martin Willi 1e54e40f5d leak-detective: remove hdr entry when reallocating zero bytes 2013-07-12 20:00:16 +02:00
Martin Willi c93cf85356 leak-detective: print total of allocated/leaked bytes in usage/report 2013-07-12 20:00:14 +02:00
Martin Willi 81959e6406 leak-detective: add a usage threshold option based on the number of allocations 2013-07-10 17:28:45 +02:00
Martin Willi 82d0317be6 leak-detective: set_state() only affects the calling thread 
The only user (bfd backtraces) is fine with that, and we really should not
mess the enable flag while doing allocations with other threads.
 2013-07-10 17:28:32 +02:00
Martin Willi f960b39061 leak-detective: take a copy of backtrace while printing traces 
As we don't want to hold the lock, we must make sure backtraces keep valid
while printing them.
 2013-07-10 17:28:24 +02:00
Martin Willi d9c459e855 backtrace: add a clone() method 2013-07-10 17:28:18 +02:00
Martin Willi 3b26f04cf4 leak-detective: remove hdr from the allocation list during realloc() 
If realloc moves an allocation, the original allocation gets freed. We
therefore must remove the hdr from the list, as it is invalid. We can add it
afterwards once it has been updated, allowing us to unlock the list during
reallocation.
 2013-07-10 16:37:08 +02:00
Tobias Brunner f460facdca utils: Add helper function to check a string for a given prefix 2013-07-08 18:49:30 +02:00
Tobias Brunner 985dcab1c2 utils: Convert string helper macros to static inline functions 2013-07-08 18:49:29 +02:00
Tobias Brunner f95205f580 integrity-checker: Use chunk_hash_static() to calculate checksums 2013-06-28 17:00:29 +02:00
Tobias Brunner ed235dbbf2 chunk: Add predictable hash function 
Since chunk_hash() is randomized its output is not predictable, that is,
it is only within the same process.
 2013-06-28 17:00:29 +02:00
Tobias Brunner 75ff252324 integrity-checker: Fix checksum calculation after randomizing chunk_hash() 2013-06-27 15:34:08 +02:00
Tobias Brunner ac2ffde4ae capabilities: Return effective UID/GID if user did not configure anything 2013-06-25 17:16:33 +02:00
Tobias Brunner 5e80e387bd capabilities: Report effective UID/GID after dropping capabilities 2013-06-25 17:16:33 +02:00
Tobias Brunner 1937538440 capabilities: Handle CAP_CHOWN specially as it might not be required 2013-06-25 17:16:33 +02:00
Tobias Brunner 9c354c659f capabilities: Check effective UID as fallback if capabilities are not supported 2013-06-25 17:16:33 +02:00
Tobias Brunner 6f15f5e632 dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets 2013-06-25 17:16:32 +02:00
Tobias Brunner 1dd61bf13d socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024 
Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.
 2013-06-25 17:16:32 +02:00
Tobias Brunner 41b8546ac0 capabilities: Only plugins that require CAP_NET_ADMIN demand it 
The daemon as such does not require this capability.
 2013-06-25 17:16:32 +02:00
Tobias Brunner a2eb581781 capabilities: Move global capabilities_t instance to libstrongswan 2013-06-25 17:16:32 +02:00
Tobias Brunner 2e21bac19a capabilities: Ensure required capabilities are actually held by the process/user 2013-06-25 17:16:32 +02:00
Tobias Brunner 0d2ad63fe2 printf-hook: Avoid double-free when freeing Vstr config 
Thread-specific objects get freed when the thread value object is
destroyed (wasn't the case earlier, i.e. before 2b19dd35), which
may cause the second call to vstr_free_conf() to fail in an assert
in Vstr (depending on how it was built).
 2013-06-21 17:03:20 +02:00
Martin Willi 092550b03a leak-detective: (re-)whitelist some OpenSSL functions 
Some static allocations in plugins won't get freed, because in the test case
process the plugins are not destroyed. If a plugin would clean up allocations
done while just using the plugin, these show up as leak in the child process,
letting tests fail.
 2013-06-21 10:53:23 +02:00
Martin Willi ad58246f53 backtrace: use backtrace_symbols() only if we have backtrace() and dladdr() fails 2013-06-19 16:09:31 +02:00
Tobias Brunner 4d04e2c63b utils: Remove volatile qualifier from refcount_t typedef 
It's not really required anymore (if it ever was) and may cause compiler
warnings when using the non atomic versions of ref_get/ref_put.
 2013-06-19 09:28:30 +02:00
Martin Willi 3160b92adb utils: ref_get() returns the new value of the reference counter 
This allows us to use ref_get() for getting unique values.
 2013-06-11 15:54:27 +02:00
Tobias Brunner f5f7053bcd leak-detective: Resolve hooked functions during initialization 
If uses of dlopen(), e.g. when loading plugins, produce errors an error
string could get allocated dynamically.  At this point realloc() might not
yet be resolved and when dlsym() is later called by leak detective to do
so the error string might get freed while leak detective is disabled and
real_free() will be called with a pointer into one of leak detective's
memory blocks instead of a pointer to the block itself, causing a SIGSEGV.
 2013-06-11 15:48:26 +02:00
Tobias Brunner 01e15ab5c7 Add getter for the number of leaks to leak_detective_t 2013-06-11 11:03:13 +02:00
Tobias Brunner 9947a1f2f4 Gracefully handle NULL as argument for enum_from_name() 2013-06-11 11:03:13 +02:00
Tobias Brunner b1abf22bd0 Fail DN parsing if OID is unterminated 
This is the case if the last OID is not followed by a = or if the string
starts with a =.
 2013-06-11 11:03:12 +02:00
Tobias Brunner f00c350688 Fix DN printing if last RDN has an empty value 2013-06-11 11:03:12 +02:00
Tobias Brunner 10584df24f Fix DN parsing if last RDN has an empty value 2013-06-11 11:03:12 +02:00
Tobias Brunner c04498b608 Fix output of ASN.1 GN 2013-06-11 11:03:12 +02:00
Tobias Brunner 78c37de15a Use chunk_from_str in identification_from_string 
We always have a non-empty string in those cases as "" is now handled
as ID_ANY.
 2013-06-11 11:03:12 +02:00
Tobias Brunner c1be5d66cd Use local variable in chunk_from_str() 
This allows using strdup() or other string functions as argument
without calling them twice.
 2013-06-11 11:03:12 +02:00
Tobias Brunner 456a31e895 Parse empty string as ID_ANY 2013-06-11 11:03:12 +02:00
Tobias Brunner 7b91011d6e Allow memstr() to be called with NULL arguments 2013-06-11 11:03:12 +02:00
Tobias Brunner 438a6693ca Removed unused clalloc() function 2013-06-11 11:03:12 +02:00
Tobias Brunner 819c02dbc6 timeval_add_ms() fixed 
1000000us are exactly 1s so.
 2013-06-11 11:03:12 +02:00
Tobias Brunner bed4bc1327 Randomly allocate chunk_hash() key during first use 
This avoids hash flooding attacks.
 2013-06-11 11:03:11 +02:00
Tobias Brunner d1953fe403 Replace chunk_hash() with output from chunk_mac() 
The quality is way better, the calculation is a bit slower though.

The key is statically initialized to zero, which will be changed later
to prevent hash flooding.
 2013-06-11 11:03:11 +02:00
Tobias Brunner 1255de5a20 Adding chunk_mac() which calculates a 64-bit MAC using SipHash-2-4 2013-06-11 11:03:11 +02:00
Tobias Brunner c480b5f458 Allow memwipe() to be called with NULL argument 2013-05-27 18:41:16 +02:00
Martin Willi e8b2ce1e72 capabilities: leak-detective using dlsym() does not need CAP_SYS_NICE anymore 2013-05-15 17:20:47 +02:00
Martin Willi b1bd63547b capabilities: initialize supplementary groups only when doing a setuid() 2013-05-15 17:20:47 +02:00
Tobias Brunner 651d5ab8e7 openssl: Properly cleanup OpenSSL library 2013-05-08 15:02:40 +02:00