Commit Graph

Select branches

Hide Pull Requests

main

Mono Color

• 1487dbb4a3 pgp: Log parsed packet data on level 4 as it may contain a private key Tobias Brunner 2026-06-29 16:01:55 +02:00
• 4e7ade053e keymat_v2: Explicitly clear key derived during EAP/PSK authentication Tobias Brunner 2026-06-29 15:46:52 +02:00
• 7a1c801512 vici: Also wipe cached PINs during clear-creds command Tobias Brunner 2026-06-29 15:41:08 +02:00
• 14a811b6af curve25519: Explicitly wipe shared secret when destroying DH object Tobias Brunner 2026-06-29 15:32:05 +02:00
• d3d7a27e46 eap-aka-3gpp: Fix length when logging AUTS and increase some log levels Tobias Brunner 2026-07-12 20:22:17 +02:00
• 7a215e568e eap-aka-3gpp2: Log potentially sensitive material on level 4 Tobias Brunner 2026-06-29 15:26:17 +02:00
• b31ce69722 eap-ttls: Add an upper bound for the length of the parsed AVP Tobias Brunner 2026-06-29 14:03:45 +02:00
• 43584ad981 ike-sa-manager: Fix some inaccuracies in the header file Tobias Brunner 2026-06-25 19:31:36 +02:00
• 207ae20aa6 mediation-manager: Avoid potential use-after-free when checking online status Tobias Brunner 2026-06-25 18:56:23 +02:00
• c485080958 connmark: Fix undefined shift if traffic selector is /0 Tobias Brunner 2026-06-25 18:23:10 +02:00
• 117cf65030 forecast: Fix undefined shift if traffic selector is /0 Tobias Brunner 2026-06-25 18:21:14 +02:00
• d5e7426c4c ikev1: Fix arguments when logging a UNITY_LOAD_BALANCE with invalid address Tobias Brunner 2026-06-25 16:41:26 +02:00
• 65a30f7bab child-create: Fix crash when responder doesn't send TS payloads Tobias Brunner 2026-06-25 11:31:09 +02:00
• 4611f41b1e child-rekey: Only reset state of SAs not actively rekeyed if passive rekeying fails Tobias Brunner 2026-06-05 08:12:05 +02:00
• 929065826b sqlite: Fix transaction handling for multiple concurrent threads Tobias Brunner 2026-06-24 18:54:04 +02:00
• bcef2c8f01 atomics: Use ACQUIRE ordering for ref_cur() Tobias Brunner 2026-07-22 23:58:50 +02:00
• 6b58665697 kernel-wfp: Uninstall policies before deleting provider Tobias Brunner 2026-06-24 15:34:01 +02:00
• 5e89dd5c4d tls-crypto: Reject signature schemes not actually defined for current TLS version Tobias Brunner 2026-06-24 14:26:55 +02:00
• c720ae2307 pts-file-meas: Fix mismatch between hash buffer size and largest possible hash Tobias Brunner 2026-06-24 13:26:24 +02:00
• 2c65dacf60 me: Avoid crash when processing endpoint with invalid NO_FAMILY Tobias Brunner 2026-06-25 16:20:24 +02:00
• d8c7fe0634 connect-manager: Ignore connectivity checks for incomplete checklists Tobias Brunner 2026-06-24 11:43:47 +02:00
• dd94e8d70e systime-fix: Unregister validator also if time got valid Tobias Brunner 2026-06-24 11:15:39 +02:00
• be4b9f4aaa xauth-pam: Properly initialize response array when handling sessions Tobias Brunner 2026-06-23 19:11:06 +02:00
• 66f0f3a599 kernel-netlink: Add some safety checks when printing extended error messages Tobias Brunner 2026-06-23 17:47:50 +02:00
• b52fc6c284 stream-service: Avoid race condition when accepting sockets Tobias Brunner 2026-06-23 16:09:07 +02:00
• c3b99c6982 ip-packet: Properly skip IPv6 fragment headers Tobias Brunner 2026-06-23 14:58:36 +02:00
• 2eeb8965ed pkcs11: Fix ECDH derivation Tobias Brunner 2026-06-23 14:35:36 +02:00
• 75baeb9f35 constraints: Fallback to binary OIDs in log messages Tobias Brunner 2026-06-23 09:49:26 +02:00
• a5d815a6ef certificate-printer: Fallback to binary OID printing for policy mappings Tobias Brunner 2026-06-23 09:44:51 +02:00
• 502fa14536 asn1: Reject OIDs with too large sub-identifiers when converting to string Tobias Brunner 2026-06-22 19:02:28 +02:00
• dafb082ae0 libtls: Check padding and MAC in constant time Tobias Brunner 2026-06-22 12:58:32 +02:00
• 1372335d30 constant-time: Add 64-bit versions of the helpers Tobias Brunner 2026-06-22 17:30:11 +02:00
• db3f4c2955 eap-radius: Avoid NULL-pointer dereference in XAuth backend Tobias Brunner 2026-06-22 16:42:32 +02:00
• 9965a64723 ike-me: Fix safety check to ensure peer ID payload in ME_CONNECT request Tobias Brunner 2026-06-19 19:43:21 +02:00
• 4feb31d0e6 tls-peer: Fix memory leak when processing Finished messages with TLS 1.3 fails Tobias Brunner 2026-07-13 19:21:41 +02:00
• be0ee2e806 tls-server: Fix memory leaks when processing certificates or Finished messages Tobias Brunner 2026-06-19 17:29:12 +02:00
• b031cd27a8 connmark: Fix addresses when removing policies in ike_update() handler Tobias Brunner 2026-06-19 18:48:49 +02:00
• fe6dc7d256 af-alg: Fix output offset if not all data was processed during en-/decryption Tobias Brunner 2026-06-19 17:12:47 +02:00
• 289d776904 dhcp: Make sure to only modify transactions after receiving an expected DHCP OFFER Tobias Brunner 2026-06-19 17:00:53 +02:00
• 8c696dc90a proposal-substructure: Avoid unaligned memory access when reading SPI Tobias Brunner 2026-06-19 15:52:31 +02:00
• d13b384536 byteorder: Add helpers to read from unaligned addresses without byte order changes Tobias Brunner 2026-06-19 15:46:24 +02:00
• d19591edda charon-tkm: charon: Avoid potential TOCTOU issues when accessing/writing PID file Tobias Brunner 2026-06-19 15:18:13 +02:00
• 18a104657e charon: Avoid potential TOCTOU issues when accessing/writing PID file Tobias Brunner 2026-06-19 15:08:51 +02:00
• 7bf9b6bad8 x509: Avoid memory leak if multiple nonce extensions are found in OCSP response Tobias Brunner 2026-06-19 14:34:25 +02:00
• 7a316d9159 kernel-libipsec: Remove exclude route (reference) if route is updated Tobias Brunner 2026-06-19 19:28:00 +02:00
• e36a8c0d62 kernel-pfkey: Remove exclude route (reference) if route is updated Tobias Brunner 2026-06-19 14:08:23 +02:00
• cef4bce3e1 controller: Properly notify waiting thread after INVALID_KE_PAYLOAD retry failed Tobias Brunner 2026-06-19 12:33:01 +02:00
• a885a3da60 pts: Verify PCR info during verification and reject mismatches Andreas Steffen 2026-06-19 15:28:22 +02:00
• e1609d8159 forecast: Make BPF statements for metadata reads clearer Tobias Brunner 2026-06-15 16:21:34 +02:00
• 7e7c2805df identification: Avoid truncating identities created from data blobs Tobias Brunner 2026-06-17 18:42:06 +02:00
• 45b2f8d91f revocation: Avoid that a skipped CRL lookup/fetch prevents fetching delta CRLs Tobias Brunner 2026-06-17 18:12:12 +02:00
• 8323fbaee7 eap-peap: Don't allow authenticated client to skip EAP-TNC with unexpected EAP-SUCCESS Tobias Brunner 2026-06-17 15:37:39 +02:00
• 4110d2795a windows: Avoid unnecessarily locking the global thread lock when removing TLS Tobias Brunner 2026-06-17 14:53:51 +02:00
• 097c7a1e0a process: Correctly read last path character on Windows Tobias Brunner 2026-06-17 14:22:39 +02:00
• 6dfebcede5 radius-socket: Fix timeout handling when waiting for responses Tobias Brunner 2026-06-17 12:03:23 +02:00
• 67bf0051c4 android: Fix memory leaks in DNS proxy Tobias Brunner 2026-06-17 10:56:12 +02:00
• 5e51fc7902 tnc-pdp: Fix lock type when adding/replacing a connection Tobias Brunner 2026-06-25 09:56:06 +02:00
• dc8fa5fea5 tnc-pdp: Don't remove watcher callbacks on failures Tobias Brunner 2026-06-16 19:48:46 +02:00
• 2cea90423a ipsec-sa-mgr: Delete pre-allocated SPI if creating CHILD_SA fails Tobias Brunner 2026-06-16 19:27:48 +02:00
• 87f0bc2a6c cert-cache: Fix race conditions when inserting CRL/OCSP Tobias Brunner 2026-06-16 18:34:39 +02:00
• bff18d9048 tls-protection: Reject unencrypted TLS 1.3 records Tobias Brunner 2026-06-16 17:59:05 +02:00
• cfc72fe901 eap-aka-3gpp2: Fix SQN generation Tobias Brunner 2026-06-16 10:00:55 +02:00
• 371c35612c eap-aka-3gpp: Fix SQN generation Tobias Brunner 2026-06-16 09:01:13 +02:00
• eec3164b41 xauth-pam: Avoid race for multiple concurrent authentication attempts Tobias Brunner 2026-06-15 18:27:06 +02:00
• 4bef380ce0 eap-simaka-reauth: Prevent corrupting hashtables during concurrent accesses Tobias Brunner 2026-06-15 18:11:48 +02:00
• 0b5143ae04 eap-simaka-pseudonym: Prevent corrupting hashtables during concurrent accesses Tobias Brunner 2026-06-15 17:39:07 +02:00
• e53e2c7ff6 eap-mschapv2: Remove retry after failed attempts Tobias Brunner 2026-06-15 08:42:57 +02:00
• 163e7bd6db tnccs_11: Fix memory leak if multiple Base64 tags are found Tobias Brunner 2026-06-15 17:24:55 +02:00
• 0a9445a7c1 pt-tls-server: Fix leak if SASL authentication failed Tobias Brunner 2026-06-19 18:18:35 +02:00
• dbaca2dffe pt-tls-server: Properly fail if processing PB-TNC batches failed Tobias Brunner 2026-06-15 16:51:46 +02:00
• 355d591967 openssl: Fix memory leak if HMAC instantiation fails late Tobias Brunner 2026-06-15 15:36:34 +02:00
• 3a30390d91 kernel-wfp: Fix remote port in traffic selectors in acquires Tobias Brunner 2026-06-12 18:26:22 +02:00
• 9598de465c unit-tests: Add tests to ensure our Curve25519/448 implementations don't return all-zero secrets Tobias Brunner 2026-06-12 18:01:39 +02:00
• 589a3a6729 curve25519: Reject all-zero shared secrets Tobias Brunner 2026-06-12 17:44:55 +02:00
• 4436c12183 coupling: Avoid potential access by multiple threads to shared hasher Tobias Brunner 2026-06-12 17:21:16 +02:00
• 0a53da7cd8 ita-comp-ima: Handle missing validation URI gracefully Tobias Brunner 2026-06-12 16:51:34 +02:00
• d9cf1b0bff wolfssl: Avoid potential RNG state corruption during RSA/ECDSA operations Tobias Brunner 2026-06-15 13:37:12 +02:00
• 05625acc2a wolfssl: Ensure X25519/X448 public key is valid Tobias Brunner 2026-06-12 17:07:32 +02:00
• 1fe813f05e wolfssl: Fix memory leak on failed ICV verification if not using in-place decryption Tobias Brunner 2026-06-12 16:43:05 +02:00
• 023c626525 openssl: Fix memory leak on failed ICV verification if not using in-place decryption Tobias Brunner 2026-06-12 16:40:05 +02:00
• c6adb20ec7 chapoly: Fix memory leak on failed ICV verification if not using in-place decryption Tobias Brunner 2026-06-12 16:37:53 +02:00
• 85c02dc16c ccm: Fix memory leak on failed ICV verification if not using in-place decryption Tobias Brunner 2026-06-12 16:44:58 +02:00
• 40aa0a12c4 botan: Fix memory leak on failed ICV verification if not using in-place decryption Tobias Brunner 2026-06-12 16:41:33 +02:00
• a2f83d3075 aesni: Fix memory leak on failed ICV verification if not using in-place decryption Tobias Brunner 2026-06-12 16:14:48 +02:00
• dae65dd492 esp-packet: Fix leak and avoid one if AEAD implementations misbehave Tobias Brunner 2026-06-12 16:23:40 +02:00
• f5aeba0f02 watcher: Remove unnecessary pending flag Tobias Brunner 2026-06-12 13:08:00 +02:00
• 87bbfe4f5f gcm: Implement block multiplication in constant time Tobias Brunner 2026-06-12 13:06:41 +02:00
• 577d4d16f6 charon-tkm: Document that public_key_t::verify() is a dummy implementation Tobias Brunner 2026-06-12 12:18:49 +02:00
• bdbdd46941 medsrv: Add missing return to avoid infinite loop while verifying username Tobias Brunner 2026-06-12 10:22:59 +02:00
• fcac9fe5df tls-socket: Avoid accessing stale data when processing application data Tobias Brunner 2026-06-11 15:48:00 +02:00
• b3c0019c84 pgp: Fix validity calculation and potential overflow Tobias Brunner 2026-06-11 17:52:01 +02:00
• 3582906332 github: Disable SonarQube's (beta) taint analysis Tobias Brunner 2026-07-20 18:18:06 +02:00
• 33917415df github: Use tpm2-tss 4.2.0 for tests Tobias Brunner 2026-07-20 17:08:12 +02:00
• 4eb3391801 github: Use AWS-LC 5.3.0 for tests Tobias Brunner 2026-07-20 17:07:50 +02:00
• 6894b33e6d child-create: Don't fail creating IKE SA if only Child SA installation fails Tobias Brunner 2026-07-20 16:30:39 +02:00
• 8cd4ac9f53 github: Use latest SonarQube action Tobias Brunner 2026-07-14 11:11:10 +02:00
• 24c70db4b9 aesni: Split plugin to avoid potential SIGILL Tobias Brunner 2026-07-10 07:51:10 +02:00
• 9d5e619e19 ha: Make receive buffer size for the HA socket configurable Tobias Brunner 2026-07-01 11:43:15 +02:00
• 3ef091815f testing: Run test scripts in a subshell so we can properly cancel them Tobias Brunner 2026-07-06 17:10:04 +02:00
• fa56cca73b testing: Format link to test results as OSC 8 hyperlink Tobias Brunner 2026-06-30 19:11:57 +02:00