]>
git.ipfire.org Git - people/ms/strongswan.git/log
Tobias Brunner [Tue, 28 Jan 2014 08:29:14 +0000 (09:29 +0100)]
unit-tests: Add tests for setters in settings_t
Tobias Brunner [Tue, 28 Jan 2014 08:03:38 +0000 (09:03 +0100)]
unit-tests: Add basic tests for settings_t
Tobias Brunner [Wed, 22 Jan 2014 10:50:39 +0000 (11:50 +0100)]
lib: Add global config namespace
Tobias Brunner [Wed, 12 Feb 2014 13:34:09 +0000 (14:34 +0100)]
pool: Typo in Makefile fixed
Tobias Brunner [Wed, 12 Feb 2014 13:23:32 +0000 (14:23 +0100)]
Merge branch 'sql-install'
SQL schemas and example data (IMV) are now part of the distribution and
installed in $prefix/share/strongswan. This way no extra copy is needed
for the test suite and distributions can easily pack those files together
with the plugins.
Tobias Brunner [Wed, 12 Feb 2014 13:21:26 +0000 (14:21 +0100)]
pool: Install SQL schemas from src/pool
This allows us to install the schemas if either the attr-sql or sql
plugin is enabled, since both use the same schema (at least in parts).
Tobias Brunner [Tue, 11 Feb 2014 19:50:32 +0000 (20:50 +0100)]
sql: Set default values for some fields in addresses table
Tobias Brunner [Fri, 7 Feb 2014 17:03:02 +0000 (18:03 +0100)]
testing: Use installed PTS SQL schema and data instead of local copy
Tobias Brunner [Fri, 7 Feb 2014 16:58:41 +0000 (17:58 +0100)]
testing: Use installed SQL schema instead of local copy
Tobias Brunner [Fri, 7 Feb 2014 16:48:16 +0000 (17:48 +0100)]
libimcv: Install SQL files in /usr/share/strongswan/templates/database
Tobias Brunner [Fri, 7 Feb 2014 16:43:50 +0000 (17:43 +0100)]
sql: Install SQL schemas in /usr/share/strongswan/templates/database
Tobias Brunner [Fri, 7 Feb 2014 16:45:32 +0000 (17:45 +0100)]
sql: Remove unused cred.sql snippet
Tobias Brunner [Wed, 5 Feb 2014 17:06:15 +0000 (18:06 +0100)]
asn1: Support dates before 1970-01-01 (i.e. when time_t gets negative)
On x86 we allow "overflows" around 1969/1970 but not for other dates.
Fixes #509.
Tobias Brunner [Wed, 5 Feb 2014 16:55:58 +0000 (17:55 +0100)]
asn1: Add additional validation for parsed ASN.1 date/time values
Tobias Brunner [Fri, 7 Feb 2014 09:04:22 +0000 (10:04 +0100)]
ikev1: Fix config switching due to failed authentication during Aggressive mode
The encoded ID payload gets destroyed by the authenticator, which caused
a segmentation fault after the switch.
Fixes #501.
Tobias Brunner [Fri, 7 Feb 2014 10:37:58 +0000 (11:37 +0100)]
kernel-pfroute: Don't cache route entries if installation fails
Tobias Brunner [Fri, 7 Feb 2014 10:37:30 +0000 (11:37 +0100)]
kernel-netlink: Don't cache route entries if installation fails
Fixes #500.
Tobias Brunner [Mon, 27 Jan 2014 12:50:28 +0000 (13:50 +0100)]
identification: Fix printing of empty RDNs on FreeBSD
On FreeBSD (null) is printed for NULL even if the precision is 0.
Tobias Brunner [Mon, 27 Jan 2014 12:50:06 +0000 (13:50 +0100)]
tests: Fix test for printing NULL on FreeBSD
Andreas Steffen [Wed, 12 Feb 2014 12:21:46 +0000 (13:21 +0100)]
Fixed description of ikev1/rw-ntru-psk scenario
Andreas Steffen [Wed, 12 Feb 2014 12:16:09 +0000 (13:16 +0100)]
Updated test kvm tests to Linux 3.13 kernel
Andreas Steffen [Wed, 12 Feb 2014 12:14:23 +0000 (13:14 +0100)]
Added ikev1/net2net-ntru-cert and ikev1/rw-ntru-psk scenarios
Tobias Brunner [Wed, 12 Feb 2014 09:53:17 +0000 (10:53 +0100)]
testing: Add ssh script to distribution
Andreas Steffen [Mon, 10 Feb 2014 20:28:54 +0000 (21:28 +0100)]
unit-tests: added asn1_parser tests
Andreas Steffen [Mon, 10 Feb 2014 15:05:55 +0000 (16:05 +0100)]
unit-tests: added some more ASN.1 length tests
Thomas Egerer [Mon, 10 Feb 2014 16:14:24 +0000 (17:14 +0100)]
leak_detective: Assign return value of realloc to buf
If realloc return a pointer value different from the value to be
reallocated, a double free can occur in this context.
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
Martin Willi [Mon, 10 Feb 2014 10:21:09 +0000 (11:21 +0100)]
rdrand: Provide get_features() regardless of RDRAND availability
As having no get_features() raises a deprecated warning, we return no features
instead.
Martin Willi [Mon, 10 Feb 2014 10:07:50 +0000 (11:07 +0100)]
rdrand: Move RDRAND detection log to level 2
When having RDRAND support, these log messages might be confusing when using
pki or other tools.
Martin Willi [Thu, 6 Feb 2014 15:38:39 +0000 (16:38 +0100)]
updown: Return an empty DNS server enumerator if no IKE_SA available
The one existing caller does not handle a NULL return and always expects
an enumerator; and returning FALSE does not make sense anyway.
Martin Willi [Thu, 6 Feb 2014 14:58:41 +0000 (15:58 +0100)]
Merge branch 'cmd-proposals'
Introduce --ike/esp/ah-proposal options to offer custom proposals, and requests
an IPv6 virtual IP if an IPv6 --remote-ts is given.
Fixes #508.
Martin Willi [Tue, 4 Feb 2014 15:40:25 +0000 (16:40 +0100)]
charon-cmd: Request an IPv6 virtual IP if an IPv6 remote subnet given
Martin Willi [Tue, 4 Feb 2014 10:37:52 +0000 (11:37 +0100)]
charon-cmd: Document new proposal options in manpage
Martin Willi [Tue, 4 Feb 2014 10:29:28 +0000 (11:29 +0100)]
charon-cmd: Add --esp/--ah-proposal options to specify CHILD_SA proposals
Martin Willi [Tue, 4 Feb 2014 10:17:37 +0000 (11:17 +0100)]
charon-cmd: Add an --ike-proposal option to specify non-default IKE proposals
Martin Willi [Tue, 4 Feb 2014 10:14:27 +0000 (11:14 +0100)]
charon-cmd: Block SIGUSR1 on worker threads
To properly shut down charon-cmd with leak reports, only the main thread
should catch SIGUSR1 to shut down the application. Work threads should ignore
SIGUSR1 to avoid any hard application termination.
Andreas Steffen [Wed, 5 Feb 2014 11:06:46 +0000 (12:06 +0100)]
Document ipsec attest --session command
Andreas Steffen [Wed, 5 Feb 2014 11:06:22 +0000 (12:06 +0100)]
Allow output of session time in UTC
Andreas Steffen [Wed, 5 Feb 2014 09:15:56 +0000 (10:15 +0100)]
Added missing semicolon in SQL statements
Andreas Steffen [Tue, 4 Feb 2014 18:49:34 +0000 (19:49 +0100)]
Added Android 4.3.1 to products database table
Andreas Steffen [Tue, 4 Feb 2014 05:59:01 +0000 (06:59 +0100)]
Added new Android versions to PTS database
Martin Willi [Fri, 31 Jan 2014 16:51:45 +0000 (17:51 +0100)]
testing: Fetch the FreeRADIUS tarball from the "old" directory
Fixes #483.
Martin Willi [Thu, 30 Jan 2014 17:05:46 +0000 (18:05 +0100)]
unit-tests: Add some test cases for HTTP GET/POST fetches
Martin Willi [Wed, 29 Jan 2014 12:36:56 +0000 (13:36 +0100)]
unit-tests: Fix test_runner_run() apidoc
Tobias Brunner [Fri, 24 Jan 2014 15:16:08 +0000 (16:16 +0100)]
pki: Declare correct section in pki --issue man page
Martin Willi [Fri, 24 Jan 2014 12:18:45 +0000 (13:18 +0100)]
NEWS: Add unit testing improvements
Martin Willi [Thu, 7 Nov 2013 08:21:02 +0000 (09:21 +0100)]
ike: Restart inactivity counter after doing a CHILD_SA rekey
When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity
job is queued for a time unrelated to the rekey time, so it might happen
that the inactivity job gets executed just after rekeying. If this happens,
inactivity is detected even if we had traffic on the rekeyed CHILD_SA just
before rekeying.
This change implies that inactivity checks can't handle inactivity timeouts
for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter
than the rekey time to have any effect.
Martin Willi [Thu, 7 Nov 2013 08:20:40 +0000 (09:20 +0100)]
child-sa: Add a getter for CHILD_SA install time
Martin Willi [Thu, 23 Jan 2014 15:14:46 +0000 (16:14 +0100)]
Merge branch 'pam-session'
Add support for PAM session management in xauth-pam.
Martin Willi [Thu, 23 Jan 2014 15:11:54 +0000 (16:11 +0100)]
NEWS: Introduce PAM session management
Martin Willi [Wed, 22 Jan 2014 13:31:22 +0000 (14:31 +0100)]
man: Document xauth-pam session option
Andrea Bonomi [Tue, 21 Jan 2014 08:54:20 +0000 (09:54 +0100)]
xauth-pam: Open/close a PAM session for each connected client
Signed-off-by: Andrea Bonomi <a.bonomi@endian.com>
Martin Willi [Wed, 22 Jan 2014 13:01:01 +0000 (14:01 +0100)]
xauth-pam: Sanitize XAuth attributes before passing them to PAM
Martin Willi [Thu, 23 Jan 2014 15:04:48 +0000 (16:04 +0100)]
Merge branch 'vendor-ids'
Refactors IKEv2 vendor ID handling, and introduces some IDs seen when talking
to Cisco devices.
Martin Willi [Fri, 17 Jan 2014 11:00:13 +0000 (12:00 +0100)]
ikev2: Add Cisco FRAGMENTATION vendor ID
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
Martin Willi [Fri, 17 Jan 2014 10:58:12 +0000 (11:58 +0100)]
ikev2: Add Cisco Copyright vendor ID
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
Martin Willi [Fri, 17 Jan 2014 10:57:47 +0000 (11:57 +0100)]
ikev2: Add Cisco Delete Reason vendor ID
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
Martin Willi [Fri, 17 Jan 2014 10:37:35 +0000 (11:37 +0100)]
ikev2: Use a more dynamic vendor ID database, as we use with IKEv1
Martin Willi [Thu, 23 Jan 2014 14:55:44 +0000 (15:55 +0100)]
Merge branch 'chunk-mmap'
Introduces file mmap/munmap() wrappers and provides a fallback if mmap() is not
supported. Replaces all mmap() uses by the new functions.
Martin Willi [Thu, 21 Nov 2013 13:49:19 +0000 (14:49 +0100)]
libpts: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:49:57 +0000 (14:49 +0100)]
tnccs: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:49:37 +0000 (14:49 +0100)]
pem: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:48:03 +0000 (14:48 +0100)]
stroke: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:47:23 +0000 (14:47 +0100)]
radattr: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:48:23 +0000 (14:48 +0100)]
libfast: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:50:30 +0000 (14:50 +0100)]
integrity-checker: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:22:01 +0000 (14:22 +0100)]
chunk: Externalize error reporting in chunk_write()
This avoids passing that arbitrary label just for error messages, and gives
greater flexibility in handling errors.
Martin Willi [Thu, 21 Nov 2013 13:07:12 +0000 (14:07 +0100)]
chunk: Provide a fallback chunk_map() if mmap is not available
Martin Willi [Thu, 21 Nov 2013 11:19:20 +0000 (12:19 +0100)]
chunk: Use dynamically allocated buffer in chunk_from_fd()
When acting on files, we can use fstat() to estimate the buffer size. On
non-file FDs, we dynamically increase an allocated buffer.
Additionally we slightly change the function signature to properly handle
zero-length files and add appropriate unit tests.
Martin Willi [Thu, 21 Nov 2013 10:29:46 +0000 (11:29 +0100)]
chunk: Add functions to map file contents to a chunk
Tobias Brunner [Thu, 23 Jan 2014 10:19:38 +0000 (11:19 +0100)]
Merge branch 'unity-fixes'
Improves compatibility with the Cisco and Shrew clients.
Fixes #445.
Tobias Brunner [Fri, 15 Nov 2013 15:45:59 +0000 (16:45 +0100)]
unity: Send all traffic selectors in a single UNITY_SPLIT_INCLUDE attribute
Cisco clients only handle the first such attribute.
Tobias Brunner [Fri, 15 Nov 2013 14:15:19 +0000 (15:15 +0100)]
unity: Change local TS to 0.0.0.0/0 as responder
Cisco clients and Shrew expect a remote TS of 0.0.0.0/0 if Unity is
used, otherwise Quick Mode fails.
Tobias Brunner [Fri, 15 Nov 2013 13:54:42 +0000 (14:54 +0100)]
unity: Send UNITY_SPLIT_INCLUDE attributes with proper padding
The additional 6 bytes are not actually padding but are parsed by the
Cisco client as protocol and src and dst ports (each two bytes but
strangely only the first two in network order).
Tobias Brunner [Thu, 23 Jan 2014 09:27:49 +0000 (10:27 +0100)]
Merge branch 'ipcomp'
Fixes compatibility issues between firewall rules (leftfirewall=yes)
and IPComp (compress=yes), plus issues with IPComp when used with
multiple subnets in left|rightsubnet.
Fixes #436.
Tobias Brunner [Fri, 8 Nov 2013 13:57:01 +0000 (14:57 +0100)]
testing: Add ikev2/host2host-transport-nat scenario
Tobias Brunner [Fri, 8 Nov 2013 11:16:40 +0000 (12:16 +0100)]
testing: Add ipv6/rw-compress-ikev2 scenario
Tobias Brunner [Fri, 8 Nov 2013 10:12:04 +0000 (11:12 +0100)]
testing: Add ikev2/compress-nat scenario
Tobias Brunner [Fri, 8 Nov 2013 09:54:20 +0000 (10:54 +0100)]
testing: Enable firewall for ikev2/compress scenario
Additionally, send a regular (small) ping as the kernel does not
compress small packets and handles those differently inbound.
Tobias Brunner [Thu, 7 Nov 2013 20:02:07 +0000 (21:02 +0100)]
kernel-netlink: Set selector on transport mode IPComp SAs
Tobias Brunner [Thu, 7 Nov 2013 19:58:42 +0000 (20:58 +0100)]
kernel-netlink: Selectively add selector on SAs that use IPComp
Don't add a selector to tunnel mode SAs, these might serve multiple
traffic selectors but with only one selector on the SA only the traffic
matching the first one would actually get tunneled.
Tobias Brunner [Thu, 7 Nov 2013 19:56:30 +0000 (20:56 +0100)]
updown: Increase buffer size for script and environment variables
Tobias Brunner [Thu, 7 Nov 2013 16:50:02 +0000 (17:50 +0100)]
updown: Allow IPIP traffic if IPComp was negotiated
The kernel implicitly creates an IPIP SA if an IPComp SA is installed.
This SA is used inbound for small packets that are not compressed.
Since the addresses are different (they are the tunnel addresses not
those of the tunneled traffic) additional rules are required if the
traffic selector does not cover the tunnel addresses (e.g. due to a NAT).
For SAs with multiple traffic selectors duplicate rules will get installed.
Tobias Brunner [Thu, 7 Nov 2013 16:48:40 +0000 (17:48 +0100)]
updown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated
Tobias Brunner [Fri, 22 Nov 2013 09:42:18 +0000 (10:42 +0100)]
curl: Replace spaces in URIs with %20
cURL requires the URIs to be URL-encoded. Apparently, some CAs encode CRL
URIs with spaces in them.
Fixes #454.
Tobias Brunner [Fri, 22 Nov 2013 09:30:16 +0000 (10:30 +0100)]
utils: Add strreplace function
Tobias Brunner [Fri, 29 Nov 2013 16:42:11 +0000 (17:42 +0100)]
stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated
Otherwise a malicious user could send an unterminated string to cause
unterminated reads.
Tobias Brunner [Fri, 29 Nov 2013 16:27:23 +0000 (17:27 +0100)]
stroke: Add an option to prevent log level changes via stroke socket
Tobias Brunner [Wed, 11 Dec 2013 16:38:18 +0000 (17:38 +0100)]
pki: Make sure no command registers too many options
Tobias Brunner [Wed, 11 Dec 2013 16:24:03 +0000 (17:24 +0100)]
pki: Increase MAX_COMMANDS to cover all currently available commands
Fixes #452.
Tobias Brunner [Wed, 11 Dec 2013 16:23:43 +0000 (17:23 +0100)]
pki: Print a warning if MAX_COMMANDS is too low
Tobias Brunner [Wed, 11 Dec 2013 16:21:06 +0000 (17:21 +0100)]
pki: Properly use ?: when defining option arrays
Tobias Brunner [Mon, 25 Nov 2013 17:20:13 +0000 (18:20 +0100)]
configure: Add -Wno-format-security to default CFLAGS
Either due to a change in Ubuntu 13.10 or GCC 4.8 -Wno-format has no
effect if -Wformat-security is enabled (which it is on Ubuntu) so we
also disable the latter by default.
Tobias Brunner [Thu, 21 Nov 2013 16:12:21 +0000 (17:12 +0100)]
agent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket
This is also required if charon-cmd is used with capability dropping.
Tobias Brunner [Mon, 11 Nov 2013 15:17:35 +0000 (16:17 +0100)]
ike: Simplify error handling if name resolution failed
This avoids a second name resolution attempt just to determine if %any
etc. was configured.
Fixes #440.
Tobias Brunner [Mon, 11 Nov 2013 15:16:03 +0000 (16:16 +0100)]
ike: Use proper hostname(s) when name resolution failed
Was wrong since
0edce687675df8f10f4026fa12a8fc3b3dd003f5 .
Fixes #440.
Tobias Brunner [Wed, 6 Nov 2013 09:30:27 +0000 (10:30 +0100)]
ikev2: Wipe (optional) shared secret during CHILD_SA key derivation
Tobias Brunner [Thu, 23 Jan 2014 08:41:35 +0000 (09:41 +0100)]
checksum must be the last subdir included
Otherwise charon-cmd will not yet be installed when the checksums are
calculated (now from the install dir, not the build dir).
Fixes #496.
Martin Willi [Tue, 21 Jan 2014 16:48:08 +0000 (17:48 +0100)]
unit-tests: Pass a test suite collection name to print during test execution
As we except to get more and more test runners for the different components,
we add a name to easily identify them on the test output.
Martin Willi [Tue, 21 Jan 2014 12:23:32 +0000 (13:23 +0100)]
array: Add an array_get() function
Martin Willi [Wed, 22 Jan 2014 13:25:03 +0000 (14:25 +0100)]
watcher: Don't complain if select() syscall got interrupted