aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* stroke: Make 96-bit truncation for SHA-256 configurableTobias Brunner2017-05-269-1/+17
|
* child-cfg: Optionally use 96-bit truncation for HMAC-SHA-256Tobias Brunner2017-05-262-0/+11
| | | | | | | | The correct truncation is 128-bit but some implementations insist on using 96-bit truncation. With strongSwan this can be negotiated using an algorithm identifier from a private range. But this doesn't work with third-party implementations. This adds an option to use 96-bit truncation even if the official identifier is used.
* android-log: Link against liblogTobias Brunner2017-05-261-0/+1
|
* unit-tests: Fix test_chunk_eq() if arguments have side-effectsTobias Brunner2017-05-241-1/+1
|
* Merge branch 'avoid-rekey-loss'Tobias Brunner2017-05-2317-395/+1667
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changes the behavior during IKEv2 CHILD_SA rekeyings to avoid traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA the responder already has everything available to install and use the new CHILD_SA. However, this could lead to lost traffic as the initiator won't be able to process inbound packets until it processed the CREATE_CHILD_SA response and updated the inbound SA. To avoid this the responder now only installs the new inbound SA and delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA. The messages transporting these DELETEs could reach the peer before packets sent with the deleted outbound SAs reach the respective peer. To reduce the chance of traffic loss due to this the inbound SA of the replaced CHILD_SA is not removed for a configurable amount of seconds after the DELETE has been processed. Fixes #1291.
| * unit-tests: Check installed IPsec SAs in child-rekey testsTobias Brunner2017-05-231-3/+94
| |
| * unit-tests: Add assert to check for installed IPsec SAsTobias Brunner2017-05-232-3/+115
| |
| * unit-tests: Migrate cached IPsec SAs to new IKE_SAs during rekeyingTobias Brunner2017-05-231-0/+42
| |
| * unit-tests: Keep track of installed IPsec SAs in mock kernel_ipsec_t ↵Tobias Brunner2017-05-232-4/+136
| | | | | | | | implementation
| * child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAsTobias Brunner2017-05-234-128/+422
| | | | | | | | | | | | | | | | After deleting a rekeyed CHILD_SA we uninstall the outbound SA but don't destroy the CHILD_SA (and the inbound SA) immediately. We delay it a few seconds or until the SA expires to allow delayed packets to get processed. The CHILD_SA remains in state CHILD_DELETING until it finally gets destroyed.
| * delete-child-sa-job: Add new constructor that takes the unique ID of a CHILD_SATobias Brunner2017-05-232-13/+69
| | | | | | | | | | This makes sure we delete the right SA in case the addresses got updated in the mean time.
| * child-sa: Remove state to track installation of half the SA againTobias Brunner2017-05-236-62/+47
| |
| * unit-tests: Overload helper macro to check for outbound SA stateTobias Brunner2017-05-231-2/+30
| |
| * child-sa: Expose state of the outbound SATobias Brunner2017-05-232-17/+61
| |
| * child-sa: Add method to remove the outbound SA and policiesTobias Brunner2017-05-232-5/+78
| |
| * child-sa: Keep track whether the outbound SA has been installed or notTobias Brunner2017-05-231-8/+13
| |
| * child-delete: Track flags per individual CHILD_SATobias Brunner2017-05-231-47/+78
| |
| * ikev2: Delay installation of outbound SAs during rekeying on the responderTobias Brunner2017-05-234-30/+124
| | | | | | | | | | | | | | | | The responder has all the information needed to install both SAs before the initiator does. So if the responder immediately installs the outbound SA it might send packets using the new SA which the initiator is not yet able to process. This can be avoided by delaying the installation of the outbound SA until the replaced SA is deleted.
| * child-sa: Add log message for CHILD_SA state changesTobias Brunner2017-05-231-0/+4
| |
| * child-sa: Add method to associate rekeyed CHILD_SAs with their replacementTobias Brunner2017-05-232-0/+35
| |
| * child-sa: Add methods that allow partial installation of CHILD_SATobias Brunner2017-05-232-5/+144
| | | | | | | | | | | | | | Using install() for the inbound SA and register_outbound() for the outbound SA followed by install_policies(), will delay the installation of the outbound SA as well as the installation of the outbound policies in the kernel until install_outbound() is called later.
| * child-sa: Add new state to track installation of only the inbound SATobias Brunner2017-05-232-1/+7
| |
| * child-sa: Change API used to set/install policiesTobias Brunner2017-05-236-79/+119
| | | | | | | | This way we only have to pass the traffic selectors once.
| * child-sa: Split in- and outbound policy de-/installationTobias Brunner2017-05-231-62/+127
| | | | | | | | Only install outbound fallback policies.
| * child-create: Trigger NARROW_RESPONDER_POST hook before installing SAsTobias Brunner2017-05-231-25/+21
|/ | | | | This makes sure we use the same set of traffic selectors when installing the SAs and installing the policies.
* Merge branch 'fuzzing'Tobias Brunner2017-05-2326-41/+380
|\ | | | | | | | | | | | | | | | | | | | | | | Adds support for fuzzing the certificate parser provided by the default plugins (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with libFuzzer). Fixes several issues that were found while fuzzing these plugins. When building the libraries monolithically and statically the plugin constructors are now hard-coded in each library so the plugin code is not removed by the linker because it thinks none of their symbols are ever referenced.
| * tnc-ifmap: Null-terminate buffer to make sscanf()-calls safeTobias Brunner2017-05-231-4/+5
| |
| * libimcv: Make sure the first argument to sscanf() is null-terminatedTobias Brunner2017-05-232-2/+6
| |
| * asn1: Make sure the first argument to sscanf() is null-terminatedTobias Brunner2017-05-231-7/+9
| |
| * x509: Fix leak when parsing CDPs if an invalid one follows valid onesTobias Brunner2017-05-231-2/+2
| |
| * pem: Ensure a value before checking Proc-Type in PEM headerTobias Brunner2017-05-231-1/+1
| |
| * chunk: Correctly parse Base64 text where four = follow in a rowTobias Brunner2017-05-231-1/+1
| | | | | | | | | | | | | | That's not correct Base64 but invalid data could trigger this. Since outlen would get reduced four times, but is only ever increased three times per iteration, this could result in an integer underflow and then a potential buffer overflow.
| * configure: Don't modify CFLAGs if fuzzing is enabledTobias Brunner2017-05-231-5/+0
| | | | | | | | Just rely on the flags passed by the build process.
| * plugin-loader: Disable some logging output when building fuzz targetsTobias Brunner2017-05-231-4/+19
| | | | | | | | | | This avoids evaluating %N. An alternative would be to define a printf-hook for plugin features.
| * x509: Manually print CRL/OCSP URIs when fuzzingTobias Brunner2017-05-232-8/+28
| | | | | | | | This avoids a warning about the custom %Y printf specifier.
| * processor: Move priority threads assignment to set_threads()Tobias Brunner2017-05-231-4/+9
| | | | | | | | | | | | This avoids the evaluation of %N even if the thread pool is never used. We need to avoid as many custom printf specifiers as possible when fuzzing our code to avoid excessive log messages.
| * fuzz: Change how fuzz_certs is builtTobias Brunner2017-05-231-5/+11
| | | | | | | | | | | | We mainly do this because we have to create a self-contained executable and it isn't so easy to actually get libtool to link e.g. libgmp statically.
| * Add plugin constructor registration for all libraries that provide pluginsTobias Brunner2017-05-239-0/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Unfortunately, we can't just add the generated C file to the sources in Makefile.am as the linker would remove that object file when it notices that no symbol in it is ever referenced. So we include it in the file that contains the library initialization, which will definitely be referenced by the executable. This allows building an almost stand-alone static version of e.g. charon when building with `--enable-monolithic --enable-static --disable-shared` (without `--disable-shared` libtool will only build a version that links the libraries dynamically). External libraries (e.g. gmp or openssl) are not linked statically this way, though.
| * plugin-constructors: Add script to generate constructor registrationTobias Brunner2017-05-232-0/+61
| | | | | | | | Using a Python script so this works in cross-compilation situations.
| * plugin-loader: Add facility to register plugin constructorsTobias Brunner2017-05-233-4/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Enabled when building monolithically and statically. This should allow us to work around the -whole-archive issue with libtool. If the libraries register the plugin constructors they provide they reference the constructors and will therefore prevent the linker from removing these seemingly unused symbols from the final executable. For use cases where dlsym() can be used, e.g. because the static libraries are manually linked with -whole-archive (Linux) or -force-load (Apple), this can be disabled by passing ss_cv_static_plugin_constructors=no to the configure script.
| * configure: Don't build static libraries by defaultTobias Brunner2017-05-231-0/+1
| | | | | | | | | | This way we can actually detect if someone wants to build strongSwan statically because --enable-static has to be passed explicitly.
| * library: Add compile option to disable memwipe() checkTobias Brunner2017-05-231-0/+6
| |
| * fuzz: Make path to libFuzzer.a configurableTobias Brunner2017-05-232-1/+2
| |
| * pem: Don't read beyond line endsTobias Brunner2017-05-231-2/+2
| |
| * x509: Fix leak if there is an empty CDPTobias Brunner2017-05-231-1/+7
| |
| * x509: Fix leak if a certificate contains multiple authorityKeyIdentifiersTobias Brunner2017-05-231-0/+1
| |
| * fuzz: Add fuzzing boilerplateTobias Brunner2017-05-236-8/+75
|/
* testing: Avoid expiration of allocated SPIs due to low retransmission settingsTobias Brunner2017-05-231-1/+6
|
* kernel-netlink: Use total retransmit timeout as acquire timeoutTobias Brunner2017-05-233-16/+26
| | | | | | | By using the total retransmit timeout, modifications of timeout settings automatically reflect on the value of xfrm_acq_expires. If set, the value of xfrm_acq_expires configured by the user takes precedence over the calculated value.
* task-manager: Add helper function to calculate the total retransmit timeoutTobias Brunner2017-05-232-1/+42
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-25 08:00:04 +0000