aboutsummaryrefslogtreecommitdiffstats
path: root/src/libstrongswan
Commit message (Collapse)AuthorAgeFilesLines
...
* sigwaitinfo() may fail with EINTR if interrupted by an unblocked signal not ↵Tobias Brunner2015-11-231-1/+4
| | | | | | in the set Fixes #1213.
* utils: Use the more low-level __NR_ prefix to refer to the syscall numberTobias Brunner2015-11-171-1/+1
| | | | The __NR_ constants are also defined in the Android headers.
* utils: Provide a fallback for sigwaitinfo() if neededTobias Brunner2015-11-133-30/+36
| | | | | Apparently, not available on Mac OS X 10.10 Yosemite. We don't provide this on Windows.
* revocation: Allow CRLs to be encoded in PEM formatTobias Brunner2015-11-121-1/+1
| | | | | | | | | | Since the textual representation for a CRL is now standardized in RFC 7468 one could argue that we should accept that too, even though RFC 5280 explicitly demands CRLs fetched via HTTP/FTP to be in DER format. But in particular for file URIs enforcing that seems inconvenient. Fixes #1203.
* curl: Be less strict when considering status codes as errorsTobias Brunner2015-11-121-3/+3
| | | | | | | For file:// URIs the code is 0 on success. We now do the same libcurl would do with CURLOPT_FAILONERROR enabled. Fixes #1203.
* auth-cfg: Prefer merged rules over existing ones when moving themTobias Brunner2015-11-121-3/+3
| | | | | | This is particularly important for single valued rules (e.g. identities). When copying values this is already handled correctly by the enumerator and add().
* android: Provide a fallback for sigwaitinfo()Tobias Brunner2015-11-121-1/+29
|
* android: Replace AndroidConfigLocal.h with a header in utils/compatTobias Brunner2015-11-124-5/+16
|
* settings: Add settings_value_as_uint64() helper functionTobias Brunner2015-11-113-0/+58
|
* traffic-selector: Don't end printf'ed list of traffic selectors with a spaceTobias Brunner2015-11-102-8/+7
|
* plugin-loader: Optionally use RTLD_NOW with dlopen()Tobias Brunner2015-11-091-6/+11
| | | | | | | | | This can be useful when writing custom plugins as typos or missing linker flags that result in unresolved symbols in the shared object could otherwise cause late crashes. In particular, if such a symbol is used in a code path that is rarely executed. During development and testing using RTLD_NOW instead of RTLD_LAZY will prevent the plugin from getting loaded and makes the error visible immediately.
* windows: Define RTLD_NOW, even if it is not usedTobias Brunner2015-11-091-0/+5
|
* iv-gen: Use NULL IV generator for NULL encryptionTobias Brunner2015-11-091-0/+5
| | | | | | | | | | | | We don't need an IV for NULL encryption, so we wouldn't technically need an IV generator. But some of the code currently relies on an IV generator to be present. So we don't have to change that code and handle IV size == 0 specially we use the new NULL IV generator, which handles this transparently to the existing code. Before 3c81cb6fc322 ("aead: Create AEAD using traditional transforms with an explicit IV generator") iv_gen_rand_t was used for NULL encryption, which would work too but this way it's clearer.
* crypto: Add NULL IV generatorTobias Brunner2015-11-094-1/+98
| | | | | This does not actually allocate an IV and only accepts requests for size == 0.
* testing: Updated hasher testsAndreas Steffen2015-11-062-4/+83
|
* Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemesAndreas Steffen2015-11-0611-86/+106
|
* Use word-aligned XOR in sha3_absorb()Andreas Steffen2015-11-031-4/+47
|
* Support BLISS signatures with SHA-3 hashAndreas Steffen2015-11-035-4/+43
|
* Implemented SHA-3 hash algorithm including test vectorsAndreas Steffen2015-11-039-0/+1029
|
* Defined SHA-3 hashersAndreas Steffen2015-11-033-10/+59
|
* random: Properly handle errors when reading from /dev/[u]randomTobias Brunner2015-10-291-0/+1
| | | | | | | | If -1 was returned on the first call to read() `done` got SIZE_MAX and the function returned TRUE even though no actual random data had been allocated. Fixes #1156.
* Replace usages of sigwait(3) with sigwaitinfo(2)Tobias Brunner2015-10-291-2/+1
| | | | | | | This is basically the same call, but it has the advantage of being supported by FreeBSD's valgrind, which sigwait() is not. References #1106.
* openssl: Explicitly include openssl/bn.hTobias Brunner2015-09-165-0/+5
| | | | | | | | If OpenSSL is compiled with OPENSSL_NO_DEPRECATED some of the headers we include don't include openssl/bn.h anymore. Therefore, we have to explicitly include it ourselves where we use BN_* functions. Fixes #1113.
* unit-tests: Add a test to verify that there is no partial matching of RDNsTobias Brunner2015-09-091-0/+1
|
* Fixed some typos, courtesy of codespellTobias Brunner2015-08-273-3/+3
|
* Fix some Doxygen issuesTobias Brunner2015-08-273-3/+3
|
* unit-tests: Additional test cases to increase coverageTobias Brunner2015-08-272-9/+611
|
* traffic-selector: Use calc_netbits() in RFC 3779 constructorTobias Brunner2015-08-271-2/+1
| | | | This properly detects prefixes encoded as ranges.
* auth-cfg: Don't enforce EAP_RADIUSTobias Brunner2015-08-211-1/+2
| | | | | Basically the same as e79b0e07e4ab. EAP_RADIUS is also a virtual method that will identify itself as a different EAP method later.
* mem-cred: We don't need a write lock when looking for a certificateTobias Brunner2015-08-201-1/+1
|
* mem-cred: Add a method to atomically replace all certificatesTobias Brunner2015-08-202-10/+58
|
* auth-cfg: Don't enforce EAP_DYNAMICTobias Brunner2015-08-201-1/+2
| | | | | We now store the actual method on the auth config, which won't match anymore if rightauth=eap-dynamic is configured.
* Defined PWG HCD IF-M attributesAndreas Steffen2015-08-182-3/+6
|
* auth-cfg: Matching one CA should be enough, similar to peer certificatesTobias Brunner2015-08-171-15/+20
| | | | | | | | | | Not sure if defining multiple CA constraints and enforcing _all_ of them, i.e. the previous behavior, makes even sense. To ensure a very specific chain it should be enough to define the last intermediate CA. On the other hand, the ability to define multiple CAs could simplify configuration. This can currently only be used with swanctl/VICI based configs as `rightca` only takes a single DN.
* identification: Remove unused ID_USER_ID typeTobias Brunner2015-08-172-11/+3
|
* plugin-feature: Add vendor specific EAP method registration macrosTobias Brunner2015-08-172-8/+18
| | | | | | | | | | | Vendor specific EAP methods may be registered with: PLUGIN_CALLBACK(eap_method_register, <constructor>), PLUGIN_PROVIDE(EAP_SERVER_VENDOR, <type>, <vendor>), Same for client implementations via EAP_PEER_VENDOR. References #969.
* utils: Check for dirfd(3)Tobias Brunner2015-08-171-0/+9
| | | | | Not all POSIX compatible systems might provide it yet. If not, we close the lowest FD to close and hope it gets reused by opendir().
* utils: Directly use syscall() to close open FDs in closefrom()Tobias Brunner2015-08-171-5/+53
| | | | | | | This avoids any allocations, since calling malloc() after fork() is potentially unsafe. Fixes #990.
* utils: Don't use directory enumerator to close open FDs in closefrom()Tobias Brunner2015-08-171-24/+36
| | | | | | | | | | Calling malloc() after fork() is potentially unsafe, so we should avoid it if possible. opendir() will still require an allocation but that's less than the variant using the enumerator wrapper, thus, decreasing the conflict potential. This way we can also avoid closing the FD for the enumerated directory itself. References #990.
* Initialize variables that some compilers seem to warn aboutTobias Brunner2015-08-132-2/+2
|
* Fixed some typosTobias Brunner2015-08-132-2/+2
|
* identification: Use UTF8String instead of the legacy T61String to encode DNsTobias Brunner2015-08-061-1/+1
| | | | | | | When strings in RDNs contain characters outside the character set for PrintableString use UTF8String as the passed string is most likely in that encoding (RFC 5280 actually recommends to use only those two string types).
* identification: Add hash() methodTobias Brunner2015-08-063-3/+135
| | | | | | | Compared to hashing the encoding we can ignore string types of RDNs when hashing DNs, making hash() compatible to equals() that does the same. Fixes #991.
* pkcs11: Fix encoding of RSA keys if unnecessarily zero prefixedTobias Brunner2015-08-061-3/+8
| | | | | | | | | | | | | | Some tokens/libraries seem to prefix all numbers with zero bytes even if not necessary (e.g. the default exponent 0x010001). If we don't fix that, the fingerprints calculated based on the retrieved values will be incorrect. Even if the pkcs1 plugin can properly handle numbers that are not in two's complement since a81bd670b086 ("Added PUBKEY_RSA_MODULUS encoding type") we prefix them with zero if necessary as other encoders might expect them in two's complement. Fixes #1012.
* printf-hook-builtin: Fix invalid memory accessTobias Brunner2015-08-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When precision is given for a string, we must not run unbounded strlen() as it will read beyond the given length. It might even cause a crash if the given pointer is near end of heap or mapping. Fixes numerous valgrind errors such as: ==19215== Invalid read of size 1 ==19215== at 0x52D36C6: builtin_vsnprintf (printf_hook_builtin.c:853) ==19215== by 0x52D40A8: builtin_snprintf (printf_hook_builtin.c:1084) ==19215== by 0x52CE464: dntoa (identification.c:337) ==19215== by 0x52CE464: identification_printf_hook (identification.c:837) ==19215== by 0x52D3DAA: builtin_vsnprintf (printf_hook_builtin.c:1010) ==19215== by 0x57040EB: vlog (bus.c:388) ==19215== by 0x570427D: log_ (bus.c:430) ==19215== by 0xA8445D3: load_x509_ca (stroke_cred.c:416) ==19215== by 0xA8445D3: load_certdir (stroke_cred.c:537) ==19215== by 0xA846A95: load_certs (stroke_cred.c:1353) ==19215== by 0xA846A95: stroke_cred_create (stroke_cred.c:1475) ==19215== by 0xA84073E: stroke_socket_create (stroke_socket.c:782) ==19215== by 0xA83F27C: register_stroke (stroke_plugin.c:53) ==19215== by 0x52C3125: load_feature (plugin_loader.c:716) ==19215== by 0x52C3125: load_provided (plugin_loader.c:778) ==19215== by 0x52C3A20: load_features (plugin_loader.c:799) ==19215== by 0x52C3A20: load_plugins (plugin_loader.c:1159) ==19215== Address 0x50cdb42 is 0 bytes after a block of size 2 alloc'd ==19215== at 0x4C919FE: malloc (vg_replace_malloc.c:296) ==19215== by 0x52CD198: chunk_printable (chunk.c:759) ==19215== by 0x52CE442: dntoa (identification.c:334) ==19215== by 0x52CE442: identification_printf_hook (identification.c:837) ==19215== by 0x52D3DAA: builtin_vsnprintf (printf_hook_builtin.c:1010) ==19215== by 0x57040EB: vlog (bus.c:388) ==19215== by 0x570427D: log_ (bus.c:430) ==19215== by 0xA8445D3: load_x509_ca (stroke_cred.c:416) ==19215== by 0xA8445D3: load_certdir (stroke_cred.c:537) ==19215== by 0xA846A95: load_certs (stroke_cred.c:1353) ==19215== by 0xA846A95: stroke_cred_create (stroke_cred.c:1475) ==19215== by 0xA84073E: stroke_socket_create (stroke_socket.c:782) ==19215== by 0xA83F27C: register_stroke (stroke_plugin.c:53) ==19215== by 0x52C3125: load_feature (plugin_loader.c:716) ==19215== by 0x52C3125: load_provided (plugin_loader.c:778) ==19215== by 0x52C3A20: load_features (plugin_loader.c:799) ==19215== by 0x52C3A20: load_plugins (plugin_loader.c:1159)
* unit-tests: Add unit tests for settings_t.load_string[_section]Tobias Brunner2015-07-281-8/+113
|
* settings: Add methods and a constructor to parse settings from stringsTobias Brunner2015-07-282-11/+112
|
* settings: Extend parser so we can parse settings from a stringTobias Brunner2015-07-282-0/+45
|
* settings: Add support for multi-line stringsTobias Brunner2015-07-283-16/+20
| | | | Unterminated strings are now an error.
* settings: Don't replace rarely used special charactersTobias Brunner2015-07-281-2/+0
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-15 19:37:50 +0000