| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | android-log: Link against liblog | Tobias Brunner | 2017-05-26 | 1 | -0/+1 | |
| | | ||||||
| * | unit-tests: Fix test_chunk_eq() if arguments have side-effects | Tobias Brunner | 2017-05-24 | 1 | -1/+1 | |
| | | ||||||
| * | unit-tests: Check installed IPsec SAs in child-rekey tests | Tobias Brunner | 2017-05-23 | 1 | -3/+94 | |
| | | ||||||
| * | unit-tests: Add assert to check for installed IPsec SAs | Tobias Brunner | 2017-05-23 | 2 | -3/+115 | |
| | | ||||||
| * | unit-tests: Migrate cached IPsec SAs to new IKE_SAs during rekeying | Tobias Brunner | 2017-05-23 | 1 | -0/+42 | |
| | | ||||||
| * | unit-tests: Keep track of installed IPsec SAs in mock kernel_ipsec_t ↵ | Tobias Brunner | 2017-05-23 | 2 | -4/+136 | |
| | | | | | implementation | |||||
| * | child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAs | Tobias Brunner | 2017-05-23 | 3 | -128/+412 | |
| | | | | | | | | | After deleting a rekeyed CHILD_SA we uninstall the outbound SA but don't destroy the CHILD_SA (and the inbound SA) immediately. We delay it a few seconds or until the SA expires to allow delayed packets to get processed. The CHILD_SA remains in state CHILD_DELETING until it finally gets destroyed. | |||||
| * | delete-child-sa-job: Add new constructor that takes the unique ID of a CHILD_SA | Tobias Brunner | 2017-05-23 | 2 | -13/+69 | |
| | | | | | | This makes sure we delete the right SA in case the addresses got updated in the mean time. | |||||
| * | child-sa: Remove state to track installation of half the SA again | Tobias Brunner | 2017-05-23 | 6 | -62/+47 | |
| | | ||||||
| * | unit-tests: Overload helper macro to check for outbound SA state | Tobias Brunner | 2017-05-23 | 1 | -2/+30 | |
| | | ||||||
| * | child-sa: Expose state of the outbound SA | Tobias Brunner | 2017-05-23 | 2 | -17/+61 | |
| | | ||||||
| * | child-sa: Add method to remove the outbound SA and policies | Tobias Brunner | 2017-05-23 | 2 | -5/+78 | |
| | | ||||||
| * | child-sa: Keep track whether the outbound SA has been installed or not | Tobias Brunner | 2017-05-23 | 1 | -8/+13 | |
| | | ||||||
| * | child-delete: Track flags per individual CHILD_SA | Tobias Brunner | 2017-05-23 | 1 | -47/+78 | |
| | | ||||||
| * | ikev2: Delay installation of outbound SAs during rekeying on the responder | Tobias Brunner | 2017-05-23 | 4 | -30/+124 | |
| | | | | | | | | | The responder has all the information needed to install both SAs before the initiator does. So if the responder immediately installs the outbound SA it might send packets using the new SA which the initiator is not yet able to process. This can be avoided by delaying the installation of the outbound SA until the replaced SA is deleted. | |||||
| * | child-sa: Add log message for CHILD_SA state changes | Tobias Brunner | 2017-05-23 | 1 | -0/+4 | |
| | | ||||||
| * | child-sa: Add method to associate rekeyed CHILD_SAs with their replacement | Tobias Brunner | 2017-05-23 | 2 | -0/+35 | |
| | | ||||||
| * | child-sa: Add methods that allow partial installation of CHILD_SA | Tobias Brunner | 2017-05-23 | 2 | -5/+144 | |
| | | | | | | | | Using install() for the inbound SA and register_outbound() for the outbound SA followed by install_policies(), will delay the installation of the outbound SA as well as the installation of the outbound policies in the kernel until install_outbound() is called later. | |||||
| * | child-sa: Add new state to track installation of only the inbound SA | Tobias Brunner | 2017-05-23 | 2 | -1/+7 | |
| | | ||||||
| * | child-sa: Change API used to set/install policies | Tobias Brunner | 2017-05-23 | 6 | -79/+119 | |
| | | | | | This way we only have to pass the traffic selectors once. | |||||
| * | child-sa: Split in- and outbound policy de-/installation | Tobias Brunner | 2017-05-23 | 1 | -62/+127 | |
| | | | | | Only install outbound fallback policies. | |||||
| * | child-create: Trigger NARROW_RESPONDER_POST hook before installing SAs | Tobias Brunner | 2017-05-23 | 1 | -25/+21 | |
| | | | | | | This makes sure we use the same set of traffic selectors when installing the SAs and installing the policies. | |||||
| * | tnc-ifmap: Null-terminate buffer to make sscanf()-calls safe | Tobias Brunner | 2017-05-23 | 1 | -4/+5 | |
| | | ||||||
| * | libimcv: Make sure the first argument to sscanf() is null-terminated | Tobias Brunner | 2017-05-23 | 2 | -2/+6 | |
| | | ||||||
| * | asn1: Make sure the first argument to sscanf() is null-terminated | Tobias Brunner | 2017-05-23 | 1 | -7/+9 | |
| | | ||||||
| * | x509: Fix leak when parsing CDPs if an invalid one follows valid ones | Tobias Brunner | 2017-05-23 | 1 | -2/+2 | |
| | | ||||||
| * | pem: Ensure a value before checking Proc-Type in PEM header | Tobias Brunner | 2017-05-23 | 1 | -1/+1 | |
| | | ||||||
| * | chunk: Correctly parse Base64 text where four = follow in a row | Tobias Brunner | 2017-05-23 | 1 | -1/+1 | |
| | | | | | | | | That's not correct Base64 but invalid data could trigger this. Since outlen would get reduced four times, but is only ever increased three times per iteration, this could result in an integer underflow and then a potential buffer overflow. | |||||
| * | plugin-loader: Disable some logging output when building fuzz targets | Tobias Brunner | 2017-05-23 | 1 | -4/+19 | |
| | | | | | | This avoids evaluating %N. An alternative would be to define a printf-hook for plugin features. | |||||
| * | x509: Manually print CRL/OCSP URIs when fuzzing | Tobias Brunner | 2017-05-23 | 1 | -8/+25 | |
| | | | | | This avoids a warning about the custom %Y printf specifier. | |||||
| * | processor: Move priority threads assignment to set_threads() | Tobias Brunner | 2017-05-23 | 1 | -4/+9 | |
| | | | | | | | This avoids the evaluation of %N even if the thread pool is never used. We need to avoid as many custom printf specifiers as possible when fuzzing our code to avoid excessive log messages. | |||||
| * | Add plugin constructor registration for all libraries that provide plugins | Tobias Brunner | 2017-05-23 | 8 | -0/+64 | |
| | | | | | | | | | | | | | | | Unfortunately, we can't just add the generated C file to the sources in Makefile.am as the linker would remove that object file when it notices that no symbol in it is ever referenced. So we include it in the file that contains the library initialization, which will definitely be referenced by the executable. This allows building an almost stand-alone static version of e.g. charon when building with `--enable-monolithic --enable-static --disable-shared` (without `--disable-shared` libtool will only build a version that links the libraries dynamically). External libraries (e.g. gmp or openssl) are not linked statically this way, though. | |||||
| * | plugin-constructors: Add script to generate constructor registration | Tobias Brunner | 2017-05-23 | 2 | -0/+61 | |
| | | | | | Using a Python script so this works in cross-compilation situations. | |||||
| * | plugin-loader: Add facility to register plugin constructors | Tobias Brunner | 2017-05-23 | 2 | -3/+69 | |
| | | | | | | | | | | | | | | | Enabled when building monolithically and statically. This should allow us to work around the -whole-archive issue with libtool. If the libraries register the plugin constructors they provide they reference the constructors and will therefore prevent the linker from removing these seemingly unused symbols from the final executable. For use cases where dlsym() can be used, e.g. because the static libraries are manually linked with -whole-archive (Linux) or -force-load (Apple), this can be disabled by passing ss_cv_static_plugin_constructors=no to the configure script. | |||||
| * | library: Add compile option to disable memwipe() check | Tobias Brunner | 2017-05-23 | 1 | -0/+6 | |
| | | ||||||
| * | pem: Don't read beyond line ends | Tobias Brunner | 2017-05-23 | 1 | -2/+2 | |
| | | ||||||
| * | x509: Fix leak if there is an empty CDP | Tobias Brunner | 2017-05-23 | 1 | -1/+7 | |
| | | ||||||
| * | x509: Fix leak if a certificate contains multiple authorityKeyIdentifiers | Tobias Brunner | 2017-05-23 | 1 | -0/+1 | |
| | | ||||||
| * | kernel-netlink: Use total retransmit timeout as acquire timeout | Tobias Brunner | 2017-05-23 | 2 | -13/+23 | |
| | | | | | | | | By using the total retransmit timeout, modifications of timeout settings automatically reflect on the value of xfrm_acq_expires. If set, the value of xfrm_acq_expires configured by the user takes precedence over the calculated value. | |||||
| * | task-manager: Add helper function to calculate the total retransmit timeout | Tobias Brunner | 2017-05-23 | 2 | -1/+42 | |
| | | ||||||
| * | ike: Use optional jitter to calculate retransmission timeouts | Tobias Brunner | 2017-05-23 | 3 | -5/+57 | |
| | | | | | | Also adds an optional limit to avoid very high retransmission timeouts with high numbers of retries. | |||||
| * | kernel-netlink: Try to add new inbound SA if update fails | Thomas Egerer | 2017-05-23 | 1 | -3/+12 | |
| | | | | | | | | | | | | | | | | When establishing a traffic-triggered CHILD_SA involves the setup of an IKE_SA more than one exchange is required. As a result the temporary acquire state may have expired -- even if the acquire expiration (xfrm_acq_expires) time is set properly (165 by default). The expire message sent by the kernel is not processed in charon since no trap can be found by the trap manager. A possible solution could be to track allocated SPIs. But since this is a corner case and the tracking introduces quite a bit of overhead, it seems much more sensible to add a new state if the update of a state fails with NOT_FOUND. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com> | |||||
| * | kernel-pfkey: Update SA addresses if supported by the kernel | Tobias Brunner | 2017-05-23 | 1 | -21/+16 | |
| | | | | | | | Upcoming FreeBSD kernels will support updating the addresses of existing SAs with new SADB_X_EXT_NEW_ADDRESS_SRC|DST extensions for the SADB_UPDATE message. | |||||
| * | kernel-pfkey: Use new encap flag on Mac OS X when updating SAs | Tobias Brunner | 2017-05-23 | 1 | -1/+1 | |
| | | ||||||
| * | receiver: Restrict init limit to half-open SAs as responder | Thomas Egerer | 2017-05-23 | 1 | -4/+2 | |
| | | | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com> | |||||
| * | kernel-netlink: Update hardware offload attribute when SAs are updated | Tobias Brunner | 2017-05-23 | 1 | -11/+37 | |
| | | ||||||
| * | kernel-netlink: Base SA update on correct message in multi-message response | Tobias Brunner | 2017-05-23 | 1 | -7/+7 | |
| | | ||||||
| * | vici: Make hardware offload configurable | Tobias Brunner | 2017-05-23 | 2 | -0/+15 | |
| | | ||||||
| * | child-sa: Optionally enable hardware offload for CHILD_SAs | Tobias Brunner | 2017-05-23 | 1 | -0/+1 | |
| | | ||||||
| * | child-cfg: Add flag to enable hardware offload | Tobias Brunner | 2017-05-23 | 1 | -0/+3 | |
| | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |