| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | android: Make sure every listener at the VPN state service is only ↵ | Tobias Brunner | 2017-06-30 | 1 | -11/+11 | |
| | | | | | | | | | | registered once We register when the service connects but also in onStart() (as we unregister in onStop() to avoid updates when not shown). So this could theoretically cause the listener to get registered twice if the service is connected before onStart() is called (it seems it usually isn't). | |||||
| * | android: Add menu item to import VPN profile via Storage Access Framework | Tobias Brunner | 2017-06-30 | 3 | -14/+59 | |
| | | | | | | This is useful in case the proper MIME type was not set for a downloaded profile. | |||||
| * | android: Add translation for Traditional Chinese | Tobias Brunner | 2017-06-30 | 2 | -0/+176 | |
| | | | | | Courtesy of Chris Chiang. | |||||
| * | android: Move Simplified Chinese translation to values-zg-rCN folder | Tobias Brunner | 2017-06-30 | 2 | -0/+0 | |
| | | ||||||
| * | android: Update Gradle plugin and wrapper | Tobias Brunner | 2017-06-30 | 3 | -4/+4 | |
| | | ||||||
| * | ikev1: Only delete redundant CHILD_SAs if configured | Tobias Brunner | 2017-06-26 | 1 | -1/+5 | |
| | | | | | | | | | | If we find a redundant CHILD_SA (the peer probably rekeyed the SA before us) we might not want to delete the old SA because the peer might still use it (same applies to old CHILD_SAs after rekeyings). So only delete them if configured to do so. Fixes #2358. | |||||
| * | configure: Enable coverage for all plugins via PLUGIN_CFLAGS | Tobias Brunner | 2017-06-20 | 3 | -6/+3 | |
| | | ||||||
| * | ipsec: Remove `starter` as valid command in --help | Tobias Brunner | 2017-06-20 | 1 | -1/+1 | |
| | | | | | | | `start` is basically the same thing. Fixes #2362. | |||||
| * | openssl: Properly handle flags in key usage extension | Tobias Brunner | 2017-06-14 | 1 | -8/+6 | |
| | | ||||||
| * | charon-tkm: Return cloned host from tkm_kernel_sad_t::get_dst_host() | Tobias Brunner | 2017-06-14 | 3 | -2/+4 | |
| | | | | | | When an expire is triggered while rekeying, the CHILD_SA might be deleted while the returned host is still used to queue a rekey job for the CHILD_SA. | |||||
| * | configure: Use pkg-config to determine Ruby CFLAGS/LIBS | Tobias Brunner | 2017-06-07 | 3 | -5/+8 | |
| | | ||||||
| * | nm: Version bump to 1.4.2 | Tobias Brunner | 2017-05-30 | 2 | -1/+7 | |
| | | ||||||
| * | x509: nameConstraints sequence does not require a loop | Andreas Steffen | 2017-05-29 | 1 | -2/+1 | |
| | | | | | Fixes: CVE-2017-9023 | |||||
| * | unit-tests: Updated asn1-parser tests | Andreas Steffen | 2017-05-29 | 1 | -1/+105 | |
| | | ||||||
| * | asn1-parser: Fix CHOICE parsing | Andreas Steffen | 2017-05-29 | 3 | -75/+134 | |
| | | | | | Fixes: CVE-2017-9023 | |||||
| * | gmp: Make sure the modulus is odd and the exponent not zero | Tobias Brunner | 2017-05-29 | 1 | -1/+6 | |
| | | | | | | | | | | Unlike mpz_powm() its secure replacement mpz_powm_sec() has the additional requirement that the exponent must be > 0 and the modulus has to be odd. Otherwise, it will crash with a floating-point exception. Fixes: CVE-2017-9022 Fixes: 3e35a6e7a1b0 ("Use side-channel secured mpz_powm_sec of libgmp 5, if available") | |||||
| * | imv-swid: Fixed memory leak in http REST interface | Andreas Steffen | 2017-05-29 | 1 | -17/+19 | |
| | | ||||||
| * | leak-detective: Whitelisted memory leaks in FHH IMCs and IMVs | Andreas Steffen | 2017-05-29 | 1 | -0/+3 | |
| | | ||||||
| * | imv-test: Fixed memory leak in server retry use case | Andreas Steffen | 2017-05-29 | 1 | -0/+2 | |
| | | ||||||
| * | libtnccs: Fixed memory leak of global variables in libxml2 | Andreas Steffen | 2017-05-29 | 1 | -1/+4 | |
| | | ||||||
| * | ike-cfg: Fix memory leak when matching against ranges | Tobias Brunner | 2017-05-29 | 1 | -1/+1 | |
| | | | | | | | | traffic_selector_t::to_subnet() always sets the net/host (unless the address family was invalid). Fixes: 3070697f9f7c ("ike: support multiple addresses, ranges and subnets in IKE address config") | |||||
| * | ike: Apply retransmission_limit before applying the jitter | Tobias Brunner | 2017-05-26 | 2 | -8/+8 | |
| | | ||||||
| * | eap-sim-file: Remove redundant enumerator allocation | Tobias Brunner | 2017-05-26 | 1 | -1/+1 | |
| | | ||||||
| * | sql: Remove redundant enumerator allocation | Tobias Brunner | 2017-05-26 | 1 | -1/+1 | |
| | | | | | | | Interestingly, this doesn't show up in the regression tests because the compiler removes the first assignment (and thus the allocation) due to -O2 that's included in our default CFLAGS. | |||||
| * | Fixed some typos, courtesy of codespell | Tobias Brunner | 2017-05-26 | 9 | -12/+12 | |
| | | ||||||
| * | linked-list: Change return value of find_first() and signature of its callback | Tobias Brunner | 2017-05-26 | 29 | -397/+525 | |
| | | | | | This avoids the unportable five pointer hack. | |||||
| * | linked-list: Change interface of callback for invoke_function() | Tobias Brunner | 2017-05-26 | 9 | -54/+98 | |
| | | | | | This avoids the unportable five pointer hack. | |||||
| * | linked-list: invoke_offset() doesn't take any additional arguments anymore | Tobias Brunner | 2017-05-26 | 3 | -18/+16 | |
| | | ||||||
| * | Change interface for enumerator_create_filter() callback | Tobias Brunner | 2017-05-26 | 50 | -929/+1331 | |
| | | | | | | This avoids the unportable 5 pointer hack, but requires enumerating in the callback. | |||||
| * | Migrate all enumerators to venumerate() interface change | Tobias Brunner | 2017-05-26 | 68 | -560/+851 | |
| | | ||||||
| * | enumerator: Add venumerate() method to enumerator_t that takes a va_list | Tobias Brunner | 2017-05-26 | 2 | -8/+51 | |
| | | | | | | | | | | | This will allow us to implement e.g. enumerator_cleaner without having to use that unportable 5 pointer forwarding or having to define a callback for each instance. A generic implementation for enumerate() is provided so only venumerate() has to be implemented, which may be simplified by using the VA_ARGS_VGET() macro. | |||||
| * | utils: Add helper macros to read variadic arguments into local variables | Tobias Brunner | 2017-05-26 | 1 | -2/+46 | |
| | | ||||||
| * | vici: Make 96-bit truncation for SHA-256 configurable | Tobias Brunner | 2017-05-26 | 2 | -0/+20 | |
| | | ||||||
| * | stroke: Make 96-bit truncation for SHA-256 configurable | Tobias Brunner | 2017-05-26 | 8 | -1/+10 | |
| | | ||||||
| * | child-cfg: Optionally use 96-bit truncation for HMAC-SHA-256 | Tobias Brunner | 2017-05-26 | 2 | -0/+11 | |
| | | | | | | | | | The correct truncation is 128-bit but some implementations insist on using 96-bit truncation. With strongSwan this can be negotiated using an algorithm identifier from a private range. But this doesn't work with third-party implementations. This adds an option to use 96-bit truncation even if the official identifier is used. | |||||
| * | android-log: Link against liblog | Tobias Brunner | 2017-05-26 | 1 | -0/+1 | |
| | | ||||||
| * | unit-tests: Fix test_chunk_eq() if arguments have side-effects | Tobias Brunner | 2017-05-24 | 1 | -1/+1 | |
| | | ||||||
| * | unit-tests: Check installed IPsec SAs in child-rekey tests | Tobias Brunner | 2017-05-23 | 1 | -3/+94 | |
| | | ||||||
| * | unit-tests: Add assert to check for installed IPsec SAs | Tobias Brunner | 2017-05-23 | 2 | -3/+115 | |
| | | ||||||
| * | unit-tests: Migrate cached IPsec SAs to new IKE_SAs during rekeying | Tobias Brunner | 2017-05-23 | 1 | -0/+42 | |
| | | ||||||
| * | unit-tests: Keep track of installed IPsec SAs in mock kernel_ipsec_t ↵ | Tobias Brunner | 2017-05-23 | 2 | -4/+136 | |
| | | | | | implementation | |||||
| * | child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAs | Tobias Brunner | 2017-05-23 | 3 | -128/+412 | |
| | | | | | | | | | After deleting a rekeyed CHILD_SA we uninstall the outbound SA but don't destroy the CHILD_SA (and the inbound SA) immediately. We delay it a few seconds or until the SA expires to allow delayed packets to get processed. The CHILD_SA remains in state CHILD_DELETING until it finally gets destroyed. | |||||
| * | delete-child-sa-job: Add new constructor that takes the unique ID of a CHILD_SA | Tobias Brunner | 2017-05-23 | 2 | -13/+69 | |
| | | | | | | This makes sure we delete the right SA in case the addresses got updated in the mean time. | |||||
| * | child-sa: Remove state to track installation of half the SA again | Tobias Brunner | 2017-05-23 | 6 | -62/+47 | |
| | | ||||||
| * | unit-tests: Overload helper macro to check for outbound SA state | Tobias Brunner | 2017-05-23 | 1 | -2/+30 | |
| | | ||||||
| * | child-sa: Expose state of the outbound SA | Tobias Brunner | 2017-05-23 | 2 | -17/+61 | |
| | | ||||||
| * | child-sa: Add method to remove the outbound SA and policies | Tobias Brunner | 2017-05-23 | 2 | -5/+78 | |
| | | ||||||
| * | child-sa: Keep track whether the outbound SA has been installed or not | Tobias Brunner | 2017-05-23 | 1 | -8/+13 | |
| | | ||||||
| * | child-delete: Track flags per individual CHILD_SA | Tobias Brunner | 2017-05-23 | 1 | -47/+78 | |
| | | ||||||
| * | ikev2: Delay installation of outbound SAs during rekeying on the responder | Tobias Brunner | 2017-05-23 | 4 | -30/+124 | |
| | | | | | | | | | The responder has all the information needed to install both SAs before the initiator does. So if the responder immediately installs the outbound SA it might send packets using the new SA which the initiator is not yet able to process. This can be avoided by delaying the installation of the outbound SA until the replaced SA is deleted. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |