denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,486 Commits 3 Branches 0 Tags
3941d55f0116b12646efaba6ed00ec09b5a246c2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 3941d55f01 pki: Document --not-before/after and --dateform options in manpages 2014-03-31 11:39:25 +02:00
Martin Willi 2769a22e1f pki: Support absolute --this/next-update CRL lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi d6e921181a pki: Support absolute --not-before/after issued certificate lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi aa8732eb68 pki: Support absolute --not-before/after self-signed certificate lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi 6f90e8e664 pki: Support absolute --not-before/after acert lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi 06d3b6e9c9 pki: Add a certificate lifetime calculation helper function 2014-03-31 11:14:59 +02:00
Martin Willi babd848778 testing: Add an acert test that forces a fallback connection based on groups 2014-03-31 11:14:59 +02:00
Martin Willi 1a4d3222be testing: Add an acert test case sending attribute certificates inline 2014-03-31 11:14:59 +02:00
Martin Willi 9f676321a9 testing: Add an acert test using locally cached attribute certificates 2014-03-31 11:14:59 +02:00
Martin Willi c602ee65dc testing: build strongSwan with acert plugin 2014-03-31 11:14:59 +02:00
Martin Willi 3a2deb98bc ikev2: Cache all received attribute certificates to auth config 2014-03-31 11:14:59 +02:00
Martin Willi d417900335 ikev2: Send all known and valid attribute certificates for subject cert 2014-03-31 11:14:59 +02:00
Martin Willi a14f7edfb2 ikev2: Slightly refactor certificate payload construction to separate functions 2014-03-31 11:14:58 +02:00
Martin Willi f316116c88 ike: Support encoding of attribute certificates in CERT payloads 2014-03-31 11:14:58 +02:00
Martin Willi 83f8cdde46 auth-cfg: Declare an attribute certificate helper type to exchange acerts 2014-03-31 11:14:58 +02:00
Martin Willi 5ac0e66879 acert: Implement a plugin finding, validating and evaluating attribute certs 
This validator checks for any attribute certificate it can find for validated
end entity certificates and tries to extract group membership information
used for connection authorization rules.
 2014-03-31 11:14:58 +02:00
Martin Willi b06283f1e3 x509: Match acert has_subject() against entityName or holder serial 
This allows us to find attribute certificates for a subject certificate in
credential sets.
 2014-03-31 11:14:58 +02:00
Martin Willi 6e8c665a51 pki: Add acert and extend pki/print manpages 2014-03-31 11:14:58 +02:00
Martin Willi 35a783cff7 pki: Implement an acert command to issue attribute certificates 2014-03-31 11:14:58 +02:00
Martin Willi 20ea84daec pki: Support printing attribute certificates 2014-03-31 11:14:58 +02:00
Martin Willi e49197f15e pki: Don't generate negative random serial numbers in X.509 certificates 
According to RFC 5280 4.1.2.2 we MUST force non-negative serial numbers.
 2014-03-31 11:14:58 +02:00
Martin Willi 0226ca886d pem: Support encoding of attribute certificates 
While there is no widely used PEM header for attribute certificates, at least
IAIK-JCE uses BEGIN ATTRIBUTE CERTIFICATE:

  http://javadoc.iaik.tugraz.at/iaik_jce/current/iaik/utils/Util.html#toPemString(iaik.x509.attr.AttributeCertificate)
 2014-03-31 11:14:58 +02:00
Martin Willi 8f9e2dbcd5 x509: Replace the comma separated string AC group builder with a list based one 2014-03-31 11:14:58 +02:00
Martin Willi a17598bc69 x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t 
The ietf_attributes_t class is used for attribute certificates only these days,
and integrating them to x509_ac_t simplifies things significantly.
 2014-03-31 11:14:58 +02:00
Martin Willi 61b2d815b9 x509: Replace fixed acert group string getter by a more dynamic group enumerator 2014-03-31 11:14:58 +02:00
Martin Willi a9bfd4b055 x509: Skip parsing of acert chargingIdentity, as we don't use it anyway 2014-03-31 11:14:58 +02:00
Martin Willi 3134379ac7 x509: Fix some whitespaces and do some minor style cleanups in acert 2014-03-31 11:14:57 +02:00
Martin Willi 883a63adc1 ac: Remove unimplemented equals_holder() method from ac_t 2014-03-31 11:14:57 +02:00
Martin Willi 0a8c399a21 pki: When dispatching commands, don't look beyond non-null-terminated array 2014-03-19 09:37:46 +01:00
Martin Willi 87e53819a6 pki: Check length of commands array before accessing command in --help 
As --help is counted as command as well, the array is not null-terminated
and we have to check for MAX_COMMANDS.

Fixes #550.
 2014-03-19 09:25:29 +01:00
Martin Willi 1c667bce3f pki: Make cmds array static, ensuring that it is zero-initialized 
As pki --help relies on a zero-terminated array, make the actually non-public
cmds array static to ensure initialization.
 2014-02-20 11:45:51 +01:00
Martin Willi 961409b668 lookip: Disconnect asynchronously to avoid dead-locking watcher unregistration 
While it really would be desirable to allow stream destruction during on_read()
callbacks, this does not work anymore since e49b2998. Until we have a proper
solution for this issue, use asynchronous disconnects for the only user doing
so.

Fixes #518.
 2014-02-17 09:48:55 +01:00
Martin Willi 7707357227 rdrand: Provide get_features() regardless of RDRAND availability 
As having no get_features() raises a deprecated warning, we return no features
instead.
 2014-02-10 11:22:16 +01:00
Martin Willi 144f1d7041 rdrand: Move RDRAND detection log to level 2 
When having RDRAND support, these log messages might be confusing when using
pki or other tools.
 2014-02-10 11:07:50 +01:00
Martin Willi ac2dc3b726 updown: Return an empty DNS server enumerator if no IKE_SA available 
The one existing caller does not handle a NULL return and always expects
an enumerator; and returning FALSE does not make sense anyway.
 2014-02-06 16:38:39 +01:00
Martin Willi fe40c47547 Merge branch 'cmd-proposals' 
Introduce --ike/esp/ah-proposal options to offer custom proposals, and requests
an IPv6 virtual IP if an IPv6 --remote-ts is given.

Fixes #508.
 2014-02-06 15:58:41 +01:00
Martin Willi e2de972c55 charon-cmd: Request an IPv6 virtual IP if an IPv6 remote subnet given 2014-02-06 15:58:13 +01:00
Martin Willi fe7269c089 charon-cmd: Document new proposal options in manpage 2014-02-06 15:58:13 +01:00
Martin Willi c9e85424a8 charon-cmd: Add --esp/--ah-proposal options to specify CHILD_SA proposals 2014-02-06 15:58:07 +01:00
Martin Willi 2796cf59bc charon-cmd: Add an --ike-proposal option to specify non-default IKE proposals 2014-02-06 15:57:36 +01:00
Martin Willi 1df1430146 charon-cmd: Block SIGUSR1 on worker threads 
To properly shut down charon-cmd with leak reports, only the main thread
should catch SIGUSR1 to shut down the application. Work threads should ignore
SIGUSR1 to avoid any hard application termination.
 2014-02-06 15:57:36 +01:00
Martin Willi 0c5dfb741f testing: Fetch the FreeRADIUS tarball from the "old" directory 
Fixes #483.
 2014-01-31 17:51:45 +01:00
Martin Willi 1f4883008e unit-tests: Add some test cases for HTTP GET/POST fetches 2014-01-31 12:18:32 +01:00
Martin Willi 1691b19900 unit-tests: Fix test_runner_run() apidoc 2014-01-29 13:38:10 +01:00
Martin Willi 0cec570a4b NEWS: Add unit testing improvements 2014-01-24 13:19:55 +01:00
Martin Willi d048a319df ike: Restart inactivity counter after doing a CHILD_SA rekey 
When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity
job is queued for a time unrelated to the rekey time, so it might happen
that the inactivity job gets executed just after rekeying. If this happens,
inactivity is detected even if we had traffic on the rekeyed CHILD_SA just
before rekeying.

This change implies that inactivity checks can't handle inactivity timeouts
for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter
than the rekey time to have any effect.
 2014-01-23 16:19:22 +01:00
Martin Willi 763e035335 child-sa: Add a getter for CHILD_SA install time 2014-01-23 16:19:22 +01:00
Martin Willi 76d073c5ab Merge branch 'pam-session' 
Add support for PAM session management in xauth-pam.
 2014-01-23 16:14:46 +01:00
Martin Willi 572582f5de NEWS: Introduce PAM session management 2014-01-23 16:11:54 +01:00
Martin Willi c5dc94dc8a man: Document xauth-pam session option 2014-01-23 16:07:04 +01:00
Martin Willi 7dc8bf495b xauth-pam: Sanitize XAuth attributes before passing them to PAM 2014-01-23 16:07:04 +01:00
Martin Willi 5770e28e96 Merge branch 'vendor-ids' 
Refactors IKEv2 vendor ID handling, and introduces some IDs seen when talking
to Cisco devices.
 2014-01-23 16:04:48 +01:00
Martin Willi c7c2e24a56 ikev2: Add Cisco FRAGMENTATION vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:04:04 +01:00
Martin Willi 2c6d204bec ikev2: Add Cisco Copyright vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:04:01 +01:00
Martin Willi f84d1cb2f9 ikev2: Add Cisco Delete Reason vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:03:55 +01:00
Martin Willi a8d8e631f9 ikev2: Use a more dynamic vendor ID database, as we use with IKEv1 2014-01-23 16:02:18 +01:00
Martin Willi 6a620f9936 Merge branch 'chunk-mmap' 
Introduces file mmap/munmap() wrappers and provides a fallback if mmap() is not
supported. Replaces all mmap() uses by the new functions.
 2014-01-23 15:57:45 +01:00
Martin Willi 853498155e libpts: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi 7ae878c357 tnccs: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi 88fa7f62be pem: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi ecdef634aa stroke: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b8d0103e31 radattr: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi 39badc53cd libfast: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi 69be6a9e05 integrity-checker: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b9ee059ca9 chunk: Externalize error reporting in chunk_write() 
This avoids passing that arbitrary label just for error messages, and gives
greater flexibility in handling errors.
 2014-01-23 15:55:32 +01:00
Martin Willi 37374a292a chunk: Provide a fallback chunk_map() if mmap is not available 2014-01-23 15:55:32 +01:00
Martin Willi 1c4a3459f7 chunk: Use dynamically allocated buffer in chunk_from_fd() 
When acting on files, we can use fstat() to estimate the buffer size. On
non-file FDs, we dynamically increase an allocated buffer.

Additionally we slightly change the function signature to properly handle
zero-length files and add appropriate unit tests.
 2014-01-23 15:55:32 +01:00
Martin Willi 595b6d9a82 chunk: Add functions to map file contents to a chunk 2014-01-23 15:55:32 +01:00
Martin Willi b034131555 unit-tests: Pass a test suite collection name to print during test execution 
As we except to get more and more test runners for the different components,
we add a name to easily identify them on the test output.
 2014-01-22 15:34:53 +01:00
Martin Willi 589fab2260 array: Add an array_get() function 2014-01-22 15:34:53 +01:00
Martin Willi 027cf7ddcf watcher: Don't complain if select() syscall got interrupted 2014-01-22 15:34:53 +01:00
Martin Willi e49b299867 stream: Make sure no watcher callback is active while changing stream callbacks 
When changing async callbacks on streams, we have to make sure the watcher
callback is not currently active and has temporarily disabled callbacks. This
could have been the case, as we didn't explicitly removed any pending
watcher registration if both callbacks are NULL.

By enforcing the watcher unregistration, we are sure the watcher callback is
not active and currently is not mangling the callback hooks. This should make
sure we avoid any races for the callback variables.
 2014-01-22 15:34:53 +01:00
Martin Willi 2e89bc4b66 printf-hook-builtin: Correctly calculate written bytes in print_in_hook() 
The hook data counts remaining buffer bytes, not used ones. Counting them
correctly fixes a crash for long hexdumps.

Further, print_in_hook() must return the number of bytes that would have been
written, not the actually written bytes. This is important, as we allocate a
dynamic buffer in bus that relies on the exact byte count. Fixes long hexdumps
that got truncated.
 2014-01-15 18:28:43 +01:00
Martin Willi 1cbe4e6ce4 tun-device: Include <linux/types.h> before <linux/if_tun.h> 
Fixes a build error on CentOS 6.4.
 2013-11-22 09:09:06 +01:00
Martin Willi 07ca25909b printf-hook-builtin: Don't use %P to print uppercase hex pointers 
We use %P as custom printf specifier for proposals.
 2013-11-20 16:57:28 +01:00
Martin Willi 27467a6881 Merge branch 'unit-tests' 
Replace the "check" based libstrongswan unit test framework with our own,
giving us more flexibility for our specific needs.

The new framework is more portable and uses complete libstrongswan init/deinit
cycles for each test to properly catch leaks. It fully supports multi-threaded
tests, and brings many of them for all threading primitives, watcher and
streams.

The --enable-unit-tests option is not required anymore for libstrongswan tests,
but still is for the still "check" based charon-tkm tests.
 2013-11-06 10:31:07 +01:00
Martin Willi 09d0c9030a unit-tests: Separate test runner to a library, reusable by other tests 
Other users may make use of the noinst libtest.la helper library to implement
unit tests. For libstrongswan, tests.[ch] provide the configuration for test
runner to perform unit tests in a simple manner.
 2013-11-06 10:31:07 +01:00
Martin Willi 5a3230a250 unit-tests: Use some include magic to define test suite constructors 
Avoid editing of several files when creating test suites by using a single
header file to define test suite constructor functions.
 2013-11-06 10:31:07 +01:00
Martin Willi d9d0eef92b unit-tests: Check printing of strings having zero length 2013-11-06 10:31:07 +01:00
Martin Willi 61934203e2 unit-tests: Add some basic tests if PRI* printf specifiers work as expected 2013-11-06 10:31:06 +01:00
Martin Willi a4cbda35ce unit-tests: Add a semaphore wait cancel test 2013-11-06 10:31:06 +01:00
Martin Willi fae1b85223 unit-tests: Add a semaphore absolute timed wait test 2013-11-06 10:31:06 +01:00
Martin Willi a14935ea4b unit-tests: Add a semaphore timed wait test case 2013-11-06 10:31:06 +01:00
Martin Willi ffab2e0c95 unit-tests: Add a simple semaphore test 2013-11-06 10:31:06 +01:00
Martin Willi b1bfe59560 unit-tests: Add a spinlock test case 2013-11-06 10:31:06 +01:00
Martin Willi 478dc0257c unit-tests: Add a rwlock condvar thread cancel test 2013-11-06 10:31:05 +01:00
Martin Willi b92c173b28 unit-tests: Add a rwlock condvar absolute timed wait test 2013-11-06 10:31:05 +01:00
Martin Willi af19213c54 unit-tests: Add a rwlock condvar wait test 2013-11-06 10:31:05 +01:00
Martin Willi 1032f52d68 unit-tests: Add a rwlock condvar broadcast test 2013-11-06 10:31:05 +01:00
Martin Willi f644b9e853 unit-tests: Add a rwlock condvar test 2013-11-06 10:31:05 +01:00
Martin Willi dac31fe1a0 unit-tests: Add a rwlock test case 2013-11-06 10:31:05 +01:00
Martin Willi 8b25b5c36f unit-tests: Add a condvar test where wait gets cancelled 2013-11-06 10:31:04 +01:00
Martin Willi b7db393d01 unit-tests: Add a condvar test working on a recursive mutex 2013-11-06 10:31:04 +01:00
Martin Willi 8699a32b74 unit-tests: Add a condvar absolute timed wait test 2013-11-06 10:31:04 +01:00
Martin Willi 31f9f777b3 unit-tests: Add a condvar timed wait test 2013-11-06 10:31:04 +01:00
Martin Willi 9a0a891e6b unit-tests: Add condvar broadcast test 2013-11-06 10:31:04 +01:00
Martin Willi 13183a74d4 unit-tests: Add a simple condvar test 2013-11-06 10:31:04 +01:00
Martin Willi 21df985148 unit-tests: Add a thread local storage cleanup test 2013-11-06 10:31:03 +01:00
Martin Willi 0b00e63e49 unit-tests: Add a thread local storage fuzzer test 2013-11-06 10:31:03 +01:00
Martin Willi fd26b7ff1b unit-tests: Add a thread cleanup pop test 2013-11-06 10:31:03 +01:00