denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,803 Commits 1 Branch 0 Tags
44107cb7b75551e02afd56061534495c10b94de3
Commit Graph
15803 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner e7c582e652 unit-tests: Fix internet checksum tests on big-endian systems 
We actually need to do a byte-swap, which ntohs() only does on
little-endian systems.

Fixes #747.
 2014-10-23 11:13:54 +02:00
Tobias Brunner eb218ff80b chunk: Fix internet checksum calculation on big-endian systems 
ntohs() might be defined as noop (#define ntohs(x) (x)) so we have
to manually shorten the negated value (gets promoted to an int).

Fixes #747.
 2014-10-23 11:13:28 +02:00
Martin Willi 4736ba0657 updown: Explicitly pass caller PATH to updown script 
When invoking /bin/sh, its default PATH is used. On some systems, that does
not include the PATH where the ipsec script is installed, as charon is invoked
with a custom PATH. Explicitly setting the PATH of charon should fix this
case, properly invoking the (default) updown script.

Fixes #745.
 2014-10-22 14:53:36 +02:00
Tobias Brunner 9e20fdbaf6 ip-packet: Fix length in IPv6 header of generated packets 2014-10-20 15:33:35 +02:00
Andreas Steffen a521ef3b8e Increased fragment size to 1400 in ipv6/net2net-ikev1 scenario 2014-10-18 14:05:53 +02:00
Andreas Steffen 09b46cdb6a Enabled IKEv2 fragmentation in ipv6/net2net-ikev2 scenario 2014-10-18 14:05:18 +02:00
Andreas Steffen 4b1b91913a Version bump to 5.2.1 2014-10-18 12:12:17 +02:00
Andreas Steffen 05b835c587 Remove unneeded get_count() method 2014-10-17 17:59:43 +02:00
Andreas Steffen 1c2416013c Process TCG/PTS File Measurement attribute incrementally 2014-10-17 16:11:40 +02:00
Andreas Steffen 82d2142f98 Exempt TCG/SEG attributes from unsupported case statement 2014-10-16 13:38:51 +02:00
Andreas Steffen 08385de6e2 Request IF-M segmentation contract for TCG/PTS subtype 2014-10-16 07:49:42 +02:00
Martin Willi cbb86a2df3 tls: Fix an invalid free on CBC encryption failure 2014-10-15 14:26:03 +02:00
Martin Willi 867d04b72e tls: Fix a memory leak if AEAD encryption fails 2014-10-15 14:21:01 +02:00
Martin Willi c0bf721357 tls: Check all bytes of the padding if they equal the padding length 2014-10-15 14:21:01 +02:00
Tobias Brunner fdeda63df0 android: Fix PA-TNC construction based on data passed via JNI 2014-10-15 13:55:13 +02:00
Tobias Brunner da241b6c75 libimcv: Add generic constructor for PA-TNC attributes 2014-10-15 13:55:13 +02:00
Tobias Brunner c71e6820ab backtrace: Fix symbol lookup in dynamic symtab via libbfd 2014-10-14 17:26:48 +02:00
Tobias Brunner 6de42cd323 swid-inventory: Remove unused variable end_of_tag 2014-10-14 17:11:41 +02:00
Tobias Brunner f8dc376c77 swanctl: Fix man page build on FreeBSD 
BSD make seems to only evaluate $< for certain rules (like the suffix rule
used to generate the config template).
 2014-10-14 16:49:40 +02:00
Martin Willi 76dc329e47 thread: Test for pending cancellation requests before select()ing on OS X 
This fixes some vici test cases on OS X, where the test thread tries to cancel
the watcher thread during cleanup, but fails as select() does not honor the
pre-issued cancellation request.
 2014-10-14 16:34:44 +02:00
Martin Willi bdfbecb3e6 vici: Return default value for get_int() if message value is empty string 
This is the behavior of some strtol() implementations, and it makes sense,
so force it.
 2014-10-14 16:33:10 +02:00
Martin Willi 784916e28d process: Don't use the shells built-in echo in tests 
On OS X, the /bin/sh built-in echo does not support -n.
 2014-10-14 16:33:10 +02:00
Martin Willi b16ea3415f process: Don't use absolute path names for true/false/cat in unit tests 
But use the (builtin) shell commands instead, as on OS X true/false are under
/usr/bin.
 2014-10-14 16:33:10 +02:00
Martin Willi 4e37bdbf57 kernel-pfroute: Check for RTM_IFANNOUNCE availability 
This message is not available on OS X.
 2014-10-14 16:33:10 +02:00
Martin Willi 5b2d89b3c3 process: Include missing <signal.h> for raise(3) 
Fixes OS X build.
 2014-10-14 16:33:10 +02:00
Tobias Brunner 9d75a28820 ike: Add IKEv2 in description of fragment_size option in strongswan.conf 2014-10-14 15:41:52 +02:00
Tobias Brunner 15dee933de ip-packet: Fix removal of TFC padding for IPv6 
The IPv6 length field denotes the payload length after the 40 bytes header.

Fixes: 293515f95c ("libipsec: remove extra RFC4303 TFC padding appended to inner payload")
 2014-10-14 14:10:33 +02:00
Tobias Brunner 283229bcb7 vici: Add vici.gemspec.in and vici.rb to distribution 2014-10-14 11:26:41 +02:00
Martin Willi 05a3f349a7 travis: Build-test updown and ext-auth plugins for Windows 2014-10-14 11:11:34 +02:00
Tobias Brunner 3307de1f8d android: Implement get_contracts() method in IMC state object 2014-10-14 10:37:55 +02:00
Tobias Brunner f4e6f89aa9 android: libpts does not exist anymore, don't attempt to load it 2014-10-14 10:12:16 +02:00
Tobias Brunner bed09f2baf android: Update receive_message() to new imc_msg_t.receive() signature 2014-10-13 18:16:47 +02:00
Tobias Brunner 668fbd4907 libimcv: Add fallback if IPSEC_SCRIPT is not defined 
This is the case on Android.
 2014-10-13 18:16:47 +02:00
Tobias Brunner ba0355c4ae libimcv: Updated Android.mk to latest Makefile.am 2014-10-13 18:16:40 +02:00
Tobias Brunner f502e503fb android: Remove references to libpts 2014-10-13 17:18:06 +02:00
Tobias Brunner ffa800ce9d libimcv: Remove reference to libpts 2014-10-13 17:17:45 +02:00
Tobias Brunner 17eed801e7 libimcv: Fix Doxygen comments after merging libpts into libimcv 2014-10-13 17:11:57 +02:00
Tobias Brunner 4bae9ec8d1 watcher: Doxygen comment fixed 2014-10-13 16:56:30 +02:00
Tobias Brunner 245979abc0 charon-systemd: Typo in log message fixed 2014-10-13 16:51:20 +02:00
Avesh Agarwal c8719a073d libimcv: Fix harcoded IMCV_DEFAULT_POLICY_SCRIPT name 
I came across an issue with src/libimcv/imcv.c where
IMCV_DEFAULT_POLICY_SCRIPT is hardcoded.

It fails where ipsec_script is renamed to, for example, strongswan from
default ipsec.
 2014-10-13 16:15:33 +02:00
Tobias Brunner 504bcf71b5 testing: Enable nat table for iptables on 3.17 kernels 2014-10-13 15:48:55 +02:00
Tobias Brunner 472156eea5 ike: Do remote address updates also when behind static NATs 
We assume that a responder is behind a static NAT (e.g. port forwarding)
and allow remote address updates in such situations.

The problem described in RFC 5996 is only an issue if the NAT mapping
can expire.
 2014-10-13 15:20:17 +02:00
Tobias Brunner f8a565fbcc ike: Remove redundant check for local NAT when handling changed NAT mappings 2014-10-13 15:20:17 +02:00
Andreas Steffen cb5ad2ba3d testing: Lower batch size to demonstrated segmetation of TCG/SWID Tag ID Inventory attribute 2014-10-11 15:01:21 +02:00
Andreas Steffen 8b812065f0 Support of multiple directed segmentation contracts 2014-10-11 14:50:08 +02:00
Andreas Steffen ab99939628 unit-tests: Updated Makefile 2014-10-11 14:50:08 +02:00
Andreas Steffen a05ca71d07 unit-tests: Added test for seg_contract_manager 2014-10-11 14:50:08 +02:00
Andreas Steffen a5e6a479d4 Added KVM config for 3.16 and 3.17 kernels 2014-10-11 14:50:08 +02:00
Andreas Steffen 4af020be37 Updated build-database.sh script to 3.13.0-37 kernel 2014-10-11 11:40:43 +02:00
Tobias Brunner 83efded313 testing: Ensure no guest is running when modifying images 
Sometimes guests are not stopped properly. If images are then modified
they will be corrupted.
 2014-10-10 19:03:50 +02:00