strongswan.git
5 years agoikev2: Add Cisco FRAGMENTATION vendor ID
Martin Willi [Fri, 17 Jan 2014 11:00:13 +0000 (12:00 +0100)]
ikev2: Add Cisco FRAGMENTATION vendor ID

Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.

5 years agoikev2: Add Cisco Copyright vendor ID
Martin Willi [Fri, 17 Jan 2014 10:58:12 +0000 (11:58 +0100)]
ikev2: Add Cisco Copyright vendor ID

Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.

5 years agoikev2: Add Cisco Delete Reason vendor ID
Martin Willi [Fri, 17 Jan 2014 10:57:47 +0000 (11:57 +0100)]
ikev2: Add Cisco Delete Reason vendor ID

Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.

5 years agoikev2: Use a more dynamic vendor ID database, as we use with IKEv1
Martin Willi [Fri, 17 Jan 2014 10:37:35 +0000 (11:37 +0100)]
ikev2: Use a more dynamic vendor ID database, as we use with IKEv1

5 years agoMerge branch 'chunk-mmap'
Martin Willi [Thu, 23 Jan 2014 14:55:44 +0000 (15:55 +0100)]
Merge branch 'chunk-mmap'

Introduces file mmap/munmap() wrappers and provides a fallback if mmap() is not
supported. Replaces all mmap() uses by the new functions.

5 years agolibpts: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:49:19 +0000 (14:49 +0100)]
libpts: Use chunk_map() instead of non-portable mmap()

5 years agotnccs: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:49:57 +0000 (14:49 +0100)]
tnccs: Use chunk_map() instead of non-portable mmap()

5 years agopem: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:49:37 +0000 (14:49 +0100)]
pem: Use chunk_map() instead of non-portable mmap()

5 years agostroke: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:48:03 +0000 (14:48 +0100)]
stroke: Use chunk_map() instead of non-portable mmap()

5 years agoradattr: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:47:23 +0000 (14:47 +0100)]
radattr: Use chunk_map() instead of non-portable mmap()

5 years agolibfast: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:48:23 +0000 (14:48 +0100)]
libfast: Use chunk_map() instead of non-portable mmap()

5 years agointegrity-checker: Use chunk_map() instead of non-portable mmap()
Martin Willi [Thu, 21 Nov 2013 13:50:30 +0000 (14:50 +0100)]
integrity-checker: Use chunk_map() instead of non-portable mmap()

5 years agochunk: Externalize error reporting in chunk_write()
Martin Willi [Thu, 21 Nov 2013 13:22:01 +0000 (14:22 +0100)]
chunk: Externalize error reporting in chunk_write()

This avoids passing that arbitrary label just for error messages, and gives
greater flexibility in handling errors.

5 years agochunk: Provide a fallback chunk_map() if mmap is not available
Martin Willi [Thu, 21 Nov 2013 13:07:12 +0000 (14:07 +0100)]
chunk: Provide a fallback chunk_map() if mmap is not available

5 years agochunk: Use dynamically allocated buffer in chunk_from_fd()
Martin Willi [Thu, 21 Nov 2013 11:19:20 +0000 (12:19 +0100)]
chunk: Use dynamically allocated buffer in chunk_from_fd()

When acting on files, we can use fstat() to estimate the buffer size. On
non-file FDs, we dynamically increase an allocated buffer.

Additionally we slightly change the function signature to properly handle
zero-length files and add appropriate unit tests.

5 years agochunk: Add functions to map file contents to a chunk
Martin Willi [Thu, 21 Nov 2013 10:29:46 +0000 (11:29 +0100)]
chunk: Add functions to map file contents to a chunk

5 years agoMerge branch 'unity-fixes'
Tobias Brunner [Thu, 23 Jan 2014 10:19:38 +0000 (11:19 +0100)]
Merge branch 'unity-fixes'

Improves compatibility with the Cisco and Shrew clients.

Fixes #445.

5 years agounity: Send all traffic selectors in a single UNITY_SPLIT_INCLUDE attribute
Tobias Brunner [Fri, 15 Nov 2013 15:45:59 +0000 (16:45 +0100)]
unity: Send all traffic selectors in a single UNITY_SPLIT_INCLUDE attribute

Cisco clients only handle the first such attribute.

5 years agounity: Change local TS to 0.0.0.0/0 as responder
Tobias Brunner [Fri, 15 Nov 2013 14:15:19 +0000 (15:15 +0100)]
unity: Change local TS to 0.0.0.0/0 as responder

Cisco clients and Shrew expect a remote TS of 0.0.0.0/0 if Unity is
used, otherwise Quick Mode fails.

5 years agounity: Send UNITY_SPLIT_INCLUDE attributes with proper padding
Tobias Brunner [Fri, 15 Nov 2013 13:54:42 +0000 (14:54 +0100)]
unity: Send UNITY_SPLIT_INCLUDE attributes with proper padding

The additional 6 bytes are not actually padding but are parsed by the
Cisco client as protocol and src and dst ports (each two bytes but
strangely only the first two in network order).

5 years agoMerge branch 'ipcomp'
Tobias Brunner [Thu, 23 Jan 2014 09:27:49 +0000 (10:27 +0100)]
Merge branch 'ipcomp'

Fixes compatibility issues between firewall rules (leftfirewall=yes)
and IPComp (compress=yes), plus issues with IPComp when used with
multiple subnets in left|rightsubnet.

Fixes #436.

5 years agotesting: Add ikev2/host2host-transport-nat scenario
Tobias Brunner [Fri, 8 Nov 2013 13:57:01 +0000 (14:57 +0100)]
testing: Add ikev2/host2host-transport-nat scenario

5 years agotesting: Add ipv6/rw-compress-ikev2 scenario
Tobias Brunner [Fri, 8 Nov 2013 11:16:40 +0000 (12:16 +0100)]
testing: Add ipv6/rw-compress-ikev2 scenario

5 years agotesting: Add ikev2/compress-nat scenario
Tobias Brunner [Fri, 8 Nov 2013 10:12:04 +0000 (11:12 +0100)]
testing: Add ikev2/compress-nat scenario

5 years agotesting: Enable firewall for ikev2/compress scenario
Tobias Brunner [Fri, 8 Nov 2013 09:54:20 +0000 (10:54 +0100)]
testing: Enable firewall for ikev2/compress scenario

Additionally, send a regular (small) ping as the kernel does not
compress small packets and handles those differently inbound.

5 years agokernel-netlink: Set selector on transport mode IPComp SAs
Tobias Brunner [Thu, 7 Nov 2013 20:02:07 +0000 (21:02 +0100)]
kernel-netlink: Set selector on transport mode IPComp SAs

5 years agokernel-netlink: Selectively add selector on SAs that use IPComp
Tobias Brunner [Thu, 7 Nov 2013 19:58:42 +0000 (20:58 +0100)]
kernel-netlink: Selectively add selector on SAs that use IPComp

Don't add a selector to tunnel mode SAs, these might serve multiple
traffic selectors but with only one selector on the SA only the traffic
matching the first one would actually get tunneled.

5 years agoupdown: Increase buffer size for script and environment variables
Tobias Brunner [Thu, 7 Nov 2013 19:56:30 +0000 (20:56 +0100)]
updown: Increase buffer size for script and environment variables

5 years agoupdown: Allow IPIP traffic if IPComp was negotiated
Tobias Brunner [Thu, 7 Nov 2013 16:50:02 +0000 (17:50 +0100)]
updown: Allow IPIP traffic if IPComp was negotiated

The kernel implicitly creates an IPIP SA if an IPComp SA is installed.
This SA is used inbound for small packets that are not compressed.

Since the addresses are different (they are the tunnel addresses not
those of the tunneled traffic) additional rules are required if the
traffic selector does not cover the tunnel addresses (e.g. due to a NAT).

For SAs with multiple traffic selectors duplicate rules will get installed.

5 years agoupdown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated
Tobias Brunner [Thu, 7 Nov 2013 16:48:40 +0000 (17:48 +0100)]
updown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated

5 years agocurl: Replace spaces in URIs with %20
Tobias Brunner [Fri, 22 Nov 2013 09:42:18 +0000 (10:42 +0100)]
curl: Replace spaces in URIs with %20

cURL requires the URIs to be URL-encoded. Apparently, some CAs encode CRL
URIs with spaces in them.

Fixes #454.

5 years agoutils: Add strreplace function
Tobias Brunner [Fri, 22 Nov 2013 09:30:16 +0000 (10:30 +0100)]
utils: Add strreplace function

5 years agostroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated
Tobias Brunner [Fri, 29 Nov 2013 16:42:11 +0000 (17:42 +0100)]
stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated

Otherwise a malicious user could send an unterminated string to cause
unterminated reads.

5 years agostroke: Add an option to prevent log level changes via stroke socket
Tobias Brunner [Fri, 29 Nov 2013 16:27:23 +0000 (17:27 +0100)]
stroke: Add an option to prevent log level changes via stroke socket

5 years agopki: Make sure no command registers too many options
Tobias Brunner [Wed, 11 Dec 2013 16:38:18 +0000 (17:38 +0100)]
pki: Make sure no command registers too many options

5 years agopki: Increase MAX_COMMANDS to cover all currently available commands
Tobias Brunner [Wed, 11 Dec 2013 16:24:03 +0000 (17:24 +0100)]
pki: Increase MAX_COMMANDS to cover all currently available commands

Fixes #452.

5 years agopki: Print a warning if MAX_COMMANDS is too low
Tobias Brunner [Wed, 11 Dec 2013 16:23:43 +0000 (17:23 +0100)]
pki: Print a warning if MAX_COMMANDS is too low

5 years agopki: Properly use ?: when defining option arrays
Tobias Brunner [Wed, 11 Dec 2013 16:21:06 +0000 (17:21 +0100)]
pki: Properly use ?: when defining option arrays

5 years agoconfigure: Add -Wno-format-security to default CFLAGS
Tobias Brunner [Mon, 25 Nov 2013 17:20:13 +0000 (18:20 +0100)]
configure: Add -Wno-format-security to default CFLAGS

Either due to a change in Ubuntu 13.10 or GCC 4.8 -Wno-format has no
effect if -Wformat-security is enabled (which it is on Ubuntu) so we
also disable the latter by default.

5 years agoagent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket
Tobias Brunner [Thu, 21 Nov 2013 16:12:21 +0000 (17:12 +0100)]
agent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket

This is also required if charon-cmd is used with capability dropping.

5 years agoike: Simplify error handling if name resolution failed
Tobias Brunner [Mon, 11 Nov 2013 15:17:35 +0000 (16:17 +0100)]
ike: Simplify error handling if name resolution failed

This avoids a second name resolution attempt just to determine if %any
etc. was configured.

Fixes #440.

5 years agoike: Use proper hostname(s) when name resolution failed
Tobias Brunner [Mon, 11 Nov 2013 15:16:03 +0000 (16:16 +0100)]
ike: Use proper hostname(s) when name resolution failed

Was wrong since 0edce687675df8f10f4026fa12a8fc3b3dd003f5.

Fixes #440.

5 years agoikev2: Wipe (optional) shared secret during CHILD_SA key derivation
Tobias Brunner [Wed, 6 Nov 2013 09:30:27 +0000 (10:30 +0100)]
ikev2: Wipe (optional) shared secret during CHILD_SA key derivation

5 years agochecksum must be the last subdir included
Tobias Brunner [Thu, 23 Jan 2014 08:41:35 +0000 (09:41 +0100)]
checksum must be the last subdir included

Otherwise charon-cmd will not yet be installed when the checksums are
calculated (now from the install dir, not the build dir).

Fixes #496.

5 years agounit-tests: Pass a test suite collection name to print during test execution
Martin Willi [Tue, 21 Jan 2014 16:48:08 +0000 (17:48 +0100)]
unit-tests: Pass a test suite collection name to print during test execution

As we except to get more and more test runners for the different components,
we add a name to easily identify them on the test output.

5 years agoarray: Add an array_get() function
Martin Willi [Tue, 21 Jan 2014 12:23:32 +0000 (13:23 +0100)]
array: Add an array_get() function

5 years agowatcher: Don't complain if select() syscall got interrupted
Martin Willi [Wed, 22 Jan 2014 13:25:03 +0000 (14:25 +0100)]
watcher: Don't complain if select() syscall got interrupted

5 years agostream: Make sure no watcher callback is active while changing stream callbacks
Martin Willi [Tue, 21 Jan 2014 16:36:38 +0000 (17:36 +0100)]
stream: Make sure no watcher callback is active while changing stream callbacks

When changing async callbacks on streams, we have to make sure the watcher
callback is not currently active and has temporarily disabled callbacks. This
could have been the case, as we didn't explicitly removed any pending
watcher registration if both callbacks are NULL.

By enforcing the watcher unregistration, we are sure the watcher callback is
not active and currently is not mangling the callback hooks. This should make
sure we avoid any races for the callback variables.

5 years agochecksum: Read executables from DESTDIR
Tobias Brunner [Tue, 21 Jan 2014 13:53:46 +0000 (14:53 +0100)]
checksum: Read executables from DESTDIR

This allows to recreate the checksums after the installed binaries have
been modified e.g. with strip.

Fixes #491.

5 years agoman: Add documentation of the dhcp interface option
Thomas Egerer [Tue, 19 Nov 2013 12:42:54 +0000 (13:42 +0100)]
man: Add documentation of the dhcp interface option

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
5 years agodhcp: Allow binding of socket to particular interface
Thomas Egerer [Mon, 18 Nov 2013 12:15:02 +0000 (13:15 +0100)]
dhcp: Allow binding of socket to particular interface

In certain situations it is desirable to bind the send/receive sockets
for the DHCP address allocation to a particular interface. With this
patch the strongswan.conf option charon.plugins.dhcp.interface can be
used to restrict the DHCP communication to a configurable interface.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
5 years agoproposal: Add possibility to register custom proposal keyword parser
Thomas Egerer [Fri, 29 Nov 2013 12:17:30 +0000 (13:17 +0100)]
proposal: Add possibility to register custom proposal keyword parser

If a proposal string cannot be matched to a token using strcmp (e.g. if
you want to register a whole class of algorithms containing their ID,
like my_alg_2342), you can use the provided function to register a
parser that transforms the given string into a proposal token.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
5 years agounit-tests: Add environment variable to reduce the number of generated keys
Tobias Brunner [Mon, 20 Jan 2014 14:35:13 +0000 (15:35 +0100)]
unit-tests: Add environment variable to reduce the number of generated keys

If TESTS_REDUCED_KEYLENGTHS is set RSA and ECDSA keys are only generated
for the lowest configured key length.

Fixes #474.

5 years agounit-tests: Generate RSA key with 768 bits not 786
Tobias Brunner [Mon, 20 Jan 2014 14:27:09 +0000 (15:27 +0100)]
unit-tests: Generate RSA key with 768 bits not 786

6 years agoike_sa: Defer task manager destruction after child destruction
Thomas Egerer [Thu, 16 Jan 2014 12:24:08 +0000 (13:24 +0100)]
ike_sa: Defer task manager destruction after child destruction

This patch exports the task manager's flush to allow flushing of all
queues with one function call from ike_sa->destroy. It allows the
access of intact children during task destructoin (see git-commit
e44ebdcf) and allows the access of the task manager in
child_state_change hook.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
6 years agoVersion bump to 5.1.2rc1
Andreas Steffen [Thu, 16 Jan 2014 00:47:34 +0000 (01:47 +0100)]
Version bump to 5.1.2rc1

6 years agoAdded TPMRA workitem support in PTS database
Andreas Steffen [Thu, 16 Jan 2014 00:46:55 +0000 (01:46 +0100)]
Added TPMRA workitem support in PTS database

6 years agoprintf-hook-builtin: Correctly calculate written bytes in print_in_hook()
Martin Willi [Wed, 15 Jan 2014 17:18:24 +0000 (18:18 +0100)]
printf-hook-builtin: Correctly calculate written bytes in print_in_hook()

The hook data counts remaining buffer bytes, not used ones. Counting them
correctly fixes a crash for long hexdumps.

Further, print_in_hook() must return the number of bytes that would have been
written, not the actually written bytes. This is important, as we allocate a
dynamic buffer in bus that relies on the exact byte count. Fixes long hexdumps
that got truncated.

6 years agoDo PTS measurements only if session initialisation was successful 5.1.2dr3
Andreas Steffen [Wed, 15 Jan 2014 11:06:22 +0000 (12:06 +0100)]
Do PTS measurements only if session initialisation was successful

6 years agoStarting with 3.1.7 kernel.org replaced bz2 with xz format
Andreas Steffen [Wed, 15 Jan 2014 01:14:08 +0000 (02:14 +0100)]
Starting with 3.1.7  replaced bz2 with xz format

6 years agoVersion bump to 5.1.2dr3
Andreas Steffen [Mon, 13 Jan 2014 11:12:52 +0000 (12:12 +0100)]
Version bump to 5.1.2dr3

6 years agoCatch AIK errors
Andreas Steffen [Mon, 13 Jan 2014 07:19:10 +0000 (08:19 +0100)]
Catch AIK errors

6 years agoDo TPM measurements only if there is a TPMRA workitem
Andreas Steffen [Fri, 10 Jan 2014 10:53:50 +0000 (11:53 +0100)]
Do TPM measurements only if there is a TPMRA workitem

6 years agoAllow reason strings to be used as workitem result string
Andreas Steffen [Tue, 31 Dec 2013 12:13:32 +0000 (13:13 +0100)]
Allow reason strings to be used as workitem result string

6 years agoAttestation IMV processes TPMRA workitem
Andreas Steffen [Thu, 26 Dec 2013 16:39:05 +0000 (17:39 +0100)]
Attestation IMV processes TPMRA workitem

6 years agoAdded TPM Remote Attestation (TPMRA) workitem
Andreas Steffen [Thu, 26 Dec 2013 10:28:51 +0000 (11:28 +0100)]
Added TPM Remote Attestation (TPMRA) workitem

6 years agochecksum: Set rpath including DESTDIR for checksum_builder
Tobias Brunner [Wed, 8 Jan 2014 10:24:24 +0000 (11:24 +0100)]
checksum: Set rpath including DESTDIR for checksum_builder

This way libraries to which checksum_builder does not itself link,
like libtls and libradius, are found during DESTDIR installs.

Fixes #476.

6 years agotest-asn1: Fix skipping of >2038 tests on i386
Tobias Brunner [Mon, 6 Jan 2014 17:01:06 +0000 (18:01 +0100)]
test-asn1: Fix skipping of >2038 tests on i386

The two constants overflow time_t on i386 (they also produced a compiler
warning without type suffix) so the comparison with TIME_32_BIT_SIGNED_MAX
did not work as intended.

Fixes #477.

6 years agochunk: Fix chunk_mac/hash tests on big-endian systems
Tobias Brunner [Mon, 6 Jan 2014 16:31:07 +0000 (17:31 +0100)]
chunk: Fix chunk_mac/hash tests on big-endian systems

Our SipHash-2-4 implementation returns the result in host order, while
the test vectors are little-endian.  Use a custom comparison function to
account for this.

Fixes #478.

6 years agoutils: Fix %T printf hook on big-endian systems
Tobias Brunner [Mon, 6 Jan 2014 14:30:02 +0000 (15:30 +0100)]
utils: Fix %T printf hook on big-endian systems

The cast to a bool* cut of the actual value on big-endian systems
if bool was shorter than int because the bool argument to printf gets
promoted to an int.

Fixes #479.

6 years agochecksum: Delay building of checksum_builder until required by make install
Tobias Brunner [Mon, 6 Jan 2014 13:17:20 +0000 (14:17 +0100)]
checksum: Delay building of checksum_builder until required by make install

This ensures PLUGINDIR includes any DESTDIR set during make install.

6 years agochecksum: Remove unnecessary pluto symbol
Tobias Brunner [Mon, 6 Jan 2014 12:37:12 +0000 (13:37 +0100)]
checksum: Remove unnecessary pluto symbol

6 years agostroke: Fix error message if parsing leftsourceip fails
Tobias Brunner [Mon, 6 Jan 2014 11:55:10 +0000 (12:55 +0100)]
stroke: Fix error message if parsing leftsourceip fails

6 years agoUpdate PCR even if measurement does not equal reference value
Andreas Steffen [Fri, 20 Dec 2013 23:39:40 +0000 (00:39 +0100)]
Update PCR even if measurement does not equal reference value

6 years agotun-device: Include system headers before our own
Tobias Brunner [Fri, 20 Dec 2013 10:24:02 +0000 (11:24 +0100)]
tun-device: Include system headers before our own

On CentOS 6.5 the sys/capability.h header file defines _LINUX_TYPES_H
without actually including that header, preventing its later inclusion
here.

As library.h (via which the capabilities headers are included) is not
actually required in tun_device.[ch], moving the inclusion of tun_device.h
would not strictly be necessary.  But it's probably a good idea to
include our own headers after system headers anyway, for if one of the
recursively included files at a later point includes library.h we'd have
the same problem again.

6 years agoaes-test: Fix compiler warnings from older versions of GCC
Tobias Brunner [Thu, 19 Dec 2013 10:02:23 +0000 (11:02 +0100)]
aes-test: Fix compiler warnings from older versions of GCC

6 years agoFixed check_file_measurement method in pts_database_t
Andreas Steffen [Fri, 13 Dec 2013 13:37:31 +0000 (14:37 +0100)]
Fixed check_file_measurement method in pts_database_t

6 years agounit-tests: NTRU test to check a special branch
Andreas Steffen [Sun, 8 Dec 2013 09:18:33 +0000 (10:18 +0100)]
unit-tests: NTRU test to check a special branch

6 years agomin_MGF_hash_calls parameter is not needed anymore
Andreas Steffen [Sat, 7 Dec 2013 22:54:53 +0000 (23:54 +0100)]
min_MGF_hash_calls parameter is not needed anymore

6 years agoOptimized MGF1 implementation
Andreas Steffen [Sat, 7 Dec 2013 22:29:04 +0000 (23:29 +0100)]
Optimized MGF1 implementation

6 years agoImplemented ntru_trits class
Andreas Steffen [Sat, 7 Dec 2013 22:27:59 +0000 (23:27 +0100)]
Implemented ntru_trits class

6 years agoStreamlined DRBG and MGF1 debug output
Andreas Steffen [Fri, 6 Dec 2013 23:21:28 +0000 (00:21 +0100)]
Streamlined DRBG and MGF1 debug output

6 years agoVersion bump to 5.1.2dr2 5.1.2.dr2
Andreas Steffen [Fri, 6 Dec 2013 09:10:24 +0000 (10:10 +0100)]
Version bump to 5.1.2dr2

6 years agounit-tests: Added crypter tests
Andreas Steffen [Fri, 6 Dec 2013 09:09:36 +0000 (10:09 +0100)]
unit-tests: Added crypter tests

6 years agoAdded own MGF1 mask generating function
Andreas Steffen [Thu, 5 Dec 2013 21:55:47 +0000 (22:55 +0100)]
Added own MGF1 mask generating function

6 years agounit-tests: Added hasher tests
Andreas Steffen [Wed, 4 Dec 2013 22:09:32 +0000 (23:09 +0100)]
unit-tests: Added hasher tests

6 years agoMoved test_rng to a test suite of its own
Andreas Steffen [Wed, 4 Dec 2013 20:23:30 +0000 (21:23 +0100)]
Moved test_rng to a test suite of its own

6 years agounit-tests: Don't use priority for destructor that unregisters testable functions
Tobias Brunner [Mon, 2 Dec 2013 10:16:04 +0000 (11:16 +0100)]
unit-tests: Don't use priority for destructor that unregisters testable functions

This fixes coverage reports, at least if leak detective is disabled.
If it is enabled the plugins are not unloaded so the destructor is not
executed until the process is destroyed, which seems not to be covered
by gcov.

6 years agounit-tests: Export ntru_drbg_create as testable function so no linking is required
Tobias Brunner [Thu, 28 Nov 2013 17:06:09 +0000 (18:06 +0100)]
unit-tests: Export ntru_drbg_create as testable function so no linking is required

This way the plugin does not have to be linked explicitly to the test
runner, which otherwise would require that the plugin is either always
enabled to build the tests or that ifdefs are added to the Makefile.

6 years agounit-tests: Add facility to register testable functions
Tobias Brunner [Thu, 28 Nov 2013 17:02:18 +0000 (18:02 +0100)]
unit-tests: Add facility to register testable functions

These can be defined in plugins, or other parts of the tested libraries.
They can even be static.

6 years agounit-tests: Move ntru_test_rng_t to a utility class in libtest
Tobias Brunner [Thu, 28 Nov 2013 17:00:33 +0000 (18:00 +0100)]
unit-tests: Move ntru_test_rng_t to a utility class in libtest

6 years agounit-tests: Fix apidoc for libtest
Tobias Brunner [Thu, 28 Nov 2013 16:54:06 +0000 (17:54 +0100)]
unit-tests: Fix apidoc for libtest

6 years agontru: Fix compiler warning caused by ++/-- on righthand side of an assignment
Tobias Brunner [Thu, 28 Nov 2013 16:31:46 +0000 (17:31 +0100)]
ntru: Fix compiler warning caused by ++/-- on righthand side of an assignment

The behavior of stuff like x = --x; (or x++) is not defined.

6 years agotesting: Fix status output in build-baseimage script
Reto Buerki [Thu, 28 Nov 2013 12:51:33 +0000 (13:51 +0100)]
testing: Fix status output in build-baseimage script

6 years agoRemove check library from HACKING document
Reto Buerki [Thu, 28 Nov 2013 08:36:52 +0000 (09:36 +0100)]
Remove check library from HACKING document

6 years agocharon-tkm: Abort if gprbuild binary is not found
Reto Buerki [Thu, 28 Nov 2013 08:37:55 +0000 (09:37 +0100)]
charon-tkm: Abort if gprbuild binary is not found

6 years agocharon-tkm: Update integration tests
Reto Buerki [Tue, 26 Nov 2013 16:20:59 +0000 (17:20 +0100)]
charon-tkm: Update integration tests

6 years agocharon-tkm: Implement IANA DH Id to TKM Id mapping
Adrian-Ken Rueegsegger [Tue, 26 Nov 2013 15:20:24 +0000 (16:20 +0100)]
charon-tkm: Implement IANA DH Id to TKM Id mapping

The TKM Diffie-Hellman plugin now maps IANA DH identifiers to TKM DH
algorithm identifiers. The mapping is specified in the daemon's
'dh_mapping' section in the strongswan.conf file:

dh_mapping {
iana_id1 = tkm_id1
iana_id2 = tkm_id2
iana_id3 = tkm_id3
...
}

Only the mapped IANA IDs are registered as supported DH groups.

6 years agocharon-tkm: Drop unnecessary include
Adrian-Ken Rueegsegger [Tue, 26 Nov 2013 10:30:57 +0000 (11:30 +0100)]
charon-tkm: Drop unnecessary include

6 years agoFixed formatting in strongswan.conf
Andreas Steffen [Tue, 3 Dec 2013 07:17:39 +0000 (08:17 +0100)]
Fixed formatting in strongswan.conf