Martin Willi
2de481e32b
Delegate tls_t.get_{peer,server}_id to handshake layer
...
This allows to get updated peer identities if the peer can't authenticate,
or does when it is optional.
2013-02-28 16:46:08 +01:00
Martin Willi
2ae0c9e618
Implement a SASL PLAIN mechanism using shared secrets
2013-02-28 16:46:07 +01:00
Martin Willi
66d8fd690c
Implement SASL authentication in PT-TLS client
2013-02-28 16:46:07 +01:00
Martin Willi
3542c4f18a
Implement SASL authentication in PT-TLS server
2013-02-28 16:46:07 +01:00
Martin Willi
5b1a10836c
Define PT-TLS SASL result codes
2013-02-28 16:46:07 +01:00
Martin Willi
4a801beb3e
Define an interface for SASL mechanisms and provide a static factory
2013-02-28 16:46:07 +01:00
Martin Willi
806126eab2
Pass a client identity to pt_tls_client, usable for TLS or SASL authentication
2013-02-28 16:46:07 +01:00
Martin Willi
55854ecc25
Don't close underlying file descriptor before destroying a tls_socket
...
tls_socket cleanup usually sends a TLS close notify, for which it uses a valid
socket.
2013-02-28 16:46:07 +01:00
Tobias Brunner
bc07fef09c
Use SIGUSR2 for SIG_CANCEL on Android
...
SIGRTMIN is defined as 32 while sigset_t is defined as
unsigned long (i.e. holds 32 signals). Hence, the signal
could never be blocked. Sending the signal still canceled
threads, but sometimes in situations where they shouldn't
have been canceled (e.g. while holding a lock).
Fixes #298 .
2013-02-26 11:40:34 +01:00
Tobias Brunner
0ac34e9e6a
Android.mk updated to latest Makefiles
...
Fixes #300 .
2013-02-26 10:11:36 +01:00
Reto Buerki
b32e732b2f
Check kvm command existence in start-testing
2013-02-22 19:22:08 +01:00
Tobias Brunner
0d237763dc
openssl: Disable PKCS#7/CMS when building against OpenSSL < 0.9.8g
...
Fixes #292 .
2013-02-20 18:34:54 +01:00
Andreas Steffen
7a93844f21
version bump to 5.0.3dr2
2013-02-19 20:25:13 +01:00
Andreas Steffen
371b752f00
treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way
2013-02-19 20:00:57 +01:00
Tobias Brunner
39db06f155
Merge branch 'dnssec'
2013-02-19 12:25:27 +01:00
Tobias Brunner
d69eb0375f
NEWS about ipseckey and unbound plugins added
2013-02-19 12:25:01 +01:00
Andreas Steffen
f0c102cbfa
Added ikev2/rw-dnssec scenario
2013-02-19 12:25:01 +01:00
Andreas Steffen
1d4ff25fb8
Added ikev2/net2net-dnssec scenario
2013-02-19 12:25:01 +01:00
Andreas Steffen
37c589f0e0
Configure winnetou as a DNSSEC enabled nameserver for the strongswan.org, org, and root zones
2013-02-19 12:25:01 +01:00
Andreas Steffen
3fbc328d14
Build unbound and ipseckey plugins on KVM image
2013-02-19 12:25:01 +01:00
Andreas Steffen
65cdda5cf8
Streamlined log messages in ipseckey plugin
2013-02-19 12:25:00 +01:00
Andreas Steffen
a4ddc0bb26
Encode RSA public keys in RFC 3110 DNSKEY format
2013-02-19 12:25:00 +01:00
Andreas Steffen
f2145c8d3a
Moved configuration from resolver manager to unbound plugin
...
Also streamlined log messages in unbound plugin.
2013-02-19 12:25:00 +01:00
Reto Guadagnini
95650c0836
ipseckey: Report IPSECKEYs with invalid DNSSEC security state
2013-02-19 12:25:00 +01:00
Reto Guadagnini
932717fbde
ipseckey: Added "enable" option for the IPSECKEY plugin to strongswan.conf
2013-02-19 12:25:00 +01:00
Reto Guadagnini
a77bbc3b8c
Added ipseckey plugin, which provides support for public keys in IPSECKEY RRs
2013-02-19 12:25:00 +01:00
Reto Guadagnini
d786cbda5c
Implemented the resolver test script "dnssec"
2013-02-19 11:57:21 +01:00
Reto Guadagnini
cfd07978d0
unbound: Implementation of query method of unbound_resolver_t
2013-02-19 11:57:21 +01:00
Reto Guadagnini
5a4126b490
unbound: Implemented resolver_response_t as unbound_response_t
2013-02-19 11:57:21 +01:00
Reto Guadagnini
62ea67e700
Implemented rr_set_t interface
2013-02-19 11:57:21 +01:00
Reto Guadagnini
4a335a2164
unbound: Implemented rr_t as unbound_rr_t
2013-02-19 11:57:21 +01:00
Reto Guadagnini
9f963a7cfc
Added unbound plugin implementing the resolver interface using libunbound
2013-02-19 11:57:21 +01:00
Reto Guadagnini
b1505b345b
Added manager for DNS resolvers
2013-02-19 11:57:21 +01:00
Reto Guadagnini
ffdeeb6609
Added interface for DNS resolvers
2013-02-19 11:57:21 +01:00
Andreas Steffen
c381e46855
added missing return statement
2013-02-19 10:24:23 +01:00
Martin Willi
69faf63528
Fix encoding of issuerAndSubject while handling SCEP pending state
2013-02-19 09:53:47 +01:00
Andreas Steffen
0f7cb0caf4
reject PB-Experimental messages with NOSKIP flag set
2013-02-19 09:31:34 +01:00
Andreas Steffen
9b4a8e1ced
added parameter descriptions
2013-02-19 07:44:57 +01:00
Andreas Steffen
2c1219c217
removed superfluous debug output
2013-02-15 15:19:16 +01:00
Martin Willi
b5b76df012
Add a timeout to clean up PDP RADIUS connections
2013-02-14 17:20:09 +01:00
Martin Willi
dadd9744b6
Keep the PDP connections lock while accessing its objects
...
When we introduce connection timeouts, the state may disappear at any time.
This change prevents that, but is not very clear. We probably have to refactor
connection handling.
2013-02-14 17:19:56 +01:00
Martin Willi
37884ab10f
Add locking to TNC-PDP connections
2013-02-14 17:19:49 +01:00
Martin Willi
d20a2cc5f3
Add IF-M message subtype getter to IMC/IMV messages
2013-02-14 17:18:24 +01:00
Martin Willi
bbe9261bbf
Use a generic constructor to create PA-TNC error attributes
2013-02-14 17:18:00 +01:00
Martin Willi
4755ab505d
Add a global return_success() method implementation
2013-02-14 17:17:45 +01:00
Martin Willi
de32b8aed6
Add a convenience method to check pen_type_t for vendor and type
2013-02-14 17:17:30 +01:00
Martin Willi
d03b338487
Add a comparison function for pen_type_t
2013-02-14 17:17:22 +01:00
Martin Willi
9db54bbcd4
Whitespace and comment cleanups in pen.[ch]
2013-02-14 17:17:07 +01:00
Andreas Steffen
f838f457a8
resolve dependency on libtls
2013-02-14 17:15:33 +01:00
Martin Willi
e212033ef2
Merge branch 'ike-dscp'
2013-02-14 17:11:35 +01:00
Martin Willi