tteras/strongswan/src/libcharon/plugins/eap_tnc, branch master tteras' strongSwan tree libhydra: Remove empty unused library 2016-03-03T16:36:11+00:00 Tobias Brunner tobias@strongswan.org 2016-02-12T15:35:54+00:00 28649f6d91971e0fe50078aec2937010e8c61cd8 






Fix of the mutual TNC measurement use case
2016-02-16T17:00:27+00:00

Andreas Steffen
andreas.steffen@strongswan.org

2016-02-16T17:00:27+00:00

4d83c5b4a6bcbf6a6426d7ba79fac4494ab36329

If the IKEv2 initiator acting as a TNC server receives invalid TNC measurements
from the IKEv2 responder acting as a TNC clienti, the exchange of PB-TNC batches
is continued until the IKEv2 responder acting as a TNC server has also finished
its TNC measurements.

In the past if these measurements in the other direction were correct
the IKEv2 responder acting as EAP server declared the IKEv2 EAP authentication
successful and the IPsec connection was established even though the TNC
measurement verification on the EAP peer side failed.

The fix adds an "allow" group membership on each endpoint if the corresponding
TNC measurements of the peer are successful. By requiring a "allow" group
membership in the IKEv2 connection definition the IPsec connection succeeds
only if the TNC measurements on both sides are valid.





If the IKEv2 initiator acting as a TNC server receives invalid TNC measurements
from the IKEv2 responder acting as a TNC clienti, the exchange of PB-TNC batches
is continued until the IKEv2 responder acting as a TNC server has also finished
its TNC measurements.

In the past if these measurements in the other direction were correct
the IKEv2 responder acting as EAP server declared the IKEv2 EAP authentication
successful and the IPsec connection was established even though the TNC
measurement verification on the EAP peer side failed.

The fix adds an "allow" group membership on each endpoint if the corresponding
TNC measurements of the peer are successful. By requiring a "allow" group
membership in the IKEv2 connection definition the IPsec connection succeeds
only if the TNC measurements on both sides are valid.







Fixed AR identities in mutual TNC measurements case
2015-08-15T20:46:21+00:00

Andreas Steffen
andreas.steffen@strongswan.org

2015-08-15T20:46:21+00:00

a330f72ecfd4b798efa0d4db63a7f4917e29e8be












eap-tnc: Free eap-tnc object if IKE_SA not found to get IPs
2015-03-25T12:24:37+00:00

Tobias Brunner
tobias@strongswan.org

2015-03-25T12:24:37+00:00

328db935bb16a17654a66bc4e8a1f3365153b23e












Make access requestor IP address available to TNC server
2015-03-08T16:17:11+00:00

Andreas Steffen
andreas.steffen@strongswan.org

2015-02-19T10:44:11+00:00

00cd79b6780acf1d2682038cb630e6871782f819












plugins: Don't link with -rdynamic on Windows
2014-06-04T13:53:02+00:00

Martin Willi
martin@revosec.ch

2013-10-25T14:03:47+00:00

4163421f918d830585bfdccde0973d8801aad258












Implemented PT-EAP protocol (RFC 7171)
2014-05-12T04:59:21+00:00

Andreas Steffen
andreas.steffen@strongswan.org

2014-05-11T18:49:21+00:00

8d59090349cb95e624c134533283a68ae95b8476












libcharon: Use lib->ns instead of charon->name
2014-02-12T13:34:32+00:00

Tobias Brunner
tobias@strongswan.org

2014-01-22T14:18:58+00:00

d223fe807a0a7fe6f358420256d11d407f7c9f07












check it specified IF-TNCCS protocol is enabled
2013-10-21T19:03:53+00:00

Andreas Steffen
andreas.steffen@strongswan.org

2013-10-21T19:03:53+00:00

27bf5c06dcaeee6d42b15d48ef4a0127a3d23f49












Keep a copy of the tnccs instance for PT-TLS handover
2013-10-09T17:03:07+00:00

Andreas Steffen
andreas.steffen@strongswan.org

2013-10-09T17:03:07+00:00

3588299fb8a14c4b260c30fc4dd6419cb74a8159