Serverd now fails handshake from early on, if no client certificate is presented by the peer.
Beatify source.
tls_generic_test now creates a different directory on each run.

Previously every time it failed we had to manually remove the
/tmp/tls_test directory, else it failed with different errors when
rerunning the test!
Update tls_generic_test.
Fortify the TLS handshake callback.

Up to now the TLS handshake callback was always returning success, and
key checks were performed manually after a small identification
dialog. Today this is still the case, with some extra checks in the
handshake.

The reason is that the same callback is used not only for the initial
handshake, but for any "TLS renegotiation" handshake. During such a
handshake, either the client or the server can change almost every
parameter of the secure session, even their certificates. For our custom
usage of the TLS protocol this shouldn't be an issue, since we disregard
anything about certificates and only care about the first presented key
which we compare to the one in ppkeys directory.

However an attack was recently published ("triple handshake" attack, see
[1]), which is applicable to the TLS protocol up to and including
version 1.2, that requires an /active/ and /trusted server/ as man in
the middle attacker exploiting session resumption and renegotiation,
both standard TLS features. CFEngine is using TLS in a very custom
manner and is not in danger from that attack.

[1] https://www.secure-resumption.com/

Nevertheless, this patchset employs the countermeasures suggested by the
authors of the attack. In particular, if any change of certificate is
detected during renegotiation, the renegotiation handshake is denied. In
addition, many rigorous sanity tests were added in the handshake
callback, and CFEngine refuses the connection if anything seems to be
fishy. All checks were added in both server and client side.
Merge pull request #1727 from jimis/fortify_tls_handshake

Fortify tls handshake
Redmine#5667 - address ps -axo shift on FreeBSD 10.0-RELEASE and later

As discussed and documented in Redmine#5667 , there's an inevitable creep to the right going on in FreeBSD 10 and later which has been demonstrated to break bootstrapping in a severe fashion. Going with the most elegant fix, which is to just say 'auxw' in line with Darwin, which is closest for these purposes. Output and column starts do not change, just guarantees getting complete lines regardless of terminal width. Quick test shows no impact.
Note that columns with -axo DO variably shift now on 10 and later, so systems with long runtimes trying to bootstrap are likely to encounter the described bug.
Redmine #1884, #5873: Read module output in text mode on Windows.

Module output is always text, and without this we will get illegal
characters in the module protocol parsing.

There are more tests to fix in the Windows area than I have included
here, but this will have to do for now.
Merge pull request #1728 from rootwyrm/patch-1

Redmine#5667 - address ps -axo shift on FreeBSD 10.0-RELEASE and later
Disable all renegotiation, resumption options and set safest defaults.

Reason is we want to expose a minimal attack surface on the very complex
TLS protocol and its implementations.

To disable TLS renegotiation and session resumption we need to turn off
the server-side session cache *and* disable session tickets (RFC 5077)
extension, see [1]. In the future we can always selectively re-enable
options in order to gain a performance boost.

[1] https://www.mail-archive.com/openssl-users@openssl.org/msg73185.html

Since we do not care about cross-browser compatibility and web, we also
disable all OpenSSL defaults that help with backwards compatibility.
Merge pull request #1730 from jimis/minor

Disable all renegotiation, resumption options and set safest defaults.
Merge pull request #1729 from kacfengine/module_text_mode

Redmine #1884, #5873: Read module output in text mode on Windows.
Redmine#5882: add INFORM message when the given permissions will be filtered
Merge pull request #1731 from tzz/feature/redmine5882-inform-ambitious-permissions

Redmine#5882: add INFORM message when the given permissions will be filtered
Beginnings of a unit test for ParseModeString.
Merge pull request #1732 from vohi/test/parsemodestring

Beginnings of a unit test for ParseModeString.
examples/some.cf: update example to show testing for an empty list
examples/some.cf: update example comments
Add interface promise type
Add files for interfaces