denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use attest database in tnc/tnccs-20-os scenario

Browse Source
This commit is contained in:
Andreas Steffen
2013-04-21 16:31:23 +02:00
parent 9fab0a58d3
commit 0f499f41dc
6 changed files with 268 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/tnc/tnccs-20-os/evaltest.dat
+2 -1
View File
@@ -6,8 +6,10 @@ dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::Y
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: ipsec attest --devices 2> /dev/null::Debian 7.0 x86_64.*[email protected]::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon:: ipsec attest --devices 2> /dev/null::Windows 1.2.3.*[email protected]::YES
moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
@@ -16,4 +18,3 @@ carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO
testing/tests/tnc/tnccs-20-os/hosts/moon/etc/strongswan.conf
+8 -1
View File
@@ -1,7 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
multiple_authentication=no
plugins {
eap-ttls {
@@ -18,7 +18,14 @@ charon {
libimcv {
plugins {
imv-os {
database = sqlite:///etc/pts/config.db
request_installed_packages = yes
}
}
}
attest {
load = random nonce openssl sqlite
database = sqlite:///etc/pts/config.db
}
testing/tests/tnc/tnccs-20-os/posttest.dat
+1
View File
@@ -5,3 +5,4 @@ moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
carol::echo 1 > /proc/sys/net/ipv4/ip_forward
moon::rm /etc/pts/config.db
testing/tests/tnc/tnccs-20-os/pretest.dat
+4
View File
@@ -2,6 +2,8 @@ moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
carol::echo 0 > /proc/sys/net/ipv4/ip_forward
dave::echo aabbccddeeff11223344556677889900 > /var/lib/dbus/machine-id
moon::cd /etc/pts; cat tables.sql data.sql | sqlite3 config.db
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
@@ -12,3 +14,5 @@ carol::sleep 1
carol::ipsec up home
dave::ipsec up home
dave::sleep 1
moon::ipsec attest --packages --product 'Debian 7.0'
moon::ipsec attest --devices