Added tnc/tnccs-20-pt-tls scenario

2013-08-19 11:36:23 +02:00
parent e626821677
commit 10c7ca2399
29 changed files with 1346 additions and 0 deletions
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	charondebug="tnc 3, imc 3"
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_DAVE
+	leftauth=eap
+	leftfirewall=yes
+	right=PH_IP_MOON
+	[email protected]
+	rightsubnet=10.1.0.0/16
+	rightauth=pubkey
+	eap_identity=dave
+	aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
+	auto=add
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+dave : EAP "W7R0g3do"
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow PT-TLS 
+-A INPUT  -i eth0 -s 10.1.0.10 -p tcp --sport 271 -j ACCEPT
+-A OUTPUT -o eth0 -d 10.1.0.10 -p tcp --dport 271 -j ACCEPT
+
+# allow ssh
+-A INPUT  -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT  -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
+
+COMMIT
@@ -0,0 +1,6 @@
+--connect aaa.strongswan.org
+--client [email protected]
+--key  /etc/ipsec.d/private/daveKey.pem
+--cert /etc/ipsec.d/certs/daveCert.pem
+--cert /etc/ipsec.d/cacerts/strongswanCert.pem
+--debug 2
@@ -0,0 +1,22 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+libimcv {
+  plugins {
+    imc-os {
+      push_info = yes 
+    }
+  }
+}
+
+libtnccs {
+  plugins {
+    tnccs-20 {
+      max_batch_size   = 131056
+      max_message_size = 131024
+    }
+  }
+}
+
+pt-tls-client {
+  load = curl revocation constraints pem openssl nonce tnc-tnccs tnc-imc tnccs-20
+}
@@ -0,0 +1,4 @@
+#IMC configuration file for strongSwan client 
+
+IMC "OS" 	/usr/local/lib/ipsec/imcvs/imc-os.so
+IMC "SWID"	/usr/local/lib/ipsec/imcvs/imc-swid.so