denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Remove TNC@FHH dependencies and scenarios that rely on them

Browse Source 
While we could continue to use FreeRADIUS 2.x that branch is officially EOL.
So instead of investing time and effort in updating/migrating the patches to
FreeRADIUS 3.x (the module changed quite significantly as it relies solely on
the naeap library in that release), for a protocol that is superseded anyway,
we just remove these scenarios and the dependencies.  Actually, the
complete rlm_eap_tnc module will be removed with FreeRADIUS 4.0.
This commit is contained in:
Tobias Brunner
2018-11-21 14:32:24 +01:00
parent babb979e42
commit 2fbe44bef3
154 changed files with 2 additions and 11629 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/do-tests
-7
View File
@@ -695,15 +695,10 @@ do
$TESTRESULTDIR/${host}.$file > /dev/null 2>&1
done
scp $SSHCONF $HOSTLOGIN:/etc/strongswan.conf \
$TESTRESULTDIR/${host}.strongswan.conf > /dev/null 2>&1
scp $SSHCONF $HOSTLOGIN:/var/log/freeradius/radius.log \
$TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1
ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \
>> $TESTRESULTDIR/${host}.daemon.log 2>/dev/null
chmod a+r $TESTRESULTDIR/*
cat >> $TESTRESULTDIR/index.html <<@EOF
<h3>$host</h3>
@@ -713,14 +708,12 @@ do
<ul>
<li><a href="$host.clients.conf">clients.conf</a></li>
<li><a href="$host.radiusd.conf">radiusd.conf</a></li>
<li><a href="$host.strongswan.conf">strongswan.conf</a></li>
</ul>
</td>
<td valign="top">
<ul>
<li><a href="$host.eap.conf">eap.conf</a></li>
<li><a href="$host.radius.log">radius.log</a></li>
<li><a href="$host.daemon.log">daemon.log</a></li>
</ul>
</td>
<td valign="top">
testing/hosts/alice/etc/freeradius/dictionary
+1 -1
View File
@@ -11,7 +11,7 @@
#
# The filename given here should be an absolute path.
#
$INCLUDE /usr/local/share/freeradius/dictionary
$INCLUDE /usr/share/freeradius/dictionary
#
# Place additional attributes or $INCLUDEs here. They will
testing/scripts/build-baseimage
+1 -1
View File
@@ -34,7 +34,7 @@ stretch)
*)
echo_warn "Package list for '$BASEIMGSUITE' might has to be updated"
esac
SERVICES="apache2 dbus isc-dhcp-server slapd bind9"
SERVICES="apache2 dbus isc-dhcp-server slapd bind9 freeradius"
INC=$INC,${SERVICES// /,}
CACHEDIR=$BUILDDIR/cache
testing/scripts/recipes/001_libtnc.mk
-31
View File
@@ -1,31 +0,0 @@
#!/usr/bin/make
PV = 1.25
PKG = libtnc-$(PV)
TAR = $(PKG).tar.gz
SRC = http://downloads.sourceforge.net/project/libtnc/libtnc/$(PV)/$(TAR)
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
CONFIG_OPTS = \
--sysconfdir=/etc
all: install
$(TAR):
wget $(SRC)
.$(PKG)-unpacked: $(TAR)
tar xfz $(TAR)
@touch $@
.$(PKG)-configured: .$(PKG)-unpacked
cd $(PKG) && ./configure $(CONFIG_OPTS)
@touch $@
.$(PKG)-built: .$(PKG)-configured
cd $(PKG) && make -j $(NUM_CPUS)
@touch $@
install: .$(PKG)-built
cd $(PKG) && make install
testing/scripts/recipes/002_tnc-fhh.mk
-35
View File
@@ -1,35 +0,0 @@
#!/usr/bin/make
PKG = fhhtnc
SRC = git://github.com/trustatfhh/tnc-fhh.git
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
CONFIG_OPTS = \
-DCOMPONENT=all \
-DNAL=8021x
PATCHES = \
tnc-fhh-tncsim
all: install
.$(PKG)-cloned:
git clone $(SRC) $(PKG)
mkdir $(PKG)/build
@touch $@
.$(PKG)-patches-applied: .$(PKG)-cloned
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
@touch $@
.$(PKG)-configured: .$(PKG)-patches-applied
cd $(PKG)/build && cmake $(CONFIG_OPTS) ../
@touch $@
.$(PKG)-built: .$(PKG)-configured
cd $(PKG)/build && make -j $(NUM_CPUS)
@touch $@
install: .$(PKG)-built
cd $(PKG)/build && make install
testing/scripts/recipes/003_freeradius.mk
-43
View File
@@ -1,43 +0,0 @@
#!/usr/bin/make
PV = 2.2.8
PKG = freeradius-server-$(PV)
TAR = $(PKG).tar.bz2
SRC = ftp://ftp.freeradius.org/pub/freeradius/old/$(TAR)
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
CONFIG_OPTS = \
--with-raddbdir=/etc/freeradius \
--sysconfdir=/etc \
--with-logdir=/var/log/freeradius \
--enable-developer \
--with-experimental-modules
PATCHES = \
freeradius-eap-sim-identity \
freeradius-tnc-fhh
all: install
$(TAR):
wget $(SRC)
.$(PKG)-unpacked: $(TAR)
tar xfj $(TAR)
@touch $@
.$(PKG)-patches-applied: .$(PKG)-unpacked
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
@touch $@
.$(PKG)-configured: .$(PKG)-patches-applied
cd $(PKG) && ./configure $(CONFIG_OPTS)
@touch $@
.$(PKG)-built: .$(PKG)-configured
cd $(PKG) && make -j $(NUM_CPUS)
@touch $@
install: .$(PKG)-built
cd $(PKG) && make install
testing/scripts/recipes/004_hostapd.mk
-39
View File
@@ -1,39 +0,0 @@
#!/usr/bin/make
PV = 2.0
PKG = hostapd-$(PV)
TAR = $(PKG).tar.gz
SRC = http://w1.fi/releases/$(TAR)
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
CONFIG_OPTS =
PATCHES = \
hostapd-config
SUBDIR = hostapd
all: install
$(TAR):
wget $(SRC)
.$(PKG)-unpacked: $(TAR)
tar xfz $(TAR)
@touch $@
.$(PKG)-patches-applied: .$(PKG)-unpacked
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
@touch $@
.$(PKG)-configured: .$(PKG)-patches-applied
cp $(PKG)/$(SUBDIR)/defconfig $(PKG)/$(SUBDIR)/.config
@touch $@
.$(PKG)-built: .$(PKG)-configured
cd $(PKG)/$(SUBDIR) && make -j $(NUM_CPUS)
@touch $@
install: .$(PKG)-built
cd $(PKG)/$(SUBDIR) && make install
testing/scripts/recipes/004_wpa_supplicant.mk
-39
View File
@@ -1,39 +0,0 @@
#!/usr/bin/make
PV = 2.0
PKG = wpa_supplicant-$(PV)
TAR = $(PKG).tar.gz
SRC = http://w1.fi/releases/$(TAR)
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
CONFIG_OPTS =
PATCHES = \
wpa_supplicant-eap-tnc
SUBDIR = wpa_supplicant
all: install
$(TAR):
wget $(SRC)
.$(PKG)-unpacked: $(TAR)
tar xfz $(TAR)
@touch $@
.$(PKG)-patches-applied: .$(PKG)-unpacked
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
@touch $@
.$(PKG)-configured: .$(PKG)-patches-applied
cp $(PKG)/$(SUBDIR)/defconfig $(PKG)/$(SUBDIR)/.config
@touch $@
.$(PKG)-built: .$(PKG)-configured
cd $(PKG)/$(SUBDIR) && make -j $(NUM_CPUS)
@touch $@
install: .$(PKG)-built
cd $(PKG)/$(SUBDIR) && make install
testing/scripts/recipes/patches/freeradius-eap-sim-identity
-30
View File
@@ -1,30 +0,0 @@
--- a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:03:05.081225276 +0100
+++ b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:46:59.746289881 +0100
@@ -246,14 +246,21 @@
newvp->vp_integer = ess->sim_id++;
pairreplace(outvps, newvp);
+ ess->keys.identitylen = strlen(handler->identity);
+ memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen);
+
/* make a copy of the identity */
newvp = pairfind(*invps, ATTRIBUTE_EAP_SIM_BASE + PW_EAP_SIM_IDENTITY);
- if (newvp) {
- ess->keys.identitylen = newvp->length;
- memcpy(ess->keys.identity, newvp->vp_octets, newvp->length);
- } else {
- ess->keys.identitylen = strlen(handler->identity);
- memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen);
+ if (newvp && newvp->length > 2) {
+ uint16_t len;
+
+ memcpy(&len, newvp->vp_octets, sizeof(uint16_t));
+ len = ntohs(len);
+ if (len <= newvp->length - 2 && len <= MAX_STRING_LEN) {
+ ess->keys.identitylen = len;
+ memcpy(ess->keys.identity, newvp->vp_octets + 2,
+ ess->keys.identitylen);
+ }
}
/* all set, calculate keys! */
testing/scripts/recipes/patches/freeradius-tnc-fhh
-6687
View File
File diff suppressed because it is too large Load Diff
testing/scripts/recipes/patches/hostapd-config
-38
View File
@@ -1,38 +0,0 @@
diff -u -ur hostapd-2.0.orig/hostapd/defconfig hostapd-2.0/hostapd/defconfig
--- hostapd-2.0.orig/hostapd/defconfig 2013-01-12 16:42:53.000000000 +0100
+++ hostapd-2.0/hostapd/defconfig 2016-06-15 17:32:57.000000000 +0200
@@ -13,14 +13,14 @@
CONFIG_DRIVER_HOSTAP=y
# Driver interface for wired authenticator
-#CONFIG_DRIVER_WIRED=y
+CONFIG_DRIVER_WIRED=y
# Driver interface for madwifi driver
#CONFIG_DRIVER_MADWIFI=y
#CFLAGS += -I../../madwifi # change to the madwifi source directory
# Driver interface for drivers using the nl80211 kernel interface
-CONFIG_DRIVER_NL80211=y
+#CONFIG_DRIVER_NL80211=y
# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
#CONFIG_DRIVER_BSD=y
@@ -30,7 +30,7 @@
#LIBS_c += -L/usr/local/lib
# Driver interface for no driver (e.g., RADIUS server only)
-#CONFIG_DRIVER_NONE=y
+CONFIG_DRIVER_NONE=y
# IEEE 802.11F/IAPP
CONFIG_IAPP=y
@@ -152,7 +152,7 @@
# Add support for writing debug log to a file: -f /tmp/hostapd.log
# Disabled by default.
-#CONFIG_DEBUG_FILE=y
+CONFIG_DEBUG_FILE=y
# Remove support for RADIUS accounting
#CONFIG_NO_ACCOUNTING=y
testing/scripts/recipes/patches/tnc-fhh-tncsim
-12
View File
@@ -1,12 +0,0 @@
diff --git a/CMakeLists.txt b/CMakeLists.txt
index fe65134512ea..3c5255f21ea6 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -101,7 +101,6 @@ IF(${COMPONENT} STREQUAL "ALL")
add_subdirectory(tncxacml)
add_subdirectory(imcv)
add_subdirectory(tncs)
- add_subdirectory(tncsim)
IF(${NAL} STREQUAL "8021X" OR ${NAL} STREQUAL "ALL")
add_subdirectory(naaeap)
testing/scripts/recipes/patches/wpa_supplicant-eap-tnc
-47
View File
@@ -1,47 +0,0 @@
diff -urN wpa_supplicant-2.0.ori/src/eap_peer/tncc.c wpa_supplicant-2.0/src/eap_peer/tncc.c
--- wpa_supplicant-2.0.ori/src/eap_peer/tncc.c 2013-01-12 16:42:53.000000000 +0100
+++ wpa_supplicant-2.0/src/eap_peer/tncc.c 2013-03-23 13:10:22.151059154 +0100
@@ -465,7 +465,7 @@
return -1;
}
#else /* CONFIG_NATIVE_WINDOWS */
- imc->dlhandle = dlopen(imc->path, RTLD_LAZY);
+ imc->dlhandle = dlopen(imc->path, RTLD_LAZY | RTLD_GLOBAL);
if (imc->dlhandle == NULL) {
wpa_printf(MSG_ERROR, "TNC: Failed to open IMC '%s' (%s): %s",
imc->name, imc->path, dlerror());
diff -urN wpa_supplicant-2.0.ori/wpa_supplicant/defconfig wpa_supplicant-2.0/wpa_supplicant/defconfig
--- wpa_supplicant-2.0.ori/wpa_supplicant/defconfig 2013-01-12 16:42:53.000000000 +0100
+++ wpa_supplicant-2.0/wpa_supplicant/defconfig 2013-03-23 13:06:08.759052370 +0100
@@ -86,7 +86,7 @@
CONFIG_DRIVER_WEXT=y
# Driver interface for Linux drivers using the nl80211 kernel interface
-CONFIG_DRIVER_NL80211=y
+#CONFIG_DRIVER_NL80211=y
# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
#CONFIG_DRIVER_BSD=y
@@ -193,7 +193,7 @@
#CONFIG_EAP_GPSK_SHA256=y
# EAP-TNC and related Trusted Network Connect support (experimental)
-#CONFIG_EAP_TNC=y
+CONFIG_EAP_TNC=y
# Wi-Fi Protected Setup (WPS)
#CONFIG_WPS=y
diff -urN wpa_supplicant-2.0.ori/wpa_supplicant/Makefile wpa_supplicant-2.0/wpa_supplicant/Makefile
--- wpa_supplicant-2.0.ori/wpa_supplicant/Makefile 2013-01-12 16:42:53.000000000 +0100
+++ wpa_supplicant-2.0/wpa_supplicant/Makefile 2013-03-23 13:06:08.759052370 +0100
@@ -6,8 +6,8 @@
CFLAGS = -MMD -O2 -Wall -g
endif
-export LIBDIR ?= /usr/local/lib/
-export BINDIR ?= /usr/local/sbin/
+export LIBDIR ?= /usr/lib/
+export BINDIR ?= /usr/sbin/
PKG_CONFIG ?= pkg-config
CFLAGS += -I../src
testing/tests/tnc/tnccs-11-fhh/description.txt
-13
View File
@@ -1,13 +0,0 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
using EAP-TTLS authentication only with the gateway presenting a server certificate and
the clients doing EAP-MD5 password-based authentication.
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
The Dummy IMC and IMV from the
<a href="http://trust.f4.hs-hannover.de/projects/tncatfhh.html" target="popup">
<b>TNC@FHH</b></a> project are used which communicate over a proprietary protocol.
<p>
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the
clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets,
respectively.
testing/tests/tnc/tnccs-11-fhh/evaltest.dat
-18
View File
@@ -1,18 +0,0 @@
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/28]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.16/28]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-allow.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-allow.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw-isolate.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-isolate.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.16/28] remote-ts=\[192.168.0.200/32]::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
testing/tests/tnc/tnccs-11-fhh/hosts/carol/etc/init.d/charon
-158
View File
@@ -1,158 +0,0 @@
#! /bin/sh
### BEGIN INIT INFO
# Provides: charon
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: strongSwan charon IKE daemon
# Description: with swanctl the strongSwan charon daemon must be
# running in the background
### END INIT INFO
# Author: Andreas Steffen <[email protected]>
#
# Do NOT "set -e"
# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin
DESC="strongSwan charon IKE daemon"
NAME=charon
DAEMON=/usr/local/libexec/ipsec/$NAME
DAEMON_ARGS=""
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/charon
export LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties
# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0
# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh
# Define LSB log_* functions.
# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
# and status_of_proc is working.
. /lib/lsb/init-functions
#
# Function that starts the daemon/service
#
do_start()
{
# Return
# 0 if daemon has been started
# 1 if daemon was already running
# 2 if daemon could not be started
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|| return 1
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON -- \
$DAEMON_ARGS \
|| return 2
# Add code here, if necessary, that waits for the process to be ready
# to handle requests from services started subsequently which depend
# on this one. As a last resort, sleep for some time.
}
#
# Function that stops the daemon/service
#
do_stop()
{
# Return
# 0 if daemon has been stopped
# 1 if daemon was already stopped
# 2 if daemon could not be stopped
# other if a failure occurred
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
RETVAL="$?"
[ "$RETVAL" = 2 ] && return 2
# Wait for children to finish too if this is a daemon that forks
# and if the daemon is only ever run from this initscript.
# If the above conditions are not satisfied then add some other code
# that waits for the process to drop all resources that could be
# needed by services started subsequently. A last resort is to
# sleep for some time.
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
[ "$?" = 2 ] && return 2
# Many daemons don't delete their pidfiles when they exit.
rm -f $PIDFILE
return "$RETVAL"
}
#
# Function that sends a SIGHUP to the daemon/service
#
do_reload() {
#
# If the daemon can reload its configuration without
# restarting (for example, when it is sent a SIGHUP),
# then implement that here.
#
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
return 0
}
case "$1" in
start)
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
do_start
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
stop)
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
do_stop
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
status)
status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
;;
#reload|force-reload)
#
# If do_reload() is not implemented then leave this commented out
# and leave 'force-reload' as an alias for 'restart'.
#
#log_daemon_msg "Reloading $DESC" "$NAME"
#do_reload
#log_end_msg $?
#;;
restart|force-reload)
#
# If the "reload" option is implemented then remove the
# 'force-reload' alias
#
log_daemon_msg "Restarting $DESC" "$NAME"
do_stop
case "$?" in
0|1)
do_start
case "$?" in
0) log_end_msg 0 ;;
1) log_end_msg 1 ;; # Old process is still running
*) log_end_msg 1 ;; # Failed to start
esac
;;
*)
# Failed to stop
log_end_msg 1
;;
esac
;;
*)
#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
exit 3
;;
esac
:
testing/tests/tnc/tnccs-11-fhh/hosts/carol/etc/strongswan.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
syslog {
daemon {
tnc = 3
}
}
plugins {
eap-tnc {
protocol = tnccs-1.1
}
}
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
}
testing/tests/tnc/tnccs-11-fhh/hosts/carol/etc/swanctl/swanctl.conf
-35
View File
@@ -1,35 +0,0 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = eap-ttls
id = [email protected]
}
remote {
auth = eap-ttls
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-modp3072
}
}
secrets {
eap {
id = [email protected]
secret = "Ar3etTnp"
}
}
testing/tests/tnc/tnccs-11-fhh/hosts/carol/etc/tnc/dummyimc.file
-1
View File
@@ -1 +0,0 @@
allow
testing/tests/tnc/tnccs-11-fhh/hosts/carol/etc/tnc/log4cxx.properties
-15
View File
@@ -1,15 +0,0 @@
# Set root logger level to DEBUG and its appenders to A1 and A2.
log4j.rootLogger=DEBUG, A1, A2
# A1 is set to be a ConsoleAppender.
log4j.appender.A1=org.apache.log4j.ConsoleAppender
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
log4j.appender.A1.layout.ConversionPattern=--[IMC] %m%n
# A2 is set to be a SyslogAppender
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
log4j.appender.A2.Facility=DAEMON
log4j.appender.A2.SyslogHost=localhost
log4j.appender.A2.Threshold=DEBUG
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
log4j.appender.A2.layout.ConversionPattern=--[IMC] %m%n
testing/tests/tnc/tnccs-11-fhh/hosts/carol/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMC configuration file for strongSwan client
IMC "Dummy" /usr/local/lib/libdummyimc.so
#IMC "HostScanner" /usr/local/lib/libhostscannerimc.so
testing/tests/tnc/tnccs-11-fhh/hosts/dave/etc/init.d/charon
-158
View File
@@ -1,158 +0,0 @@
#! /bin/sh
### BEGIN INIT INFO
# Provides: charon
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: strongSwan charon IKE daemon
# Description: with swanctl the strongSwan charon daemon must be
# running in the background
### END INIT INFO
# Author: Andreas Steffen <[email protected]>
#
# Do NOT "set -e"
# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin
DESC="strongSwan charon IKE daemon"
NAME=charon
DAEMON=/usr/local/libexec/ipsec/$NAME
DAEMON_ARGS=""
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/charon
export LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties
# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0
# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh
# Define LSB log_* functions.
# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
# and status_of_proc is working.
. /lib/lsb/init-functions
#
# Function that starts the daemon/service
#
do_start()
{
# Return
# 0 if daemon has been started
# 1 if daemon was already running
# 2 if daemon could not be started
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|| return 1
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON -- \
$DAEMON_ARGS \
|| return 2
# Add code here, if necessary, that waits for the process to be ready
# to handle requests from services started subsequently which depend
# on this one. As a last resort, sleep for some time.
}
#
# Function that stops the daemon/service
#
do_stop()
{
# Return
# 0 if daemon has been stopped
# 1 if daemon was already stopped
# 2 if daemon could not be stopped
# other if a failure occurred
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
RETVAL="$?"
[ "$RETVAL" = 2 ] && return 2
# Wait for children to finish too if this is a daemon that forks
# and if the daemon is only ever run from this initscript.
# If the above conditions are not satisfied then add some other code
# that waits for the process to drop all resources that could be
# needed by services started subsequently. A last resort is to
# sleep for some time.
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
[ "$?" = 2 ] && return 2
# Many daemons don't delete their pidfiles when they exit.
rm -f $PIDFILE
return "$RETVAL"
}
#
# Function that sends a SIGHUP to the daemon/service
#
do_reload() {
#
# If the daemon can reload its configuration without
# restarting (for example, when it is sent a SIGHUP),
# then implement that here.
#
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
return 0
}
case "$1" in
start)
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
do_start
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
stop)
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
do_stop
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
status)
status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
;;
#reload|force-reload)
#
# If do_reload() is not implemented then leave this commented out
# and leave 'force-reload' as an alias for 'restart'.
#
#log_daemon_msg "Reloading $DESC" "$NAME"
#do_reload
#log_end_msg $?
#;;
restart|force-reload)
#
# If the "reload" option is implemented then remove the
# 'force-reload' alias
#
log_daemon_msg "Restarting $DESC" "$NAME"
do_stop
case "$?" in
0|1)
do_start
case "$?" in
0) log_end_msg 0 ;;
1) log_end_msg 1 ;; # Old process is still running
*) log_end_msg 1 ;; # Failed to start
esac
;;
*)
# Failed to stop
log_end_msg 1
;;
esac
;;
*)
#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
exit 3
;;
esac
:
testing/tests/tnc/tnccs-11-fhh/hosts/dave/etc/strongswan.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
syslog {
daemon {
tnc = 3
}
}
plugins {
eap-tnc {
protocol = tnccs-1.1
}
}
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
}
testing/tests/tnc/tnccs-11-fhh/hosts/dave/etc/swanctl/swanctl.conf
-35
View File
@@ -1,35 +0,0 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = eap-ttls
id = [email protected]
}
remote {
auth = eap-ttls
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-modp3072
}
}
secrets {
eap {
id = [email protected]
secret = "W7R0g3do"
}
}
testing/tests/tnc/tnccs-11-fhh/hosts/dave/etc/tnc/dummyimc.file
-1
View File
@@ -1 +0,0 @@
isolate
testing/tests/tnc/tnccs-11-fhh/hosts/dave/etc/tnc/log4cxx.properties
-15
View File
@@ -1,15 +0,0 @@
# Set root logger level to DEBUG and its appenders to A1 and A2.
log4j.rootLogger=DEBUG, A1, A2
# A1 is set to be a ConsoleAppender.
log4j.appender.A1=org.apache.log4j.ConsoleAppender
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
log4j.appender.A1.layout.ConversionPattern=--[IMC] %m%n
# A2 is set to be a SyslogAppender
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
log4j.appender.A2.Facility=DAEMON
log4j.appender.A2.SyslogHost=localhost
log4j.appender.A2.Threshold=DEBUG
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
log4j.appender.A2.layout.ConversionPattern=--[IMC] %m%n
testing/tests/tnc/tnccs-11-fhh/hosts/dave/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMC configuration file for strongSwan client
IMC "Dummy" /usr/local/lib/libdummyimc.so
#IMC "HostScanner" /usr/local/lib/libhostscannerimc.so
testing/tests/tnc/tnccs-11-fhh/hosts/moon/etc/init.d/charon
-158
View File
@@ -1,158 +0,0 @@
#! /bin/sh
### BEGIN INIT INFO
# Provides: charon
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: strongSwan charon IKE daemon
# Description: with swanctl the strongSwan charon daemon must be
# running in the background
### END INIT INFO
# Author: Andreas Steffen <[email protected]>
#
# Do NOT "set -e"
# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin
DESC="strongSwan charon IKE daemon"
NAME=charon
DAEMON=/usr/local/libexec/ipsec/$NAME
DAEMON_ARGS=""
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/charon
export LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties
# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0
# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh
# Define LSB log_* functions.
# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
# and status_of_proc is working.
. /lib/lsb/init-functions
#
# Function that starts the daemon/service
#
do_start()
{
# Return
# 0 if daemon has been started
# 1 if daemon was already running
# 2 if daemon could not be started
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|| return 1
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON -- \
$DAEMON_ARGS \
|| return 2
# Add code here, if necessary, that waits for the process to be ready
# to handle requests from services started subsequently which depend
# on this one. As a last resort, sleep for some time.
}
#
# Function that stops the daemon/service
#
do_stop()
{
# Return
# 0 if daemon has been stopped
# 1 if daemon was already stopped
# 2 if daemon could not be stopped
# other if a failure occurred
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
RETVAL="$?"
[ "$RETVAL" = 2 ] && return 2
# Wait for children to finish too if this is a daemon that forks
# and if the daemon is only ever run from this initscript.
# If the above conditions are not satisfied then add some other code
# that waits for the process to drop all resources that could be
# needed by services started subsequently. A last resort is to
# sleep for some time.
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
[ "$?" = 2 ] && return 2
# Many daemons don't delete their pidfiles when they exit.
rm -f $PIDFILE
return "$RETVAL"
}
#
# Function that sends a SIGHUP to the daemon/service
#
do_reload() {
#
# If the daemon can reload its configuration without
# restarting (for example, when it is sent a SIGHUP),
# then implement that here.
#
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
return 0
}
case "$1" in
start)
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
do_start
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
stop)
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
do_stop
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
status)
status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
;;
#reload|force-reload)
#
# If do_reload() is not implemented then leave this commented out
# and leave 'force-reload' as an alias for 'restart'.
#
#log_daemon_msg "Reloading $DESC" "$NAME"
#do_reload
#log_end_msg $?
#;;
restart|force-reload)
#
# If the "reload" option is implemented then remove the
# 'force-reload' alias
#
log_daemon_msg "Restarting $DESC" "$NAME"
do_stop
case "$?" in
0|1)
do_start
case "$?" in
0) log_end_msg 0 ;;
1) log_end_msg 1 ;; # Old process is still running
*) log_end_msg 1 ;; # Failed to start
esac
;;
*)
# Failed to stop
log_end_msg 1
;;
esac
;;
*)
#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
exit 3
;;
esac
:
testing/tests/tnc/tnccs-11-fhh/hosts/moon/etc/strongswan.conf
-28
View File
@@ -1,28 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
multiple_authentication = no
syslog {
daemon {
tnc = 3
}
}
plugins {
eap-ttls {
phase2_method = md5
phase2_piggyback = yes
phase2_tnc = yes
phase2_tnc_method = tnc
}
eap-tnc {
protocol = tnccs-1.1
}
}
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
}
testing/tests/tnc/tnccs-11-fhh/hosts/moon/etc/swanctl/swanctl.conf
-64
View File
@@ -1,64 +0,0 @@
connections {
rw-allow {
local_addrs = 192.168.0.1
local {
auth = eap-ttls
id = moon.strongswan.org
}
remote {
auth = eap-ttls
id = *@strongswan.org
groups = allow
}
children {
rw-allow {
local_ts = 10.1.0.0/28
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-modp3072
}
rw-isolate {
local_addrs = 192.168.0.1
local {
auth = eap-ttls
id = moon.strongswan.org
}
remote {
auth = eap-ttls
id = *@strongswan.org
groups = isolate
}
children {
rw-isolate {
local_ts = 10.1.0.16/28
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-modp3072
}
}
secrets {
eap-carol {
id = [email protected]
secret = "Ar3etTnp"
}
eap-dave {
id = [email protected]
secret = "W7R0g3do"
}
}
testing/tests/tnc/tnccs-11-fhh/hosts/moon/etc/tnc/dummyimv.policy
-1
View File
@@ -1 +0,0 @@
1
testing/tests/tnc/tnccs-11-fhh/hosts/moon/etc/tnc/hostscannerimv.policy
-40
View File
@@ -1,40 +0,0 @@
#FTP - File Transfer Protocol
TCP 20 = whatever
TCP 21 = close
#SSH - Secure Shell
TCP 22 = whatever
#Telnet
TCP 23 = close
#E-Mail
#
#SMTP - Simple Mail Transfer Protocol
TCP 25 = close
TCP 587 = close
#POP3 - Post Office Protocol version 3
TCP 110 = close
TCP 995 = close
#DNS - Domain Name System
UDP 53 = close
TCP 53 = close
#BOOTP/DHCP - Bootstrap Protocol /
#Dynamic Host Configuration Protocol
UDP 67 = close
#UDP 68 = open
UDP 68 = whatever
#www - World Wide Web
#HTTP - Hypertext Transfer Protocol
TCP 80 = close
#HTTPS - Hypertext Transfer Protocol Secure
TCP 443 = close
#examples
TCP 8080 = close
TCP 5223 = whatever
UDP 4444 = close
UDP 631 = whatever
testing/tests/tnc/tnccs-11-fhh/hosts/moon/etc/tnc/log4cxx.properties
-15
View File
@@ -1,15 +0,0 @@
# Set root logger level to DEBUG and its appenders to A1 and A2.
log4j.rootLogger=DEBUG, A1, A2
# A1 is set to be a ConsoleAppender.
log4j.appender.A1=org.apache.log4j.ConsoleAppender
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
log4j.appender.A1.layout.ConversionPattern=--[IMV] %m%n
# A2 is set to be a SyslogAppender
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
log4j.appender.A2.Facility=DAEMON
log4j.appender.A2.SyslogHost=localhost
log4j.appender.A2.Threshold=DEBUG
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
log4j.appender.A2.layout.ConversionPattern=--[IMV] %m%n
testing/tests/tnc/tnccs-11-fhh/hosts/moon/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMV configuration file for strongSwan server
IMV "Dummy" /usr/local/lib/libdummyimv.so
#IMV "HostScanner" /usr/local/lib/libhostscannerimv.so
testing/tests/tnc/tnccs-11-fhh/posttest.dat
-6
View File
@@ -1,6 +0,0 @@
carol::systemctl stop strongswan-swanctl
dave::systemctl stop strongswan-swanctl
moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
testing/tests/tnc/tnccs-11-fhh/pretest.dat
-20
View File
@@ -1,20 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
carol::cat /etc/tnc/dummyimc.file
dave::cat /etc/tnc/dummyimc.file
carol::rm /etc/swanctl/rsa/*
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
moon::systemctl start strongswan-swanctl
carol::systemctl start strongswan-swanctl
dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
carol::expect-connection home
carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home
dave::swanctl --initiate --child home 2> /dev/null
testing/tests/tnc/tnccs-11-fhh/test.conf
-28
View File
@@ -1,28 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tnc/tnccs-11-radius-block/description.txt
-14
View File
@@ -1,14 +0,0 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>.
At the outset the gateway authenticates itself to the clients by sending an IKEv2
<b>RSA signature</b> accompanied by a certificate.
<b>carol</b> and <b>dave</b> then set up an <b>EAP-TTLS</b> tunnel each via <b>moon</b> to the
<a href="http://trust.f4.hs-hannover.de/projects/tncatfhh.html" target="popup">
<b>TNC@FHH</b></a>-enhanced FreeRADIUS server <b>alice</b> authenticated by an X.509 AAA certificate.
The strong EAP-TTLS tunnel protects the ensuing weak client authentication based on <b>EAP-MD5</b>.
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
The IMC and IMV communicate are using the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
<p>
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements <b>carol</b>
is authenticated successfully and is granted access to the subnet behind <b>moon</b> whereas
<b>dave</b> fails the layered EAP authentication and is rejected.
testing/tests/tnc/tnccs-11-radius-block/evaltest.dat
-15
View File
@@ -1,15 +0,0 @@
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*none::YES
dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon:: cat /var/log/daemon.log::RADIUS authentication of '[email protected]' failed::YES
moon:: cat /var/log/daemon.log::EAP method EAP_TTLS failed for peer [email protected]::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home::NO
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw::NO
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/eap.conf
-25
View File
@@ -1,25 +0,0 @@
eap {
md5 {
}
default_eap_type = ttls
tls {
private_key_file = /etc/raddb/certs/aaaKey.pem
certificate_file = /etc/raddb/certs/aaaCert.pem
CA_file = /etc/raddb/certs/strongswanCert.pem
cipher_list = "DEFAULT"
dh_file = /etc/raddb/certs/dh
random_file = /etc/raddb/certs/random
}
ttls {
default_eap_type = md5
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
tnc_virtual_server = "inner-tunnel-second"
}
}
eap eap_tnc {
default_eap_type = tnc
tnc {
}
}
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/proxy.conf
-5
View File
@@ -1,5 +0,0 @@
realm strongswan.org {
type = radius
authhost = LOCAL
accthost = LOCAL
}
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default
-43
View File
@@ -1,43 +0,0 @@
authorize {
suffix
eap {
ok = return
}
files
}
authenticate {
eap
}
preacct {
preprocess
acct_unique
suffix
files
}
accounting {
detail
unix
radutmp
attr_filter.accounting_response
}
session {
radutmp
}
post-auth {
exec
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
eap
}
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel
-32
View File
@@ -1,32 +0,0 @@
server inner-tunnel {
authorize {
suffix
eap {
ok = return
}
files
}
authenticate {
eap
}
session {
radutmp
}
post-auth {
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
eap
}
} # inner-tunnel server block
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second
-36
View File
@@ -1,36 +0,0 @@
server inner-tunnel-second {
authorize {
eap_tnc {
ok = return
}
}
authenticate {
eap_tnc
}
session {
radutmp
}
post-auth {
if (control:TNC-Status == "Access") {
update reply {
Tunnel-Type := ESP
Filter-Id := "allow"
}
}
elsif (control:TNC-Status == "Isolate") {
update reply {
Tunnel-Type := ESP
Filter-Id := "isolate"
}
}
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
} # inner-tunnel-second block
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/users
-2
View File
@@ -1,2 +0,0 @@
carol Cleartext-Password := "Ar3etTnp"
dave Cleartext-Password := "W7R0g3do"
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/strongswan.conf
-12
View File
@@ -1,12 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
libimcv {
load = random nonce sha1 sha2 md5 gmp pubkey x509
debug_level = 3
assessment_result = no
plugins {
imv-test {
rounds = 1
}
}
}
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/tnc/log4cxx.properties
-15
View File
@@ -1,15 +0,0 @@
# Set root logger level to DEBUG and its appenders to A1 and A2.
log4j.rootLogger=DEBUG, A1, A2
# A1 is set to be a ConsoleAppender.
log4j.appender.A1=org.apache.log4j.ConsoleAppender
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
log4j.appender.A1.layout.ConversionPattern=[FHH] %m%n
# A2 is set to be a SyslogAppender
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
log4j.appender.A2.Facility=DAEMON
log4j.appender.A2.SyslogHost=localhost
log4j.appender.A2.Threshold=DEBUG
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
log4j.appender.A2.layout.ConversionPattern=[FHH] %m%n
testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMV configuration file for strongSwan client
IMV "Test" /usr/local/lib/ipsec/imcvs/imv-test.so
IMV "Scanner" /usr/local/lib/ipsec/imcvs/imv-scanner.so
testing/tests/tnc/tnccs-11-radius-block/hosts/carol/etc/strongswan.conf
-27
View File
@@ -1,27 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
syslog {
daemon {
tnc = 3
imc = 3
}
}
plugins {
eap-tnc {
protocol = tnccs-1.1
}
}
}
libimcv {
plugins {
imc-test {
command = allow
}
}
}
testing/tests/tnc/tnccs-11-radius-block/hosts/carol/etc/swanctl/swanctl.conf
-35
View File
@@ -1,35 +0,0 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = eap
aaa_id = aaa.strongswan.org
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}
secrets {
eap {
id = [email protected]
secret = "Ar3etTnp"
}
}
testing/tests/tnc/tnccs-11-radius-block/hosts/carol/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMC configuration file for strongSwan client
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
testing/tests/tnc/tnccs-11-radius-block/hosts/dave/etc/strongswan.conf
-30
View File
@@ -1,30 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
syslog {
daemon {
tnc = 3
imc = 3
}
}
plugins {
eap-tnc {
protocol = tnccs-1.1
}
}
}
libimcv {
plugins {
imc-test {
command = none
}
imc-scanner {
push_info = no
}
}
}
testing/tests/tnc/tnccs-11-radius-block/hosts/dave/etc/swanctl/swanctl.conf
-35
View File
@@ -1,35 +0,0 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = eap
aaa_id = aaa.strongswan.org
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}
secrets {
eap {
id = [email protected]
secret = "W7R0g3do"
}
}
testing/tests/tnc/tnccs-11-radius-block/hosts/dave/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMC configuration file for strongSwan client
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules
-32
View File
@@ -1,32 +0,0 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow esp
-A INPUT -i eth0 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
# allow crl fetch from winnetou
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow RADIUS protocol with alice
-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
COMMIT
testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/strongswan.conf
-15
View File
@@ -1,15 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-radius updown
multiple_authentication=no
plugins {
eap-radius {
secret = gv6URkSs
server = 10.1.0.10
filter_id = yes
}
}
}
testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/swanctl/swanctl.conf
-27
View File
@@ -1,27 +0,0 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
id = moon.strongswan.org
certs = moonCert.pem
}
remote {
auth = eap-radius
id = *@strongswan.org
}
children {
rw {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-modp3072
}
}
testing/tests/tnc/tnccs-11-radius-block/posttest.dat
-8
View File
@@ -1,8 +0,0 @@
carol::systemctl stop strongswan-swanctl
dave::systemctl stop strongswan-swanctl
moon::systemctl stop strongswan-swanctl
alice::killall radiusd
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
testing/tests/tnc/tnccs-11-radius-block/pretest.dat
-21
View File
@@ -1,21 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second
alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second
alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd
alice::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
carol::rm /etc/swanctl/rsa/*
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
moon::systemctl start strongswan-swanctl
carol::systemctl start strongswan-swanctl
dave::systemctl start strongswan-swanctl
moon::expect-connection rw
carol::expect-connection home
carol::swanctl --initiate --child home
dave::expect-connection home
dave::swanctl --initiate --child home
testing/tests/tnc/tnccs-11-radius-block/test.conf
-29
View File
@@ -1,29 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tnc/tnccs-11-radius-pts/description.txt
-14
View File
@@ -1,14 +0,0 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>.
At the outset the gateway authenticates itself to the clients by sending an IKEv2
<b>RSA signature</b> accompanied by a certificate.
<b>carol</b> and <b>dave</b> then set up an <b>EAP-TTLS</b> tunnel each via <b>moon</b> to the
<a href="http://trust.f4.hs-hannover.de/projects/tncatfhh.html" target="popup">
<b>TNC@FHH</b></a>-enhanced FreeRADIUS server <b>alice</b> authenticated by an X.509 AAA certificate.
The strong EAP-TTLS tunnel protects the ensuing weak client authentication based on <b>EAP-MD5</b>.
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
The communication between the OS and Attestation IMC and the Attestation IMV is based on the
<b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
<p>
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the clients
are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets, respectively.
testing/tests/tnc/tnccs-11-radius-pts/evaltest.dat
-18
View File
@@ -1,18 +0,0 @@
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/28]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.16/28]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-allow.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*rw-allow.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw-isolate.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*rw-isolate.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.16/28] remote-ts=\[192.168.0.200/32]::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/freeradius/eap.conf
-25
View File
@@ -1,25 +0,0 @@
eap {
md5 {
}
default_eap_type = ttls
tls {
private_key_file = /etc/raddb/certs/aaaKey.pem
certificate_file = /etc/raddb/certs/aaaCert.pem
CA_file = /etc/raddb/certs/strongswanCert.pem
cipher_list = "DEFAULT"
dh_file = /etc/raddb/certs/dh
random_file = /etc/raddb/certs/random
}
ttls {
default_eap_type = md5
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
tnc_virtual_server = "inner-tunnel-second"
}
}
eap eap_tnc {
default_eap_type = tnc
tnc {
}
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/freeradius/proxy.conf
-5
View File
@@ -1,5 +0,0 @@
realm strongswan.org {
type = radius
authhost = LOCAL
accthost = LOCAL
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/freeradius/sites-available/default
-43
View File
@@ -1,43 +0,0 @@
authorize {
suffix
eap {
ok = return
}
files
}
authenticate {
eap
}
preacct {
preprocess
acct_unique
suffix
files
}
accounting {
detail
unix
radutmp
attr_filter.accounting_response
}
session {
radutmp
}
post-auth {
exec
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
eap
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/freeradius/sites-available/inner-tunnel
-32
View File
@@ -1,32 +0,0 @@
server inner-tunnel {
authorize {
suffix
eap {
ok = return
}
files
}
authenticate {
eap
}
session {
radutmp
}
post-auth {
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
eap
}
} # inner-tunnel server block
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second
-36
View File
@@ -1,36 +0,0 @@
server inner-tunnel-second {
authorize {
eap_tnc {
ok = return
}
}
authenticate {
eap_tnc
}
session {
radutmp
}
post-auth {
if (control:TNC-Status == "Access") {
update reply {
Tunnel-Type := ESP
Filter-Id := "allow"
}
}
elsif (control:TNC-Status == "Isolate") {
update reply {
Tunnel-Type := ESP
Filter-Id := "isolate"
}
}
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
} # inner-tunnel-second block
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/freeradius/users
-2
View File
@@ -1,2 +0,0 @@
carol Cleartext-Password := "Ar3etTnp"
dave Cleartext-Password := "W7R0g3do"
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/pts/data1.sql
-29
View File
@@ -1,29 +0,0 @@
/* Devices */
INSERT INTO devices ( /* 1 */
value, product, created
)
SELECT 'aabbccddeeff11223344556677889900', id, 1372330615
FROM products WHERE name = 'Debian DEBIAN_VERSION x86_64';
/* Groups Members */
INSERT INTO groups_members (
group_id, device_id
) VALUES (
10, 1
);
INSERT INTO enforcements (
policy, group_id, max_age, rec_fail, rec_noresult
) VALUES (
3, 10, 0, 2, 2
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
16, 2, 0
);
DELETE FROM enforcements WHERE id = 1;
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/strongswan.conf
-13
View File
@@ -1,13 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
libimcv {
load = random nonce openssl pubkey sqlite
debug_level = 3
database = sqlite:///etc/db.d/config.db
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
assessment_result = no
}
attest {
database = sqlite:///etc/db.d/config.db
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/tnc/log4cxx.properties
-15
View File
@@ -1,15 +0,0 @@
# Set root logger level to DEBUG and its appenders to A1 and A2.
log4j.rootLogger=DEBUG, A1, A2
# A1 is set to be a ConsoleAppender.
log4j.appender.A1=org.apache.log4j.ConsoleAppender
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
log4j.appender.A1.layout.ConversionPattern=[FHH] %m%n
# A2 is set to be a SyslogAppender
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
log4j.appender.A2.Facility=DAEMON
log4j.appender.A2.SyslogHost=localhost
log4j.appender.A2.Threshold=DEBUG
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
log4j.appender.A2.layout.ConversionPattern=[FHH] %m%n
testing/tests/tnc/tnccs-11-radius-pts/hosts/alice/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMV configuration file for strongSwan client
IMV "OS" /usr/local/lib/ipsec/imcvs/imv-os.so
IMV "Attestation" /usr/local/lib/ipsec/imcvs/imv-attestation.so
testing/tests/tnc/tnccs-11-radius-pts/hosts/carol/etc/strongswan.conf
-19
View File
@@ -1,19 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
syslog {
daemon {
tnc = 3
imc = 3
}
}
plugins {
eap-tnc {
protocol = tnccs-1.1
}
}
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/carol/etc/swanctl/swanctl.conf
-35
View File
@@ -1,35 +0,0 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = eap
aaa_id = aaa.strongswan.org
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256
}
}
version = 2
proposals = aes128-sha256-ecp256
}
}
secrets {
eap {
id = [email protected]
secret = "Ar3etTnp"
}
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/carol/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMC configuration file for strongSwan client
IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so
IMC "Attestation" /usr/local/lib/ipsec/imcvs/imc-attestation.so
testing/tests/tnc/tnccs-11-radius-pts/hosts/dave/etc/strongswan.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
retransmit_tries = 5
syslog {
daemon {
tnc = 3
imc = 3
}
}
plugins {
eap-tnc {
protocol = tnccs-1.1
}
}
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/dave/etc/swanctl/swanctl.conf
-35
View File
@@ -1,35 +0,0 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = eap
aaa_id = aaa.strongswan.org
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256
}
}
version = 2
proposals = aes128-sha256-ecp256
}
}
secrets {
eap {
id = [email protected]
secret = "W7R0g3do"
}
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/dave/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMC configuration file for strongSwan client
IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so
IMC "Attestation" /usr/local/lib/ipsec/imcvs/imc-attestation.so
testing/tests/tnc/tnccs-11-radius-pts/hosts/moon/etc/iptables.rules
-32
View File
@@ -1,32 +0,0 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow esp
-A INPUT -i eth0 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
# allow crl fetch from winnetou
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow RADIUS protocol with alice
-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
COMMIT
testing/tests/tnc/tnccs-11-radius-pts/hosts/moon/etc/strongswan.conf
-15
View File
@@ -1,15 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce openssl pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-radius updown
multiple_authentication=no
plugins {
eap-radius {
secret = gv6URkSs
server = 10.1.0.10
filter_id = yes
}
}
}
testing/tests/tnc/tnccs-11-radius-pts/hosts/moon/etc/swanctl/swanctl.conf
-53
View File
@@ -1,53 +0,0 @@
connections {
rw-allow {
local_addrs = 192.168.0.1
local {
auth = pubkey
id = moon.strongswan.org
certs = moonCert.pem
}
remote {
auth = eap-radius
id = *@strongswan.org
groups = allow
}
children {
rw-allow {
local_ts = 10.1.0.0/28
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-ecp256
}
rw-isolate {
local_addrs = 192.168.0.1
local {
auth = pubkey
id = moon.strongswan.org
}
remote {
auth = eap-radius
id = *@strongswan.org
groups = isolate
}
children {
rw-isolate {
local_ts = 10.1.0.16/28
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-ecp256
}
}
testing/tests/tnc/tnccs-11-radius-pts/posttest.dat
-9
View File
@@ -1,9 +0,0 @@
carol::systemctl stop strongswan-swanctl
dave::systemctl stop strongswan-swanctl
moon::systemctl stop strongswan-swanctl
alice::killall radiusd
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
carol::echo 1 > /proc/sys/net/ipv4/ip_forward
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
testing/tests/tnc/tnccs-11-radius-pts/pretest.dat
-28
View File
@@ -1,28 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
carol::echo 0 > /proc/sys/net/ipv4/ip_forward
dave::echo aabbccddeeff11223344556677889900 > /var/lib/dbus/machine-id
alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second
alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second
alice::sed -i "s:DEBIAN_VERSION:\`cat /etc/debian_version\`:" /etc/pts/data1.sql
alice::cd /usr/local/share/strongswan/templates/database/imv; cat tables.sql data.sql /etc/pts/data1.sql | sqlite3 /etc/db.d/config.db
alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd
alice::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
carol::rm /etc/swanctl/rsa/*
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
moon::systemctl start strongswan-swanctl
carol::systemctl start strongswan-swanctl
dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
carol::swanctl --initiate --child home
dave::expect-connection home
dave::swanctl --initiate --child home
alice::ipsec attest --sessions
alice::ipsec attest --devices
testing/tests/tnc/tnccs-11-radius-pts/test.conf
-33
View File
@@ -1,33 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
# Guest instances on which databases are used
#
DBHOSTS="alice"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tnc/tnccs-11-radius/description.txt
-13
View File
@@ -1,13 +0,0 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>.
At the outset the gateway authenticates itself to the clients by sending an IKEv2
<b>RSA signature</b> accompanied by a certificate.
<b>carol</b> and <b>dave</b> then set up an <b>EAP-TTLS</b> tunnel each via <b>moon</b> to the
<a href="http://trust.f4.hs-hannover.de/projects/tncatfhh.html" target="popup">
<b>TNC@FHH</b></a>-enhanced FreeRADIUS server <b>alice</b> authenticated by an X.509 AAA certificate.
The strong EAP-TTLS tunnel protects the ensuing weak client authentication based on <b>EAP-MD5</b>.
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
The communication between IMCs and IMVs is based on the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
<p>
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the clients
are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets, respectively.
testing/tests/tnc/tnccs-11-radius/evaltest.dat
-18
View File
@@ -1,18 +0,0 @@
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/28]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.16/28]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-allow.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-allow.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw-isolate.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-isolate.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.16/28] remote-ts=\[192.168.0.200/32]::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/eap.conf
-25
View File
@@ -1,25 +0,0 @@
eap {
md5 {
}
default_eap_type = ttls
tls {
private_key_file = /etc/raddb/certs/aaaKey.pem
certificate_file = /etc/raddb/certs/aaaCert.pem
CA_file = /etc/raddb/certs/strongswanCert.pem
cipher_list = "DEFAULT"
dh_file = /etc/raddb/certs/dh
random_file = /etc/raddb/certs/random
}
ttls {
default_eap_type = md5
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
tnc_virtual_server = "inner-tunnel-second"
}
}
eap eap_tnc {
default_eap_type = tnc
tnc {
}
}
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/proxy.conf
-5
View File
@@ -1,5 +0,0 @@
realm strongswan.org {
type = radius
authhost = LOCAL
accthost = LOCAL
}
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default
-43
View File
@@ -1,43 +0,0 @@
authorize {
suffix
eap {
ok = return
}
files
}
authenticate {
eap
}
preacct {
preprocess
acct_unique
suffix
files
}
accounting {
detail
unix
radutmp
attr_filter.accounting_response
}
session {
radutmp
}
post-auth {
exec
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
eap
}
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel
-32
View File
@@ -1,32 +0,0 @@
server inner-tunnel {
authorize {
suffix
eap {
ok = return
}
files
}
authenticate {
eap
}
session {
radutmp
}
post-auth {
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
eap
}
} # inner-tunnel server block
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second
-36
View File
@@ -1,36 +0,0 @@
server inner-tunnel-second {
authorize {
eap_tnc {
ok = return
}
}
authenticate {
eap_tnc
}
session {
radutmp
}
post-auth {
if (control:TNC-Status == "Access") {
update reply {
Tunnel-Type := ESP
Filter-Id := "allow"
}
}
elsif (control:TNC-Status == "Isolate") {
update reply {
Tunnel-Type := ESP
Filter-Id := "isolate"
}
}
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
} # inner-tunnel-second block
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/users
-2
View File
@@ -1,2 +0,0 @@
carol Cleartext-Password := "Ar3etTnp"
dave Cleartext-Password := "W7R0g3do"
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/strongswan.conf
-12
View File
@@ -1,12 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
libimcv {
load = random nonce sha1 sha2 md5 gmp pubkey x509
debug_level = 3
assessment_result = no
plugins {
imv-test {
rounds = 1
}
}
}
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/tnc/log4cxx.properties
-15
View File
@@ -1,15 +0,0 @@
# Set root logger level to DEBUG and its appenders to A1 and A2.
log4j.rootLogger=DEBUG, A1, A2
# A1 is set to be a ConsoleAppender.
log4j.appender.A1=org.apache.log4j.ConsoleAppender
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
log4j.appender.A1.layout.ConversionPattern=[FHH] %m%n
# A2 is set to be a SyslogAppender
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
log4j.appender.A2.Facility=DAEMON
log4j.appender.A2.SyslogHost=localhost
log4j.appender.A2.Threshold=DEBUG
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
log4j.appender.A2.layout.ConversionPattern=[FHH] %m%n
testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMV configuration file for strongSwan client
IMV "Test" /usr/local/lib/ipsec/imcvs/imv-test.so
IMV "Scanner" /usr/local/lib/ipsec/imcvs/imv-scanner.so
testing/tests/tnc/tnccs-11-radius/hosts/carol/etc/strongswan.conf
-30
View File
@@ -1,30 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
syslog {
daemon {
tnc = 3
imc = 3
}
}
plugins {
eap-tnc {
protocol = tnccs-1.1
}
}
}
libimcv {
plugins {
imc-test {
command = allow
}
}
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
}
testing/tests/tnc/tnccs-11-radius/hosts/carol/etc/swanctl/swanctl.conf
-35
View File
@@ -1,35 +0,0 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = eap
aaa_id = aaa.strongswan.org
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}
secrets {
eap {
id = [email protected]
secret = "Ar3etTnp"
}
}
testing/tests/tnc/tnccs-11-radius/hosts/carol/etc/tnc_config
-4
View File
@@ -1,4 +0,0 @@
#IMC configuration file for strongSwan client
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
testing/tests/tnc/tnccs-11-radius/hosts/dave/etc/strongswan.conf
-30
View File
@@ -1,30 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
syslog {
daemon {
tnc = 3
imc = 3
}
}
plugins {
eap-tnc {
protocol = tnccs-1.1
}
}
}
libimcv {
plugins {
imc-test {
command = isolate
}
imc-scanner {
push_info = no
}
}
}
testing/tests/tnc/tnccs-11-radius/hosts/dave/etc/swanctl/swanctl.conf
-35
View File
@@ -1,35 +0,0 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = eap
aaa_id = aaa.strongswan.org
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}
secrets {
eap {
id = [email protected]
secret = "W7R0g3do"
}
}

Some files were not shown because too many files have changed in this diff Show More