Implemented segmented SWID tag attributes on IMV side

2014-04-15 09:21:06 +02:00
parent 8c40609f96
commit 3e7044b45e
58 changed files with 178 additions and 71 deletions
@@ -0,0 +1,3 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+# the PT-TLS client reads its configuration via the command line
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+# the PT-TLS client loads its secrets via the command line
@@ -0,0 +1,4 @@
+/* strongSwan SQLite database */
+
+/* configuration is read from the command line */
+/* credentials are read from the command line */
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow PT-TLS 
+-A INPUT  -i eth0 -s 10.1.0.10 -p tcp --sport 271 -j ACCEPT
+-A OUTPUT -o eth0 -d 10.1.0.10 -p tcp --dport 271 -j ACCEPT
+
+# allow ssh
+-A INPUT  -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT  -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
+
+COMMIT
@@ -0,0 +1,6 @@
+--connect aaa.strongswan.org
+--client [email protected]
+--key  /etc/ipsec.d/private/daveKey.pem
+--cert /etc/ipsec.d/certs/daveCert.pem
+--cert /etc/ipsec.d/cacerts/strongswanCert.pem
+--debug 2
@@ -0,0 +1,26 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+libimcv {
+  plugins {
+    imc-os {
+      push_info = no
+    }
+  }
+}
+
+libtnccs {
+  plugins {
+    tnccs-20 {
+      max_batch_size   = 131056
+      max_message_size = 131024
+    }
+  }
+}
+
+libtls {
+  suites = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+}
+
+pt-tls-client {
+  load = curl revocation constraints pem openssl nonce tnc-tnccs tnc-imc tnccs-20
+}
@@ -0,0 +1,4 @@
+#IMC configuration file for strongSwan client 
+
+IMC "OS" 	/usr/local/lib/ipsec/imcvs/imc-os.so
+IMC "SWID"	/usr/local/lib/ipsec/imcvs/imc-swid.so