From 44e83f76f3de50947a90cc37b2628646a5125353 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 26 Nov 2015 19:06:41 +0100 Subject: [PATCH] testing: Use TLS 1.2 in RADIUS test cases This took a while as in the OpenSSL package shipped with Debian and on which our FIPS-enabled package is based, the function SSL_export_keying_material(), which is used by FreeRADIUS to derive the MSK, did not use the correct digest to calculate the result when TLS 1.2 was used. This caused IKE to fail with "verification of AUTH payload with EAP MSK failed". The fix was only backported to jessie recently. --- .../ikev2/rw-eap-tls-radius/hosts/carol/etc/strongswan.conf | 3 +++ .../tests/tnc/tnccs-11-radius/hosts/carol/etc/strongswan.conf | 3 +++ 2 files changed, 6 insertions(+) diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/carol/etc/strongswan.conf index 4c778a721..50f0389d3 100644 --- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/carol/etc/strongswan.conf +++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/carol/etc/strongswan.conf @@ -4,3 +4,6 @@ charon { load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default eap-tls updown multiple_authentication=no } +libtls { + suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 +} diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/carol/etc/strongswan.conf b/testing/tests/tnc/tnccs-11-radius/hosts/carol/etc/strongswan.conf index 80c96b677..09ca9d0e4 100644 --- a/testing/tests/tnc/tnccs-11-radius/hosts/carol/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-11-radius/hosts/carol/etc/strongswan.conf @@ -32,3 +32,6 @@ libimcv { } } } +libtls { + suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 +}