denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Converted tnc scenarios to swanctl

Browse Source
This commit is contained in:
Andreas Steffen
2015-12-11 18:26:54 +01:00
parent 74270c8c86
commit 6aa7703122
386 changed files with 5091 additions and 2383 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/tnc/tnccs-20-mutual-eap/evaltest.dat
+3 -5
View File
@@ -2,10 +2,8 @@ moon::cat /var/log/daemon.log::activating mutual PB-TNC half duplex protocol::YE
sun:: cat /var/log/daemon.log::activating mutual PB-TNC half duplex protocol::YES
moon::cat /var/log/daemon.log::PB-TNC access recommendation is.*Access Allowed::YES
sun:: cat /var/log/daemon.log::PB-TNC access recommendation is.*Access Allowed::YES
moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
moon::swanctl --list-sas --raw 2> /dev/null::mutual.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*mutual.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
sun::swanctl --list-sas --raw 2> /dev/null::mutual.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*mutual.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
moon::ping -c 1 192.168.0.2::64 bytes from 192.168.0.2: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/tnc/tnccs-20-mutual-eap/hosts/moon/etc/ipsec.conf
-23
View File
@@ -1,23 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tnc 2, imc 2, imv 2"
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn host-host
left=PH_IP_MOON
leftcert=moonCert.pem
leftid=moon.strongswan.org
leftauth=eap
leftfirewall=yes
right=PH_IP_SUN
rightid=sun.strongswan.org
rightsendcert=never
rightauth=any
auto=add
testing/tests/tnc/tnccs-20-mutual-eap/hosts/moon/etc/strongswan.conf
+21 -2
View File
@@ -1,12 +1,27 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = x509 openssl pem pkcs1 random nonce curl revocation stroke kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
multiple_authentication = no
start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
syslog {
auth {
default = 0
}
daemon {
tnc = 2
imc = 2
imv = 2
}
}
plugins {
eap-ttls {
phase2_tnc =yes
phase2_tnc = yes
}
tnccs-20 {
mutual = yes
@@ -14,6 +29,10 @@ charon {
}
}
libtls {
suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
}
libimcv {
plugins {
imc-test {
testing/tests/tnc/tnccs-20-mutual-eap/hosts/moon/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
mutual {
local_addrs = 192.168.0.1
remote_addrs = 192.168.0.2
local {
auth = eap-ttls
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = eap-ttls
id = sun.strongswan.org
}
children {
mutual {
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256
}
}
version = 2
mobike = no
send_certreq = no
proposals = aes128-sha256-ecp256
}
}
testing/tests/tnc/tnccs-20-mutual-eap/hosts/sun/etc/ipsec.conf
-23
View File
@@ -1,23 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tnc 2, imc 2, imv 2"
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn host-host
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
leftauth=eap-ttls
leftfirewall=yes
right=PH_IP_MOON
rightid=moon.strongswan.org
rightauth=eap-ttls
rightsendcert=never
auto=add
testing/tests/tnc/tnccs-20-mutual-eap/hosts/sun/etc/strongswan.conf
+21 -2
View File
@@ -1,9 +1,24 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = x509 openssl pem pkcs1 random nonce curl revocation stroke kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
multiple_authentication = no
multiple_authentication = no
start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
syslog {
auth {
default = 0
}
daemon {
tnc = 2
imc = 2
imv = 2
}
}
plugins {
eap-ttls {
request_peer_auth = yes
@@ -16,6 +31,10 @@ charon {
}
}
libtls {
suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
}
libimcv {
plugins {
imc-test {
testing/tests/tnc/tnccs-20-mutual-eap/hosts/sun/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
mutual {
local_addrs = 192.168.0.2
remote_addrs = 192.168.0.1
local {
auth = eap-ttls
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = eap-ttls
id = moon.strongswan.org
}
children {
mutual {
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256
}
}
version = 2
mobike = no
send_certreq = no
proposals = aes128-sha256-ecp256
}
}
testing/tests/tnc/tnccs-20-mutual-eap/posttest.dat
+2 -2
View File
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
moon::service charon stop
sun::service charon stop
moon::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
testing/tests/tnc/tnccs-20-mutual-eap/pretest.dat
+4 -4
View File
@@ -1,6 +1,6 @@
moon::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::expect-connection host-host
moon::ipsec up host-host
moon::service charon start
sun::service charon start
moon::expect-connection mutual
moon::swanctl --initiate --child mutual
testing/tests/tnc/tnccs-20-mutual-eap/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="sun"
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1