From 737f7fce51066534b6e443b24b904e0eb1401e62 Mon Sep 17 00:00:00 2001 From: Andreas Steffen Date: Tue, 23 Mar 2021 10:49:32 +0100 Subject: [PATCH] testing: Switched PTS measurements to /usr/sbin Due to Debian 10 linking /bin to /usr/bin which drastically increased the number of files in /bin, the PTS measurement was switched to /usr/sbin with a lesser number of files. --- src/libimcv/imv/data.sql | 4 ++-- testing/tests/tnc/tnccs-20-os-pts/description.txt | 4 ++-- .../tnccs-20-os-pts/hosts/carol/etc/strongswan.conf | 5 +++++ .../tnccs-20-os-pts/hosts/dave/etc/strongswan.conf | 3 +++ .../tnccs-20-os-pts/hosts/moon/etc/strongswan.conf | 1 + .../tests/tnc/tnccs-20-pts-no-ecc/description.txt | 12 ++++++------ .../hosts/carol/etc/strongswan.conf | 5 +++++ .../hosts/dave/etc/strongswan.conf | 3 +++ .../hosts/moon/etc/strongswan.conf | 1 + testing/tests/tnc/tnccs-20-pts/description.txt | 6 +++--- .../tnc/tnccs-20-pts/hosts/carol/etc/strongswan.conf | 5 +++++ .../tnc/tnccs-20-pts/hosts/dave/etc/strongswan.conf | 3 +++ .../tnc/tnccs-20-pts/hosts/moon/etc/strongswan.conf | 1 + 13 files changed, 40 insertions(+), 13 deletions(-) diff --git a/src/libimcv/imv/data.sql b/src/libimcv/imv/data.sql index 5220a82a6..6587b3d56 100644 --- a/src/libimcv/imv/data.sql +++ b/src/libimcv/imv/data.sql @@ -1731,7 +1731,7 @@ INSERT INTO policies ( /* 10 */ INSERT INTO policies ( /* 11 */ type, name, dir, rec_fail, rec_noresult ) VALUES ( - 8, 'Get /bin', 1, 0, 0 + 8, 'Get /usr/sbin', 12, 0, 0 ); INSERT INTO policies ( /* 12 */ @@ -1761,7 +1761,7 @@ INSERT INTO policies ( /* 15 */ INSERT INTO policies ( /* 16 */ type, name, dir, rec_fail, rec_noresult ) VALUES ( - 9, 'Measure /bin', 1, 2, 2 + 9, 'Measure /usr/sbin', 12, 2, 2 ); INSERT INTO policies ( /* 17 */ diff --git a/testing/tests/tnc/tnccs-20-os-pts/description.txt b/testing/tests/tnc/tnccs-20-os-pts/description.txt index 0ade4ba30..53d173a91 100644 --- a/testing/tests/tnc/tnccs-20-os-pts/description.txt +++ b/testing/tests/tnc/tnccs-20-os-pts/description.txt @@ -11,8 +11,8 @@ protocol defined by RFC 5792 PA-TNC. Product Information, String Version, and Device ID up-front to the Attestation IMV, whereas dave must be prompted by the IMV to do so via an Attribute Request PA-TNC attribute. dave is instructed to do a reference -measurement on all files in the /bin directory. carol is then prompted to -measure a couple of individual files and the files in the /bin directory as +measurement on all files in the /usr/sbin directory. carol is then prompted to +measure a couple of individual files and the files in the /usr/sbin directory as well as to get metadata on the /etc/tnc_confg configuration file.

carol passes the health test and dave fails because IP forwarding is diff --git a/testing/tests/tnc/tnccs-20-os-pts/hosts/carol/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os-pts/hosts/carol/etc/strongswan.conf index 3e4d76f10..fe6ea8cd0 100644 --- a/testing/tests/tnc/tnccs-20-os-pts/hosts/carol/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-os-pts/hosts/carol/etc/strongswan.conf @@ -12,6 +12,11 @@ charon-systemd { pts = 3 } } + plugins { + eap-ttls { + max_message_count = 0 + } + } } libtls { diff --git a/testing/tests/tnc/tnccs-20-os-pts/hosts/dave/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os-pts/hosts/dave/etc/strongswan.conf index 2e249d48d..92050e6bb 100644 --- a/testing/tests/tnc/tnccs-20-os-pts/hosts/dave/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-os-pts/hosts/dave/etc/strongswan.conf @@ -14,6 +14,9 @@ charon-systemd { } } plugins { + eap-ttls { + max_message_count = 0 + } tnc-imc { preferred_language = de } diff --git a/testing/tests/tnc/tnccs-20-os-pts/hosts/moon/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os-pts/hosts/moon/etc/strongswan.conf index a683ba77c..560b248f7 100644 --- a/testing/tests/tnc/tnccs-20-os-pts/hosts/moon/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-os-pts/hosts/moon/etc/strongswan.conf @@ -14,6 +14,7 @@ charon-systemd { } plugins { eap-ttls { + max_message_count = 0 phase2_method = md5 phase2_piggyback = yes phase2_tnc = yes diff --git a/testing/tests/tnc/tnccs-20-pts-no-ecc/description.txt b/testing/tests/tnc/tnccs-20-pts-no-ecc/description.txt index febf07401..d3c3431d6 100644 --- a/testing/tests/tnc/tnccs-20-pts-no-ecc/description.txt +++ b/testing/tests/tnc/tnccs-20-pts-no-ecc/description.txt @@ -2,18 +2,18 @@ The roadwarriors carol and dave set up a connection each to gatewa using EAP-TTLS authentication only with the gateway presenting a server certificate and the clients doing EAP-MD5 password-based authentication.

-In a next step the RFC 7171 PT-EAP transport protocol is used within the EAP-TTLS -tunnel to determine the state of carol's and dave's operating system via the -TNCCS 2.0 client-server interface compliant with RFC 5793 PB-TNC. The OS IMC -and OS IMV pair is using the IF-M 1.0 measurement protocol defined by RFC 5792 PA-TNC +In a next step the RFC 7171 PT-EAP transport protocol is used within the EAP-TTLS +tunnel to determine the state of carol's and dave's operating system via the +TNCCS 2.0 client-server interface compliant with RFC 5793 PB-TNC. The OS IMC +and OS IMV pair is using the IF-M 1.0 measurement protocol defined by RFC 5792 PA-TNC to exchange PA-TNC attributes.

carol sends information on her operating system consisting of the PA-TNC attributes Product Information, String Version, and Device ID up-front to the Attestation IMV, whereas dave must be prompted by the IMV to do so via an Attribute Request PA-TNC attribute. dave is instructed to do a reference -measurement on all files in the /bin directory. carol is then prompted to -measure a couple of individual files and the files in the /bin directory as +measurement on all files in the /usr/sbin directory. carol is then prompted to +measure a couple of individual files and the files in the /usr/sbin directory as well as to get metadata on the /etc/tnc_confg configuration file.

Since the Attestation IMV negotiates a Diffie-Hellman group for TPM-based measurements, diff --git a/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/carol/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/carol/etc/strongswan.conf index 55f31671e..4f47b79f2 100644 --- a/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/carol/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/carol/etc/strongswan.conf @@ -12,6 +12,11 @@ charon-systemd { pts = 3 } } + plugins { + eap-ttls { + max_message_count = 0 + } + } } libtls { diff --git a/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/dave/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/dave/etc/strongswan.conf index 8f8ef96d9..9a0644661 100644 --- a/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/dave/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/dave/etc/strongswan.conf @@ -13,6 +13,9 @@ charon-systemd { } } plugins { + eap-ttls { + max_message_count = 0 + } tnc-imc { preferred_language = de } diff --git a/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/moon/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/moon/etc/strongswan.conf index dd9a2e0bc..edb59d2b8 100644 --- a/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/moon/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/moon/etc/strongswan.conf @@ -14,6 +14,7 @@ charon-systemd { } plugins { eap-ttls { + max_message_count = 0 phase2_method = md5 phase2_piggyback = yes phase2_tnc = yes diff --git a/testing/tests/tnc/tnccs-20-pts/description.txt b/testing/tests/tnc/tnccs-20-pts/description.txt index e532ab2cf..c4c556662 100644 --- a/testing/tests/tnc/tnccs-20-pts/description.txt +++ b/testing/tests/tnc/tnccs-20-pts/description.txt @@ -2,7 +2,7 @@ The roadwarriors carol and dave set up a connection each to gatewa using EAP-TTLS authentication only with the gateway presenting a server certificate and the clients doing EAP-MD5 password-based authentication.

-In a next step the RFC 7171 PT-EAP transport protocol is used within the EAP-TTLS tunnel +In a next step the RFC 7171 PT-EAP transport protocol is used within the EAP-TTLS tunnel to determine the state of carol's and dave's operating system via the TNCCS 2.0 client-server interface compliant with RFC 5793 PB-TNC. The OS and Attestation IMCs exchange PA-TNC attributes with the OS IMV via the IF-M 1.0 measurement protocol @@ -12,8 +12,8 @@ defined by RFC 5792 PA-TNC. Product Information, String Version, and Device ID up-front to the Attestation IMV, whereas dave must be prompted by the IMV to do so via an Attribute Request PA-TNC attribute. dave is instructed to do a reference -measurement on all files in the /bin directory. carol is then prompted to -measure a couple of individual files and the files in the /bin directory as +measurement on all files in the /usr/sbin directory. carol is then prompted to +measure a couple of individual files and the files in the /usr/sbin directory as well as to get metadata on the /etc/tnc_confg configuration file.

carol passes the health test and dave fails because IP forwarding is diff --git a/testing/tests/tnc/tnccs-20-pts/hosts/carol/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pts/hosts/carol/etc/strongswan.conf index 8ebf56878..fd76ad0fd 100644 --- a/testing/tests/tnc/tnccs-20-pts/hosts/carol/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-pts/hosts/carol/etc/strongswan.conf @@ -12,6 +12,11 @@ charon-systemd { pts = 3 } } + plugins { + eap-ttls { + max_message_count = 0 + } + } } libtls { diff --git a/testing/tests/tnc/tnccs-20-pts/hosts/dave/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pts/hosts/dave/etc/strongswan.conf index 0b47d35e7..13969e583 100644 --- a/testing/tests/tnc/tnccs-20-pts/hosts/dave/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-pts/hosts/dave/etc/strongswan.conf @@ -13,6 +13,9 @@ charon-systemd { } } plugins { + eap-ttls { + max_message_count = 0 + } tnc-imc { preferred_language = de } diff --git a/testing/tests/tnc/tnccs-20-pts/hosts/moon/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pts/hosts/moon/etc/strongswan.conf index bf14fe327..d3ca047cb 100644 --- a/testing/tests/tnc/tnccs-20-pts/hosts/moon/etc/strongswan.conf +++ b/testing/tests/tnc/tnccs-20-pts/hosts/moon/etc/strongswan.conf @@ -14,6 +14,7 @@ charon-systemd { } plugins { eap-ttls { + max_message_count = 0 phase2_method = md5 phase2_piggyback = yes phase2_tnc = yes