denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use EAP identity in tnc/tnccs-20-pdp scenario

Browse Source
This commit is contained in:
Andreas Steffen
2013-02-12 20:41:37 +01:00
parent 2a421163bf
commit 7d355f853d
8 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/tnc/tnccs-20-pdp/evaltest.dat
+4 -2
View File
@@ -7,9 +7,11 @@ dave:: cat /var/log/daemon.log::PB-TNC access recommendation is .*Quarantined::Y
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES
moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES moon:: cat /var/log/daemon.log::RADIUS authentication of 'carol' successful::YES
moon:: cat /var/log/daemon.log::authentication of '192.168.0.100' with EAP successful::YES
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave' successful::YES
moon:: cat /var/log/daemon.log::authentication of '192.168.0.200' with EAP successful::YES
moon:: ipsec statusall 2>/dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES moon:: ipsec statusall 2>/dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2>/dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES moon:: ipsec statusall 2>/dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
testing/tests/tnc/tnccs-20-pdp/hosts/alice/etc/ipsec.secrets
+2 -2
View File
@@ -2,5 +2,5 @@
: RSA aaaKey.pem : RSA aaaKey.pem
carol@strongswan.org : EAP "Ar3etTnp" carol : EAP "Ar3etTnp"
dave@strongswan.org : EAP "W7R0g3do" dave : EAP "W7R0g3do"
testing/tests/tnc/tnccs-20-pdp/hosts/carol/etc/ipsec.conf
+1 -1
View File
@@ -12,12 +12,12 @@ conn %default
conn home conn home
left=PH_IP_CAROL left=PH_IP_CAROL
[email protected]
leftauth=eap leftauth=eap
leftfirewall=yes leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
[email protected] [email protected]
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
rightauth=pubkey rightauth=pubkey
eap_identity=carol
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org" aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
auto=add auto=add
testing/tests/tnc/tnccs-20-pdp/hosts/carol/etc/ipsec.secrets
+1 -1
View File
@@ -1,3 +1,3 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file # /etc/ipsec.secrets - strongSwan IPsec secrets file
carol@strongswan.org : EAP "Ar3etTnp" carol : EAP "Ar3etTnp"
testing/tests/tnc/tnccs-20-pdp/hosts/dave/etc/ipsec.conf
+1 -1
View File
@@ -12,12 +12,12 @@ conn %default
conn home conn home
left=PH_IP_DAVE left=PH_IP_DAVE
[email protected]
leftauth=eap leftauth=eap
leftfirewall=yes leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
[email protected] [email protected]
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
rightauth=pubkey rightauth=pubkey
eap_identity=dave
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org" aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
auto=add auto=add
testing/tests/tnc/tnccs-20-pdp/hosts/dave/etc/ipsec.secrets
+1 -1
View File
@@ -1,3 +1,3 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file # /etc/ipsec.secrets - strongSwan IPsec secrets file
dave@strongswan.org : EAP "W7R0g3do" dave : EAP "W7R0g3do"
testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/ipsec.conf
+1 -1
View File
@@ -28,6 +28,6 @@ conn rw-eap
leftauth=pubkey leftauth=pubkey
leftfirewall=yes leftfirewall=yes
rightauth=eap-radius rightauth=eap-radius
rightid=*@strongswan.org
rightsendcert=never rightsendcert=never
right=%any right=%any
eap_identity=%any
testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/strongswan.conf
+1 -1
View File
@@ -1,7 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-radius updown load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-radius updown
multiple_authentication=no multiple_authentication=no
plugins { plugins {
eap-radius { eap-radius {