added the ikev2/rw-eap-tnc-20 scenario based on the RFC 5792 PA-TNC protocol

testing/tests/ikev2/rw-eap-tnc-20/description.txt

@@ -3,7 +3,8 @@ using EAP-TTLS authentication only with the gateway presenting a server certific
 the clients doing EAP-MD5 password-based authentication.
 In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
 health of <b>carol</b> and <b>dave</b> via the <b>TNCCS 2.0 </b> client-server interface
-compliant with <b>RFC 5793 PB-TNC</b>.
+compliant with <b>RFC 5793 PB-TNC</b>. The IMC and IMV communicate using the <b>RFC 5792 PA-TNC</b>
+protocol.
 <p>
 <b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the
 clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets,

testing/tests/ikev2/rw-eap-tnc-20/evaltest.dat

@@ -6,11 +6,9 @@ dave::cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YE
 dave::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
 dave::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
 dave::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
-moon::cat /var/log/auth.log::policy enforced on peer '[email protected]' is 'allow'::YES
-moon::cat /var/log/daemon.log::policy enforcement point added group membership 'allow'::YES
+moon::cat /var/log/daemon.log::added group membership 'allow'::YES
 moon::cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
-moon::cat /var/log/auth.log::policy enforced on peer '[email protected]' is 'isolate'::YES
-moon::cat /var/log/daemon.log::policy enforcement point added group membership 'isolate'::YES
+moon::cat /var/log/daemon.log::added group membership 'isolate'::YES
 moon::cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
 moon::ipsec statusall::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
 moon::ipsec statusall::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES

testing/tests/ikev2/rw-eap-tnc-20/hosts/carol/etc/ipsec.conf

@@ -2,7 +2,7 @@
 
 config setup
 	plutostart=no
-	charondebug="tls 2, tnc 3"
+	charondebug="tnc 3, imc 2"
 
 conn %default
 	ikelifetime=60m

testing/tests/ikev2/rw-eap-tnc-20/hosts/carol/etc/strongswan.conf

@@ -9,3 +9,7 @@ charon {
     }
   }
 }
+
+imc-test {
+  command = allow
+}

testing/tests/ikev2/rw-eap-tnc-20/hosts/carol/etc/tnc_config

@@ -1,4 +1,3 @@
 #IMC configuration file for strongSwan client 
 
-IMC "Dummy"		/usr/local/lib/libdummyimc.so
-#IMC "HostScanner"	/usr/local/lib/libhostscannerimc.so
+IMC "Test"	/usr/local/libexec/ipsec/plugins/libstrongswan-imc-test.so

testing/tests/ikev2/rw-eap-tnc-20/hosts/dave/etc/ipsec.conf

@@ -2,7 +2,7 @@
 
 config setup
 	plutostart=no
-	charondebug="tls 2, tnc 3"
+	charondebug="tnc 3, imc 2"
 
 conn %default
 	ikelifetime=60m

testing/tests/ikev2/rw-eap-tnc-20/hosts/dave/etc/strongswan.conf

@@ -9,3 +9,7 @@ charon {
     }
   }
 }
+
+imc-test {
+  command = isolate
+}

testing/tests/ikev2/rw-eap-tnc-20/hosts/dave/etc/tnc_config

@@ -1,4 +1,3 @@
 #IMC configuration file for strongSwan client 
 
-IMC "Dummy"		/usr/local/lib/libdummyimc.so
-#IMC "HostScanner"	/usr/local/lib/libhostscannerimc.so
+IMC "Test"	/usr/local/libexec/ipsec/plugins/libstrongswan-imc-test.so

testing/tests/ikev2/rw-eap-tnc-20/hosts/moon/etc/ipsec.conf

@@ -3,7 +3,7 @@
 config setup
 	strictcrlpolicy=no
 	plutostart=no
-	charondebug="tls 2, tnc 3"
+	charondebug="tnc 3, imv 2"
 
 conn %default
 	ikelifetime=60m

testing/tests/ikev2/rw-eap-tnc-20/hosts/moon/etc/strongswan.conf

@@ -14,3 +14,7 @@ charon {
     }
   }
 }
+
+imv-test {
+  rounds = 1
+}

testing/tests/ikev2/rw-eap-tnc-20/hosts/moon/etc/tnc_config

@@ -1,4 +1,3 @@
 #IMV configuration file for strongSwan server 
 
-IMV "Dummy"		/usr/local/lib/libdummyimv.so
-#IMV "HostScanner"	/usr/local/lib/libhostscannerimv.so
+IMV "Test"	/usr/local/libexec/ipsec/plugins/libstrongswan-imv-test.so