tnccs-11: Remove legacy TNCCS-1.1 implementation
There is no reason to keep this around anymore (has been superseded by TNCCS-2.0 a long time ago). Removed the corresponding test scenarios. Since this is the last user of libxml, also removed those references.
This commit is contained in:
Tobias Brunner
@@ -14,7 +14,7 @@ check_commands debootstrap mkfs.ext3 blockdev qemu-img qemu-nbd sfdisk
|
||||
# package includes/excludes
|
||||
INC=automake,autoconf,libtool,bison,flex,gperf,pkg-config,less,locales
|
||||
INC=$INC,build-essential,libgmp-dev,libldap2-dev,libcurl4-openssl-dev,ethtool
|
||||
INC=$INC,libxml2-dev,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc
|
||||
INC=$INC,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc
|
||||
INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libltdl-dev,wget,gnupg,man-db
|
||||
INC=$INC,libboost-thread-dev,libboost-system-dev,git,iperf3,htop,valgrind,strace
|
||||
INC=$INC,gnat,gprbuild,acpid,acpi-support-base,libldns-dev,libunbound-dev
|
||||
|
||||
@@ -42,7 +42,6 @@ CONFIG_OPTS = \
|
||||
--enable-tnc-pdp \
|
||||
--enable-tnc-imc \
|
||||
--enable-tnc-imv \
|
||||
--enable-tnccs-11 \
|
||||
--enable-tnccs-20 \
|
||||
--enable-tnccs-dynamic \
|
||||
--enable-imc-test \
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
|
||||
using EAP-TTLS authentication only with the gateway presenting a server certificate and
|
||||
the clients doing EAP-MD5 password-based authentication.
|
||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
||||
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
|
||||
The IMC and IMV communicate are using the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
|
||||
<p>
|
||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the
|
||||
clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets,
|
||||
respectively.
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
|
||||
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
|
||||
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
|
||||
dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
|
||||
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
|
||||
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
||||
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/28]::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.16/28]::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-allow.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-allow.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[192.168.0.100/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw-isolate.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-isolate.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.16/28] remote-ts=\[192.168.0.200/32]::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
|
||||
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
|
||||
@@ -1,32 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
syslog {
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-tnc {
|
||||
protocol = tnccs-1.1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
libtls {
|
||||
version_max = 1.3
|
||||
suites = TLS_AES_128_GCM_SHA256
|
||||
}
|
||||
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = allow
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap-ttls
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = eap-ttls
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
eap {
|
||||
id = [email protected]
|
||||
secret = "Ar3etTnp"
|
||||
}
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
|
||||
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
|
||||
@@ -1,34 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
syslog {
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-tnc {
|
||||
protocol = tnccs-1.1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
libtls {
|
||||
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
}
|
||||
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = isolate
|
||||
}
|
||||
imc-scanner {
|
||||
push_info = no
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.200
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap-ttls
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = eap-ttls
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
eap {
|
||||
id = [email protected]
|
||||
secret = "W7R0g3do"
|
||||
}
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
|
||||
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
|
||||
@@ -1,38 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
syslog {
|
||||
daemon {
|
||||
tnc = 3
|
||||
imv = 3
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-ttls {
|
||||
phase2_method = md5
|
||||
phase2_piggyback = yes
|
||||
phase2_tnc = yes
|
||||
phase2_tnc_method = tnc
|
||||
}
|
||||
eap-tnc {
|
||||
protocol = tnccs-1.1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
libtls {
|
||||
version_max = 1.3
|
||||
suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
}
|
||||
|
||||
libimcv {
|
||||
plugins {
|
||||
imv-test {
|
||||
rounds = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,64 +0,0 @@
|
||||
connections {
|
||||
|
||||
rw-allow {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap-ttls
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = eap-ttls
|
||||
id = *@strongswan.org
|
||||
groups = allow
|
||||
}
|
||||
children {
|
||||
rw-allow {
|
||||
local_ts = 10.1.0.0/28
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
|
||||
rw-isolate {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap-ttls
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = eap-ttls
|
||||
id = *@strongswan.org
|
||||
groups = isolate
|
||||
}
|
||||
children {
|
||||
rw-isolate {
|
||||
local_ts = 10.1.0.16/28
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
eap-carol {
|
||||
id = [email protected]
|
||||
secret = "Ar3etTnp"
|
||||
}
|
||||
eap-dave {
|
||||
id = [email protected]
|
||||
secret = "W7R0g3do"
|
||||
}
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMV configuration file for strongSwan client
|
||||
|
||||
IMV "Test" /usr/local/lib/ipsec/imcvs/imv-test.so
|
||||
IMV "Scanner" /usr/local/lib/ipsec/imcvs/imv-scanner.so
|
||||
@@ -1,6 +0,0 @@
|
||||
carol::systemctl stop strongswan
|
||||
dave::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
@@ -1,19 +0,0 @@
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::cat /etc/tnc_config
|
||||
carol::cat /etc/tnc_config
|
||||
dave::cat /etc/tnc_config
|
||||
carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
dave::systemctl start strongswan
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
dave::expect-connection home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
@@ -1,30 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice venus moon carol winnetou dave"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-v-m-c-w-d.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol dave"
|
||||
|
||||
# Guest instances on which FreeRadius is started
|
||||
#
|
||||
RADIUSHOSTS=
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
|
||||
using EAP-TTLS authentication only with the gateway presenting a server certificate and
|
||||
the clients doing EAP-MD5 password-based authentication.
|
||||
<p/>
|
||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
||||
health of TNC client <b>carol</b> via the <b>TNCCS 1.1 </b> client-server interface and of
|
||||
TNC client <b>dave</b> via the <b>TNCCS 2.0 </b> client-server interface. TNC server
|
||||
<b>moon</b> dynamically detects which version of the IF-TNCCS protocol is used.
|
||||
<p>
|
||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the
|
||||
clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets,
|
||||
respectively.
|
||||
</p>
|
||||
@@ -1,28 +0,0 @@
|
||||
carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
|
||||
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
|
||||
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
|
||||
dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
|
||||
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
|
||||
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
||||
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::TNCCS 1.1 protocol detected dynamically::YES
|
||||
moon:: cat /var/log/daemon.log::assigned TNCCS Connection ID 1::YES
|
||||
moon:: cat /var/log/daemon.log::final recommendation is 'allow' and evaluation is 'compliant'::YES
|
||||
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::removed TNCCS Connection ID 1::YES
|
||||
moon:: cat /var/log/daemon.log::TNCCS 2.0 protocol detected dynamically::YES
|
||||
moon:: cat /var/log/daemon.log::assigned TNCCS Connection ID 2::YES
|
||||
moon:: cat /var/log/daemon.log::final recommendation is 'isolate' and evaluation is 'non-compliant minor'::YES
|
||||
moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::removed TNCCS Connection ID 2::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/28]::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.16/28]::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-allow.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-allow.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[192.168.0.100/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw-isolate.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-isolate.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.16/28] remote-ts=\[192.168.0.200/32]::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
|
||||
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
|
||||
@@ -1,33 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
integrity_test = yes
|
||||
|
||||
syslog {
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-tnc {
|
||||
protocol = tnccs-1.1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
libtls {
|
||||
version_max = 1.3
|
||||
suites = TLS_AES_128_GCM_SHA256
|
||||
}
|
||||
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = allow
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap-ttls
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = eap-ttls
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
eap {
|
||||
id = [email protected]
|
||||
secret = "Ar3etTnp"
|
||||
}
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
|
||||
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
|
||||
@@ -1,35 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication=no
|
||||
integrity_test = yes
|
||||
|
||||
syslog {
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-tnc {
|
||||
protocol = tnccs-2.0
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
libtls {
|
||||
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
}
|
||||
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = isolate
|
||||
}
|
||||
imc-scanner {
|
||||
push_info = no
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.200
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap-ttls
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = eap-ttls
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
eap {
|
||||
id = [email protected]
|
||||
secret = "W7R0g3do"
|
||||
}
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
|
||||
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
|
||||
@@ -1,32 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-dynamic tnccs-11 tnccs-20 tnc-imv updown
|
||||
|
||||
multiple_authentication=no
|
||||
integrity_test = yes
|
||||
|
||||
syslog {
|
||||
daemon {
|
||||
tnc = 3
|
||||
imv = 3
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-ttls {
|
||||
phase2_method = md5
|
||||
phase2_piggyback = yes
|
||||
phase2_tnc = yes
|
||||
phase2_tnc_method = tnc
|
||||
}
|
||||
eap-tnc {
|
||||
protocol = tnccs-dynamic
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
libtls {
|
||||
version_max = 1.3
|
||||
suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
}
|
||||
|
||||
@@ -1,64 +0,0 @@
|
||||
connections {
|
||||
|
||||
rw-allow {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap-ttls
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = eap-ttls
|
||||
id = *@strongswan.org
|
||||
groups = allow
|
||||
}
|
||||
children {
|
||||
rw-allow {
|
||||
local_ts = 10.1.0.0/28
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
|
||||
rw-isolate {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap-ttls
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = eap-ttls
|
||||
id = *@strongswan.org
|
||||
groups = isolate
|
||||
}
|
||||
children {
|
||||
rw-isolate {
|
||||
local_ts = 10.1.0.16/28
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
eap-carol {
|
||||
id = [email protected]
|
||||
secret = "Ar3etTnp"
|
||||
}
|
||||
eap-dave {
|
||||
id = [email protected]
|
||||
secret = "W7R0g3do"
|
||||
}
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMV configuration file for strongSwan client
|
||||
|
||||
IMV "Test" /usr/local/lib/ipsec/imcvs/imv-test.so
|
||||
IMV "Scanner" /usr/local/lib/ipsec/imcvs/imv-scanner.so
|
||||
@@ -1,6 +0,0 @@
|
||||
carol::systemctl stop strongswan
|
||||
dave::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
@@ -1,19 +0,0 @@
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::cat /etc/tnc_config
|
||||
carol::cat /etc/tnc_config
|
||||
dave::cat /etc/tnc_config
|
||||
carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
dave::systemctl start strongswan
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
dave::expect-connection home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
@@ -1,29 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice venus moon carol winnetou dave"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-v-m-c-w-d.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol dave"
|
||||
|
||||
# Guest instances on which FreeRadius is started
|
||||
#
|
||||
RADIUSHOSTS=
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
Reference in New Issue
Block a user