denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Negotiate TLS 1.3 for part of the EAP-TLS scenarios

Browse Source
This commit is contained in:
Andreas Steffen
2023-03-02 09:02:38 +01:00
parent d605584a7a
commit edd3c797b0
42 changed files with 114 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat
+2
View File
@@ -1,10 +1,12 @@
carol::cat /var/log/daemon.log::server requested EAP_PEAP authentication::YES
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_256_GCM_SHA384::YES
carol::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
carol::cat /var/log/daemon.log::EAP method EAP_PEAP succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::server requested EAP_PEAP authentication::YES
dave:: cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::YES
dave:: cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
moon:: cat /var/log/daemon.log::EAP_PEAP phase2 authentication of '[email protected]' with EAP_MD5 successful::YES
testing/tests/ikev2/rw-eap-peap-md5/hosts/carol/etc/strongswan.conf
+2 -1
View File
@@ -16,5 +16,6 @@ charon-systemd {
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
version_max = 1.3
suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
}
testing/tests/ikev2/rw-eap-peap-md5/hosts/moon/etc/strongswan.conf
+4
View File
@@ -20,3 +20,7 @@ charon-systemd {
}
}
}
libtls {
version_max = 1.3
}
testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat
+2
View File
@@ -1,10 +1,12 @@
carol::cat /var/log/daemon.log::server requested EAP_PEAP authentication::YES
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_256_GCM_SHA384::YES
carol::cat /var/log/daemon.log::server requested EAP_MSCHAPV2 authentication::YES
carol::cat /var/log/daemon.log::EAP method EAP_PEAP succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::server requested EAP_PEAP authentication::YES
dave:: cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::YES
dave:: cat /var/log/daemon.log::server requested EAP_MSCHAPV2 authentication::YES
dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
moon:: cat /var/log/daemon.log::EAP_PEAP phase2 authentication of '[email protected]' with EAP_MSCHAPV2 successful::YES
testing/tests/ikev2/rw-eap-peap-mschapv2/hosts/carol/etc/strongswan.conf
+2 -1
View File
@@ -16,5 +16,6 @@ charon-systemd {
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
version_max = 1.3
suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
}
testing/tests/ikev2/rw-eap-peap-mschapv2/hosts/moon/etc/strongswan.conf
+4
View File
@@ -19,3 +19,7 @@ charon-systemd {
}
}
}
libtls {
version_max = 1.3
}
testing/tests/ikev2/rw-eap-tls-only/evaltest.dat
+1 -1
View File
@@ -1,6 +1,6 @@
carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_256_GCM_SHA384::YES
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
dave::cat /var/log/daemon.log::no issuer certificate found for \"C=CH, O=strongSwan Project, CN=moon.strongswan.org\"::YES
dave::cat /var/log/daemon.log::no TLS public key found for server 'C=CH, O=strongSwan Project, CN=moon.strongswan.org'::YES
testing/tests/ikev2/rw-eap-tls-only/hosts/carol/etc/strongswan.conf
+4
View File
@@ -14,3 +14,7 @@ charon-systemd {
}
}
}
libtls {
version_max = 1.3
}
testing/tests/ikev2/rw-eap-tls-only/hosts/moon/etc/strongswan.conf
+2 -1
View File
@@ -16,5 +16,6 @@ charon-systemd {
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
version_max = 1.3
suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
}
testing/tests/ikev2/rw-eap-tls-sha3-rsa/evaltest.dat
+2
View File
@@ -1,4 +1,6 @@
carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
testing/tests/ikev2/rw-eap-tls-sha3-rsa/hosts/carol/etc/strongswan.conf
+3 -2
View File
@@ -5,9 +5,10 @@ swanctl {
}
charon-systemd {
load = random nonce md5 sha1 sha2 sha3 aes hmac kdf pem pkcs1 x509 revocation constraints pubkey curve25519 mgf1 gmp curl eap-tls kernel-netlink socket-default updown vici
load = random nonce md5 sha1 sha2 sha3 aes hmac gcm kdf pem pkcs1 x509 revocation constraints pubkey curve25519 mgf1 gmp curl eap-tls kernel-netlink socket-default updown vici
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
version_max = 1.3
suites = TLS_AES_128_GCM_SHA256
}
testing/tests/ikev2/rw-eap-tls-sha3-rsa/hosts/moon/etc/strongswan.conf
+5 -1
View File
@@ -5,5 +5,9 @@ swanctl {
}
charon-systemd {
load = random nonce md5 sha1 sha2 sha3 aes hmac kdf pem pkcs1 x509 revocation constraints pubkey curve25519 mgf1 gmp curl eap-tls kernel-netlink socket-default updown vici
load = random nonce md5 sha1 sha2 sha3 aes hmac gcm kdf pem pkcs1 x509 revocation constraints pubkey curve25519 mgf1 gmp curl eap-tls kernel-netlink socket-default updown vici
}
libtls {
version_max = 1.3
}
testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat
+2
View File
@@ -1,10 +1,12 @@
carol::cat /var/log/daemon.log::server requested EAP_TTLS authentication::YES
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_256_GCM_SHA384::YES
carol::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::server requested EAP_TTLS authentication::YES
dave:: cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::YES
dave:: cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
moon:: cat /var/log/daemon.log::EAP_TTLS phase2 authentication of '[email protected]' with EAP_MD5 successful::YES
testing/tests/ikev2/rw-eap-ttls-only/hosts/carol/etc/strongswan.conf
+2 -1
View File
@@ -16,5 +16,6 @@ charon-systemd {
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
version_max = 1.3
suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
}
testing/tests/ikev2/rw-eap-ttls-only/hosts/moon/etc/strongswan.conf
+4
View File
@@ -19,3 +19,7 @@ charon-systemd {
}
}
}
libtls {
version_max = 1.3
}