testing: Negotiate TLS 1.3 for part of the EAP-TLS scenarios

testing/tests/tnc/tnccs-11/evaltest.dat

@@ -1,6 +1,8 @@
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
 carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
 dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES

testing/tests/tnc/tnccs-11/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
 
   multiple_authentication=no
 
@@ -19,7 +19,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-11/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
 
   multiple_authentication = no
 
@@ -25,7 +25,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-block/evaltest.dat

@@ -1,6 +1,8 @@
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
 carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Denied'::YES
 dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
 moon:: cat /var/log/daemon.log::added group membership 'allow'::YES

testing/tests/tnc/tnccs-20-block/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
 
   multiple_authentication = no
 
@@ -19,7 +19,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-block/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
 
   multiple_authentication = no
 
@@ -24,5 +24,6 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 }

testing/tests/tnc/tnccs-20-client-retry/evaltest.dat

@@ -1,6 +1,8 @@
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
 carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
 moon:: cat /var/log/daemon.log::added group membership 'allow'::YES

testing/tests/tnc/tnccs-20-client-retry/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
 
   multiple_authentication = no
 
@@ -14,7 +14,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-client-retry/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
 
   multiple_authentication = no
 
@@ -21,7 +21,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-pdp-eap/evaltest.dat

@@ -1,9 +1,11 @@
 dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::PDP server.*aaa.strongswan.org.*is listening on port 271::YES
 dave:: cat /var/log/daemon.log::collected ... SW records::YES
 dave:: cat /var/log/daemon.log::PB-TNC access recommendation is .*Quarantined::YES
 dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::PDP server.*aaa.strongswan.org.*is listening on port 271::YES
 carol::cat /var/log/daemon.log::collected ... SW ID records::YES
 carol::cat /var/log/daemon.log::strongswan.org__strongSwan.*swidtag::YES

testing/tests/tnc/tnccs-20-pdp-eap/hosts/alice/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici socket-default kernel-netlink eap-identity eap-ttls eap-md5 eap-tnc tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici socket-default kernel-netlink eap-identity eap-ttls eap-md5 eap-tnc tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
 
   syslog {
     daemon {
@@ -42,3 +42,7 @@ libimcv {
     }
   }
 }
+
+libtls {
+  version_max = 1.3
+}

testing/tests/tnc/tnccs-20-pdp-eap/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
 
   syslog {
     daemon {
@@ -24,5 +24,6 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }

testing/tests/tnc/tnccs-20-pts-no-ecc/evaltest.dat

@@ -1,6 +1,8 @@
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
 carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
 dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES

testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 mgf1 gmp hmac kdf pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
+  load = random nonce aes sha1 sha2 md5 mgf1 gmp hmac gcm curve25519 kdf pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
 
   multiple_authentication = no
 
@@ -20,7 +20,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-pts-no-ecc/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 mgf1 gmp hmac kdf pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
+  load = random nonce aes sha1 sha2 md5 mgf1 gmp hmac gcm curve25519 kdf pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
 
   multiple_authentication = no
 
@@ -23,7 +23,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-pts/evaltest.dat

@@ -1,6 +1,8 @@
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
 carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
 dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES

testing/tests/tnc/tnccs-20-pts/hosts/carol/etc/strongswan.conf

@@ -20,7 +20,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-pts/hosts/moon/etc/strongswan.conf

@@ -23,7 +23,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-tls/evaltest.dat

@@ -1,6 +1,8 @@
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
 carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
 dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES

testing/tests/tnc/tnccs-20-tls/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp curve25519 hmac gcm kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
 
   multiple_authentication = no
 
@@ -14,7 +14,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20-tls/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp curve25519 hmac gcm kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
 
   multiple_authentication = no
 
@@ -21,5 +21,6 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 }

testing/tests/tnc/tnccs-20/evaltest.dat

@@ -1,6 +1,8 @@
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
 carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
 dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES

testing/tests/tnc/tnccs-20/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
 
   multiple_authentication = no
 
@@ -14,7 +14,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-20/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
 
   multiple_authentication = no
 
@@ -21,7 +21,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-dynamic/evaltest.dat

@@ -1,6 +1,8 @@
+carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
 carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
 carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
 dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
 dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
 dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES

testing/tests/tnc/tnccs-dynamic/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
 
   multiple_authentication=no
   integrity_test = yes
@@ -19,8 +19,9 @@ charon-systemd {
   }
 }
 
-ilibtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+libtls {
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
 }
 
 libimcv {

testing/tests/tnc/tnccs-dynamic/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-dynamic tnccs-11 tnccs-20 tnc-imv updown
+  load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-dynamic tnccs-11 tnccs-20 tnc-imv updown
 
   multiple_authentication=no
   integrity_test = yes
@@ -26,6 +26,7 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 }