denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Negotiate TLS 1.3 for part of the EAP-TLS scenarios

Browse Source
This commit is contained in:
Andreas Steffen
2023-03-02 09:02:38 +01:00
parent d605584a7a
commit edd3c797b0
42 changed files with 114 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/tnc/tnccs-20/evaltest.dat
+2
View File
@@ -1,6 +1,8 @@
carol::cat /var/log/daemon.log::negotiated TLS 1.3 using suite TLS_AES_128_GCM_SHA256::YES
carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256::YES
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
testing/tests/tnc/tnccs-20/hosts/carol/etc/strongswan.conf
+3 -2
View File
@@ -1,7 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
multiple_authentication = no
@@ -14,7 +14,8 @@ charon-systemd {
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
version_max = 1.3
suites = TLS_AES_128_GCM_SHA256
}
libimcv {
testing/tests/tnc/tnccs-20/hosts/moon/etc/strongswan.conf
+3 -2
View File
@@ -1,7 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
load = random nonce aes sha1 sha2 md5 pem pkcs1 mgf1 gmp hmac gcm curve25519 kdf x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
multiple_authentication = no
@@ -21,7 +21,8 @@ charon-systemd {
}
libtls {
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
version_max = 1.3
suites = TLS_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
}
libimcv {