testing: Use TLS 1.3 in TNC PT-TLS tests

diff --git a/testing/tests/tnc/tnccs-20-ev-pt-tls/description.txt b/testing/tests/tnc/tnccs-20-ev-pt-tls/description.txt
index a4d9b4cf40404eef2222dd66d65f4829725b824c..730d0781bf393a97bb7087fd1e9f6361de1b61bb 100644 (file)
--- a/testing/tests/tnc/tnccs-20-ev-pt-tls/description.txt
+++ b/testing/tests/tnc/tnccs-20-ev-pt-tls/description.txt
@@ -1,7 +1,7 @@
 The PT-TLS (RFC 6876) clients <b>carol</b> and <b>dave</b> set up a connection each to the policy decision 
 point (PDP) <b>alice</b>. Endpoint <b>carol</b> uses password-based SASL PLAIN client authentication during the
 <b>PT-TLS negotiation phase</b> whereas endpoint <b>dave</b> uses certificate-based TLS client authentication
-during the <b>TLS setup phase</b>.
+during the <b>TLS setup phase</b>. In both connections TLS 1.3 is used.
 <p/>
 During the ensuing <b>PT-TLS data transport phase</b> the <b>OS</b> and <b>SWIMA</b> IMC/IMV pairs
 loaded by the PT-TLS clients and PDP, respectively, exchange PA-TNC (RFC 5792) messages

diff --git a/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/alice/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/alice/etc/strongswan.conf
index 04d7dbacc701b7cc2d515138f5501908444aa1d2..51ae13e3de98ae25b28b4def8a8e752c72101ecd 100644 (file)
--- a/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/alice/etc/strongswan.conf
+++ b/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/alice/etc/strongswan.conf
@@ -24,7 +24,9 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+  suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256
+  ke_group = curve25519, curve448
+  version_max = 1.3
 }
 
 libimcv {

diff --git a/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/carol/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/carol/etc/strongswan.conf
index 87c3745a31d25a5e1705c8a857e11161dbf8ee41..389a68a57506e0e22c2f943c9e7e14fd3b25a9ba 100644 (file)
--- a/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/carol/etc/strongswan.conf
+++ b/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/carol/etc/strongswan.conf
@@ -1,7 +1,9 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+  suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
+  ke_group = curve25519, curve448
+  version_max = 1.3
 }
 
 libimcv {

diff --git a/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/dave/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/dave/etc/strongswan.conf
index 93cbb7101b2e3393ba056f89056dd6033215f048..d91c3837fa35d3c84413590c90f9f0c9ba936ba8 100644 (file)
--- a/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/dave/etc/strongswan.conf
+++ b/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/dave/etc/strongswan.conf
@@ -12,7 +12,9 @@ libimcv {
 }
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+  suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
+  ke_group = curve25519, curve448
+  version_max = 1.3
 }
 
 pt-tls-client {

diff --git a/testing/tests/tnc/tnccs-20-mutual-pt-tls/description.txt b/testing/tests/tnc/tnccs-20-mutual-pt-tls/description.txt
index 09ab8e9f17b1ad99bf78583cf4373729229029b7..dba6fc5e58466b96c3d20652f33fca02a2bae341 100644 (file)
--- a/testing/tests/tnc/tnccs-20-mutual-pt-tls/description.txt
+++ b/testing/tests/tnc/tnccs-20-mutual-pt-tls/description.txt
@@ -1,3 +1,3 @@
 The hosts <b>moon</b> and <b>sun</b> do mutual TNC measurements using the
 PA-TNC, PB-TNC and PT-TLS protocols. The authentication is based on
-X.509 certificates.
+X.509 certificates and transport on TLS 1.3.

diff --git a/testing/tests/tnc/tnccs-20-mutual-pt-tls/hosts/moon/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-mutual-pt-tls/hosts/moon/etc/strongswan.conf
index a476878ac31940422efa4f43fcc94aca52518efc..f0291d5d59685efb413630198af1f2d8207850f8 100644 (file)
--- a/testing/tests/tnc/tnccs-20-mutual-pt-tls/hosts/moon/etc/strongswan.conf
+++ b/testing/tests/tnc/tnccs-20-mutual-pt-tls/hosts/moon/etc/strongswan.conf
@@ -5,7 +5,9 @@ pt-tls-client {
 }
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
+  ke_group = curve25519
 }
 
 libimcv {

diff --git a/testing/tests/tnc/tnccs-20-mutual-pt-tls/hosts/sun/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-mutual-pt-tls/hosts/sun/etc/strongswan.conf
index b596dbc1bf6561ed5da35b609e82c319bf7dbdcf..d7e33f52e661705f3a2325b969b9ac08db861427 100644 (file)
--- a/testing/tests/tnc/tnccs-20-mutual-pt-tls/hosts/sun/etc/strongswan.conf
+++ b/testing/tests/tnc/tnccs-20-mutual-pt-tls/hosts/sun/etc/strongswan.conf
@@ -24,7 +24,9 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256
+  ke_group = curve25519
 }
 
 libimcv {

diff --git a/testing/tests/tnc/tnccs-20-pdp-pt-tls/description.txt b/testing/tests/tnc/tnccs-20-pdp-pt-tls/description.txt
index 90e85485cbc67a90a73933a198da556c1fa469a9..9da98de2a97731aba1c690d53c1f059f45616c9d 100644 (file)
--- a/testing/tests/tnc/tnccs-20-pdp-pt-tls/description.txt
+++ b/testing/tests/tnc/tnccs-20-pdp-pt-tls/description.txt
@@ -1,7 +1,7 @@
 The PT-TLS (RFC 6876) clients <b>carol</b> and <b>dave</b> set up a connection each to the policy decision 
 point (PDP) <b>alice</b>. Endpoint <b>carol</b> uses password-based SASL PLAIN client authentication during the
 <b>PT-TLS negotiation phase</b> whereas endpoint <b>dave</b> uses certificate-based TLS client authentication
-during the <b>TLS setup phase</b>.
+during the <b>TLS setup phase</b>. In both connections TLS 1.3 is used.
 <p/>
 During the ensuing <b>PT-TLS data transport phase</b> the <b>OS</b> and <b>SWIMA</b> IMC/IMV pairs
 loaded by the PT-TLS clients and PDP, respectively, exchange PA-TNC (RFC 5792) messages

diff --git a/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/alice/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/alice/etc/strongswan.conf
index 04d7dbacc701b7cc2d515138f5501908444aa1d2..df8750c5a183ec05d2aaf3ff94eb482f5c97f03a 100644 (file)
--- a/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/alice/etc/strongswan.conf
+++ b/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/alice/etc/strongswan.conf
@@ -24,7 +24,8 @@ charon-systemd {
 }
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
 }
 
 libimcv {

diff --git a/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/carol/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/carol/etc/strongswan.conf
index 5aad0890572ef0e22c477781a49c31d18c4eab66..c9bc663ffa3619d8da2738732baa5a959806bc56 100644 (file)
--- a/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/carol/etc/strongswan.conf
+++ b/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/carol/etc/strongswan.conf
@@ -1,7 +1,8 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
 }
 
 libimcv {

diff --git a/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/dave/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/dave/etc/strongswan.conf
index cf08b969d4e8edecd8ef577c0729979e0f8c190d..408c35091ac716d4b60c7b29dfb7a89ff54f7311 100644 (file)
--- a/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/dave/etc/strongswan.conf
+++ b/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/dave/etc/strongswan.conf
@@ -19,7 +19,8 @@ libimcv {
 }
 
 libtls {
-  suites = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+  version_max = 1.3
+  suites = TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
 }
 
 pt-tls-client {