From: Andreas Steffen Date: Mon, 16 Aug 2010 17:29:39 +0000 (+0200) Subject: describe EAP-TTLS phase2 start options using the phase2_piggyback parameter X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f9a2d4bfcbf697abbf4c90234b5e7bf0d88d1db1;p=people%2Fms%2Fstrongswan.git describe EAP-TTLS phase2 start options using the phase2_piggyback parameter --- diff --git a/testing/tests/ikev2/rw-eap-ttls-only/description.txt b/testing/tests/ikev2/rw-eap-ttls-only/description.txt index 702598e72..3d4c3ab87 100644 --- a/testing/tests/ikev2/rw-eap-ttls-only/description.txt +++ b/testing/tests/ikev2/rw-eap-ttls-only/description.txt @@ -2,5 +2,10 @@ The roadwarriors carol and dave set up a connection each to gatewa The strong mutual authentication is based on EAP-TTLS only (without a separate IKEv2 authentication) with the gateway being authenticated by a server certificate during the EAP-TLS tunnel setup (phase1 of EAP-TTLS). This tunnel protects the ensuing weak client -authentication based on EAP-MD5 (phase2 of EAP-TTLS). carol presents the -correct MD5 password and succeeds whereas dave chooses the wrong password and fails. +authentication based on EAP-MD5 (phase2 of EAP-TTLS). +

+With the default setting charon.plugins.eap-ttls.phase2_piggyback = no the server +moon passively waits for the clients to initiate phase2 of the EAP-TTLS protocol by +sending a tunneled orphan EAP Identity response upon the reception of the server's TLS +Finished message. Client carol presents the correct MD5 password and succeeds +whereas client dave chooses the wrong password and fails. diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/description.txt b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/description.txt index 9624fa709..d5f0b267a 100644 --- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/description.txt +++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/description.txt @@ -2,7 +2,9 @@ The roadwarriors carol and dave set up a connection each to gatewa The strong mutual authentication is based on EAP-TTLS only (without a separate IKEv2 authentication) with the gateway being authenticated by a server certificate during the EAP-TLS tunnel setup (phase1 of EAP-TTLS). This tunnel protects the ensuing weak client -authentication based on EAP-MD5 (phase2 of EAP-TTLS). The server moon -piggybacks the tunneled EAP Identity request which starts phase2 of EAP-TTLS right onto -the TLS Finished message. carol presents the correct MD5 password and succeeds -whereas dave chooses the wrong password and fails. +authentication based on EAP-MD5 (phase2 of EAP-TTLS). +

+With the setting charon.plugins.eap-ttls.phase2_piggyback = yes the server moon +initiates phase2 of the EAP-TTLS protocol by piggybacking a tunneled EAP Identity request +right onto the TLS Finished message. Client carol presents the correct MD5 password +and succeeds whereas client dave chooses the wrong password and fails.