From 117375ed00f67e86e759bd79de027d91e386e2b3 Mon Sep 17 00:00:00 2001
From: Reto Buerki <reet@codelabs.ch>
Date: Tue, 22 Jan 2013 20:52:55 +0100
Subject: [PATCH] Add initial TKM integration test

A connection between the hosts moon and sun is set up. The host moon
uses the Trusted Key Manager (TKM) and is the initiator of the transport
connection. The authentication is based on X.509 certificates.
---
 .../tkm/host2host-initiator/description.txt   |   3 +++
 .../tkm/host2host-initiator/evaltest.dat      |  12 ++++++++++
 .../hosts/moon/etc/tkm/moonKey.der            | Bin 0 -> 1191 bytes
 .../hosts/moon/etc/tkm/strongswanCert.der     | Bin 0 -> 956 bytes
 .../hosts/moon/etc/tkm/tkm.conf               |  21 ++++++++++++++++++
 .../hosts/sun/etc/ipsec.conf                  |  20 +++++++++++++++++
 .../hosts/sun/etc/strongswan.conf             |   5 +++++
 .../tkm/host2host-initiator/posttest.dat      |   4 ++++
 .../tests/tkm/host2host-initiator/pretest.dat |  10 +++++++++
 .../tests/tkm/host2host-initiator/test.conf   |  21 ++++++++++++++++++
 10 files changed, 96 insertions(+)
 create mode 100644 testing/tests/tkm/host2host-initiator/description.txt
 create mode 100644 testing/tests/tkm/host2host-initiator/evaltest.dat
 create mode 100644 testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/moonKey.der
 create mode 100644 testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/strongswanCert.der
 create mode 100644 testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/tkm.conf
 create mode 100644 testing/tests/tkm/host2host-initiator/hosts/sun/etc/ipsec.conf
 create mode 100644 testing/tests/tkm/host2host-initiator/hosts/sun/etc/strongswan.conf
 create mode 100644 testing/tests/tkm/host2host-initiator/posttest.dat
 create mode 100644 testing/tests/tkm/host2host-initiator/pretest.dat
 create mode 100644 testing/tests/tkm/host2host-initiator/test.conf

diff --git a/testing/tests/tkm/host2host-initiator/description.txt b/testing/tests/tkm/host2host-initiator/description.txt
new file mode 100644
index 000000000..467693b1e
--- /dev/null
+++ b/testing/tests/tkm/host2host-initiator/description.txt
@@ -0,0 +1,3 @@
+A connection between the hosts <b>moon</b> and <b>sun</b> is set up. The host
+<b>moon</b> uses the Trusted Key Manager (TKM) and is the initiator of the
+transport connection. The authentication is based on X.509 certificates.
diff --git a/testing/tests/tkm/host2host-initiator/evaltest.dat b/testing/tests/tkm/host2host-initiator/evaltest.dat
new file mode 100644
index 000000000..d8d44dff6
--- /dev/null
+++ b/testing/tests/tkm/host2host-initiator/evaltest.dat
@@ -0,0 +1,12 @@
+moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES
+sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
+moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
+moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
+moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES
+moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
+moon::cat /tmp/tkm.log::Adding SA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
diff --git a/testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/moonKey.der b/testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/moonKey.der
new file mode 100644
index 0000000000000000000000000000000000000000..97f0963f893bb5ed4c3c3c1c88fe041089fe4717
GIT binary patch
literal 1191
zcmV;Y1X%kpf&`-i0RRGm0RaHYFJnE_ySfF2AzKxoF)wrVGZIe=Gn<;>JGMx$D@;a?
z4*}*d`|pw&dv^%++yCl*Nn(bUZFQ{iJJsYjdKe+tE#U&{-<e~yi3A!851)3oo*_`G
zIRXwpr7CBAyN8^ZVv*$WR4?N2Nlu(xl}%5ob)kBvwPsTBv2Od^v}Tw0(6{v<yqN+8
zHd#2*%`x)6?J(zIrECJ(+=B4U@5$6ON4BYtb||jWtP*-kl>~#2X6I3UUJC|t$QD#|
zyyl7bI&a3~$15yFNsZgQ3m33S6<}}aPbF-}cf>4HMPUEC<*LouM9ht}(yOnEDN6NQ
z1E!!FRM&(st9Uq<Q^JP=0|5X50)hbmAVmlD>S{aseYyQBs&TJ9Ho1HTnWq;5)kqG5
z^LjO=T`mv<iFNFH$qr|wN_bwBGONqU=U{mgtvvgheK13T!&@&pqxvKzLBC9-OLwN<
z@79q*s;GvicZmrHla0p9JC`5o28xAB7f0LxAlAc-AB?`mFxN*3o&nF$>m2X$uy?%&
zs_#jOw^fv3OBSbii5f0R18LH!R~_G6(Pc9hIH;q^VT7n9p0$X|t2@7|oDX-lY=aKZ
z4=GK-wt8PSw_ZL8UL<&A@tU#{{l7Hel2aDS6T?EZx<*dVlhUZ;p6(>wW8K}8fdQ%X
zxbWVPc3vDG+FWAcVa#zSl&-F!0)c@5_+4P8nFL3YZK123xA2su)HSgmaK--lR2qrk
zSeO72kk8y@8;T>$zv$<^tkNZSZvknY2EJP5tHfy!>6?N5pEjPCG&lRpqVL<`+;4-4
z`zz;;I7jsGQzNp+wzj0mT%f9QWG6>MPeWMny73CJbNR#aPL_060eRixJZvP50)c@5
z&}NhCT#~lc7WOc=n;V$wIS|Xl#6qNZoZ)X<34&aOj-=nrO*8JZ<ldJWf2Go)Q|YKa
zW%p8ir+bs{!dI3Kt=P_6SLKk|7@kxnQm!_4#v?R3Il<9wzVil@2I{1dKI@=v3Oe)1
zQ=Pp_=h@2h%+^${IeO>%rz@x<<gg%P0)c@5?<>UeN%Djh?|VD1(>+^wVdfs5e^fje
z&@>82Kq!b1Vp_QisJxql1>gLle07#w@JaOXp;y>q$;pSmDj;>r&GMu`NvaFcYa{-n
z|4L`-jWri^uAn5a_3tmR0W{lmlQyYMB|~ZL*t@Ggk5;A(g88TighYVebZ%}8`cTc)
z0)c>gGT7-qt-uBn@9}o&Y!oL88$rtr*7MPRUCQmho?t=PMB&7)GcZ32;|JpNX+180
zBi4Z=*kjx)N~8A<C8r?(X7&FI<U5cHytTA`7F|BeR8DZoYAO4@@qdR5+q3iKg?KLY
zKT4Fh(Y<k98|0nh4<@=~Vxu<;l7w)}rO!_Sfq*hk`p<A)XGZry(ogoP3$aSARm-Fv
zw{?zez||i>{;X?CMV#YwuR=nH_5!eBMIZ;8Lu-zZ&EVbtXOjf!@7;8w|G(zs;k^<z
z!(c%_Ehbjr3qCxu7glz0zjLP|q9Wz!T@at*$9%6@QT4g>7aVj-`f-2f=`du7=BtM^
F5}2C3S5W`}

literal 0
HcmV?d00001

diff --git a/testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/strongswanCert.der b/testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/strongswanCert.der
new file mode 100644
index 0000000000000000000000000000000000000000..a5a631f4b5f8b29a990ab4b075e44e0d961c6286
GIT binary patch
literal 956
zcmXqLV%}lU#I#@mGZP~d6C;BGFB_*;n@8JsUPeZ4Rt5uCLv903Hs(+kHen`b4?{@<
zaS(?~SimPUue3s;xTGjQFFm+CG0#xiKoTUyEG&c&R0zt?FHvxIG>{YLH83%-G&C?Y
zFfcT<h!W>Dv^20ZFo$xfWla;K60!#vSs9p{82K3tni#p5niv@w_J4{`dSx4y7qR(7
zmFKC?YZA||OfE0>ZPDHQ<8R&q<?kDW_0rS=gba(@ist0jI92t|7ps0~@#6J5ZK0i!
z#=G8|Efzg|_mj%GC%b1~tq_i7Nw-kbOp^bZ-Rt`80n<|sv!pu@8yjLoxb1ab+BdIz
zd?NAuH-W|T89Pr~+0^XZU#G<x;-^^fewD=EEB_UKP1z@&TmR;NlYGX-!XOse*=`@s
zpFjBIyz{+Sd#i}@<n=Gr>Vr3m&D^Z!e>5hr^J|7ip;*q&X7;J9nJMy%`F{u86ZU_r
zKi%fNl%<AxoA!~rtETVXAma3B@)3c83q>kd_PMW94}Puv*8AYCiO2emHylag=VxMO
zWMEv}xXGY#y@3!gwq%7F8UM3z7_b2;CPqdBZjcy13kxtYuo=jLID9N(EF!VX?-sBH
z8r41Dmb-cD(+3H!^nBkN<btG?S<(zr8n7x@=()t5O7Yr+kuHJJ%E+KRY1Tr<EkYN+
zE-epM==j9B*?q=xz3Y23U9Wq;TC{m#S$oRb`flDIH>;%VE(+*PTKbXwG3(qzs@zZJ
zGO5X|urkr(i+z5@#=OMO{@h~8a)ncZEmz)8dA9F0uZp<ahMn5=8yS2!UUdI_?emP^
zPGm~j=a+x%XY6_6`NiYsmDH!&ksk!)l9<o0<?VcA%K3}M)<=j*uHR^1?T$@vcil>n
zO<5(yvOZ<eyXZ!*Qrqj<29NKtd_J~KFzuPq4>RAu^X3LC!@PVa?^LSM*f5(vbm~p5
zWc{Ll0keeWtb7-8Uz_hvj;%$Qzkq7qpBwv{HoZxiUT2jb_hH7X<saCRmYsbocDf<C
F1^~+-XHozF

literal 0
HcmV?d00001

diff --git a/testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/tkm.conf b/testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/tkm.conf
new file mode 100644
index 000000000..2619c0089
--- /dev/null
+++ b/testing/tests/tkm/host2host-initiator/hosts/moon/etc/tkm/tkm.conf
@@ -0,0 +1,21 @@
+<tkmconfig>
+    <local_identity id="1">
+        <identity>moon.strongswan.org</identity>
+        <certificate>moonCert.pem</certificate>
+    </local_identity>
+    <policy id="1">
+        <mode>transport</mode>
+        <local>
+            <identity_id>1</identity_id>
+            <ip>192.168.0.1</ip>
+        </local>
+        <remote>
+            <identity>sun.strongswan.org</identity>
+            <ip>192.168.0.2</ip>
+        </remote>
+        <lifetime>
+            <soft>30</soft>
+            <hard>60</hard>
+        </lifetime>
+    </policy>
+</tkmconfig>
diff --git a/testing/tests/tkm/host2host-initiator/hosts/sun/etc/ipsec.conf b/testing/tests/tkm/host2host-initiator/hosts/sun/etc/ipsec.conf
new file mode 100644
index 000000000..4ad0aa7db
--- /dev/null
+++ b/testing/tests/tkm/host2host-initiator/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn host-host
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=sun.strongswan.org
+	right=PH_IP_MOON
+	rightid=moon.strongswan.org
+	ike=aes256-sha512-modp4096!
+	esp=aes256-sha512-modp4096!
+	auto=add
diff --git a/testing/tests/tkm/host2host-initiator/hosts/sun/etc/strongswan.conf b/testing/tests/tkm/host2host-initiator/hosts/sun/etc/strongswan.conf
new file mode 100644
index 000000000..dc937641c
--- /dev/null
+++ b/testing/tests/tkm/host2host-initiator/hosts/sun/etc/strongswan.conf
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
+}
diff --git a/testing/tests/tkm/host2host-initiator/posttest.dat b/testing/tests/tkm/host2host-initiator/posttest.dat
new file mode 100644
index 000000000..34037bc23
--- /dev/null
+++ b/testing/tests/tkm/host2host-initiator/posttest.dat
@@ -0,0 +1,4 @@
+moon::DAEMON_NAME=charon-tkm ipsec stop
+moon::killall tkm_keymanager
+moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
+sun::ipsec stop
diff --git a/testing/tests/tkm/host2host-initiator/pretest.dat b/testing/tests/tkm/host2host-initiator/pretest.dat
new file mode 100644
index 000000000..7cb90ac26
--- /dev/null
+++ b/testing/tests/tkm/host2host-initiator/pretest.dat
@@ -0,0 +1,10 @@
+moon::rm /etc/ipsec.secrets
+moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
+moon::cat /etc/ipsec.conf
+moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der >/tmp/tkm.log 2>&1 &
+moon::expect-file /tmp/tkm.rpc.ike
+moon::DAEMON_NAME=charon-tkm ipsec start
+sun::ipsec start
+sun::expect-connection host-host
+moon::DAEMON_NAME=charon-tkm expect-connection conn1
+moon::DAEMON_NAME=charon-tkm ipsec up conn1
diff --git a/testing/tests/tkm/host2host-initiator/test.conf b/testing/tests/tkm/host2host-initiator/test.conf
new file mode 100644
index 000000000..9647dc6a2
--- /dev/null
+++ b/testing/tests/tkm/host2host-initiator/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="moon winnetou sun"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"