denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adapted ikev2 uml scenarios for the 4.2 version

Browse Source
This commit is contained in:
Andreas Steffen
2008-04-01 20:05:02 +00:00
parent 372b7ac7e2
commit 158a62c326
27 changed files with 115 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/crl-from-cache/evaltest.dat
+8 -6
View File
@@ -1,8 +1,10 @@
moon::cat /var/log/daemon.log::loading crl file::YES
carol::cat /var/log/daemon.log::loading crl file::YES
moon::cat /var/log/daemon.log::loaded crl file::YES
moon::cat /var/log/daemon.log::crl is valid::YES
moon::cat /var/log/daemon.log::certificate status is good::YES
moon::ipsec listcrls:: ok::YES
carol::cat /var/log/daemon.log::loaded crl file::YES
carol::cat /var/log/daemon.log::crl is valid::YES
carol::cat /var/log/daemon.log::certificate status is good::YES
carol::ipsec listcrls:: ok::YES
moon::ipsec status::rw.*ESTABLISHED::YES
carol::ipsec status::home.*ESTABLISHED::YES
moon::cat /var/log/auth.log::written crl file::NO
carol::cat /var/log/auth.log::written crl file::NO
moon::ipsec listcrls:: ok::YES
carol::ipsec listcrls:: ok::YES
testing/tests/ikev2/crl-ldap/evaltest.dat
+8 -8
View File
@@ -1,12 +1,12 @@
moon::cat /var/log/daemon.log::loading crl file::YES
carol::cat /var/log/daemon.log::loading crl file::YES
moon::cat /var/log/daemon.log::loaded crl file::YES
moon::cat /var/log/daemon.log::crl is stale::YES
moon::cat /var/log/daemon.log::fetching crl from.*ldap::YES
moon::cat /var/log/daemon.log::crl is valid::YES
moon::cat /var/log/daemon.log::certificate status is good::YES
carol::cat /var/log/daemon.log::loaded crl file::YES
carol::cat /var/log/daemon.log::crl is stale::YES
moon::cat /var/log/daemon.log::sending ldap request::YES
carol::cat /var/log/daemon.log::sending ldap request::YES
carol::cat /var/log/daemon.log::fetching crl from.*ldap::YES
carol::cat /var/log/daemon.log::crl is valid::YES
carol::cat /var/log/daemon.log::certificate status is good::YES
moon::ipsec status::rw.*ESTABLISHED::YES
carol::ipsec status::home.*ESTABLISHED::YES
moon::cat /var/log/daemon.log::written crl file::YES
carol::cat /var/log/daemon.log::written crl file::YES
moon::ipsec listcrls:: ok::YES
carol::ipsec listcrls:: ok::YES
testing/tests/ikev2/crl-revoked/evaltest.dat
+2 -3
View File
@@ -1,6 +1,5 @@
moon::cat /var/log/daemon.log::certificate was revoked::YES
moon::cat /var/log/daemon.log::end entity certificate is not trusted::YES
carol::cat /var/log/daemon.log::AUTHENTICATION_FAILED::YES
moon::ipsec listcrls:: ok::YES
moon::cat /var/log/daemon.log::authentication of.*[email protected].*failed::YES
carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
moon::ipsec status::rw.*ESTABLISHED::NO
carol::ipsec status::home.*ESTABLISHED::NO
testing/tests/ikev2/multi-level-ca-ldap/evaltest.dat
+12 -3
View File
@@ -1,11 +1,20 @@
moon::cat /var/log/daemon.log::sending ldap request to::YES
moon::cat /var/log/daemon.log::received valid ldap response::YES
moon::cat /var/log/daemon.log::fetching crl from.*ldap.*Research CA::YES
moon::cat /var/log/daemon.log::crl correctly signed by.*Research CA::YES
moon::cat /var/log/daemon.log::fetching crl from.*ldap.*Sales CA::YES
moon::cat /var/log/daemon.log::crl correctly signed by.*Sales CA::YES
moon::cat /var/log/daemon.log::fetching crl from.*ldap.*strongSwan Root CA::YES
moon::cat /var/log/daemon.log::crl correctly signed by.*strongSwan Root CA::YES
carol::ipsec status::alice.*INSTALLED::YES
moon::ipsec status::alice.*ESTABLISHED.*[email protected]::YES
carol::cat /var/log/daemon.log::received TS_UNACCEPTABLE notify, no CHILD_SA built::YES
carol::ipsec status::venus.*INSTALLED::NO
moon::cat /var/log/daemon.log::constraint check failed: peer not authenticated by.*Sales CA::YES
moon::cat /var/log/daemon.log::traffic selectors PH_IP_VENUS/32 === PH_IP_CAROL/32.*inacceptable::YES
moon::ipsec status::venus.*ESTABLISHED.*[email protected]::NO
dave::ipsec status::venus.*INSTALLED::YES
moon::ipsec status::venus.*ESTABLISHED.*[email protected]::YES
dave::cat /var/log/daemon.log::received TS_UNACCEPTABLE notify, no CHILD_SA built::YES
dave::ipsec status::alice.*INSTALLED::NO
moon::cat /var/log/daemon.log::constraint check failed: peer not authenticated by.*Research CA::YES
moon::cat /var/log/daemon.log::traffic selectors PH_IP_ALICE/32 === PH_IP_DAVE/32.*inacceptable::YES
moon::ipsec status::alice.*ESTABLISHED.*[email protected]::NO
testing/tests/ikev2/multi-level-ca-revoked/evaltest.dat
-2
View File
@@ -1,6 +1,4 @@
moon::ipsec listcacerts --utc::status revoked on::YES
moon::cat /var/log/daemon.log::certificate was revoked::YES
moon::cat /var/log/daemon.log::received end entity certificate is not trusted::YES
moon::cat /var/log/daemon.log::authentication of.*[email protected].*failed::YES
carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
moon::ipsec status::alice.*ESTABLISHED::NO
testing/tests/ikev2/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf
+5
View File
@@ -5,6 +5,11 @@ config setup
strictcrlpolicy=yes
plutostart=no
ca strongswan
cacert=strongswanCert.pem
crluri=http://crl.strongswan.org/strongswan.crl
auto=add
conn %default
ikelifetime=60m
keylife=20m
testing/tests/ikev2/multi-level-ca/evaltest.dat
+8
View File
@@ -1,12 +1,20 @@
moon::cat /var/log/daemon.log::fetching crl from.*http.*research.crl::YES
moon::cat /var/log/daemon.log::crl correctly signed by.*Research CA::YES
moon::cat /var/log/daemon.log::fetching crl from.*http.*sales.crl::YES
moon::cat /var/log/daemon.log::crl correctly signed by.*Sales CA::YES
moon::cat /var/log/daemon.log::fetching crl from.*http.*strongswan.crl::YES
moon::cat /var/log/daemon.log::crl correctly signed by.*strongSwan Root CA::YES
carol::ipsec status::alice.*INSTALLED::YES
moon::ipsec status::alice.*ESTABLISHED.*[email protected]::YES
carol::cat /var/log/daemon.log::received TS_UNACCEPTABLE notify, no CHILD_SA built::YES
carol::ipsec status::venus.*INSTALLED::NO
moon::cat /var/log/daemon.log::constraint check failed: peer not authenticated by.*Sales CA::YES
moon::cat /var/log/daemon.log::traffic selectors PH_IP_VENUS/32 === PH_IP_CAROL/32.*inacceptable::YES
moon::ipsec status::venus.*ESTABLISHED.*[email protected]::NO
dave::ipsec status::venus.*INSTALLED::YES
moon::ipsec status::venus.*ESTABLISHED.*[email protected]::YES
dave::cat /var/log/daemon.log::received TS_UNACCEPTABLE notify, no CHILD_SA built::YES
dave::ipsec status::alice.*INSTALLED::NO
moon::cat /var/log/daemon.log::constraint check failed: peer not authenticated by.*Research CA::YES
moon::cat /var/log/daemon.log::traffic selectors PH_IP_ALICE/32 === PH_IP_DAVE/32.*inacceptable::YES
moon::ipsec status::alice.*ESTABLISHED.*[email protected]::NO
testing/tests/ikev2/multi-level-ca/hosts/moon/etc/ipsec.conf
-1
View File
@@ -1,7 +1,6 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2"
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
testing/tests/ikev2/ocsp-local-cert/evaltest.dat
+8 -4
View File
@@ -1,8 +1,12 @@
moon::cat /var/log/daemon.log::received valid http response::YES
carol::cat /var/log/daemon.log::received valid http response::YES
moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
moon::cat /var/log/daemon.log::requesting ocsp status from::YES
moon::cat /var/log/daemon.log::ocsp response correctly signed by::YES
moon::cat /var/log/daemon.log::ocsp response is valid::YES
moon::cat /var/log/daemon.log::certificate status is good::YES
carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
moon::cat /var/log/daemon.log::certificate is good::YES
carol::cat /var/log/daemon.log::certificate is good::YES
carol::cat /var/log/daemon.log::requesting ocsp status from::YES
carol::cat /var/log/daemon.log::ocsp response correctly signed by::YES
carol::cat /var/log/daemon.log::ocsp response is valid::YES
carol::cat /var/log/daemon.log::certificate status is good::YES
moon::ipsec status::rw.*ESTABLISHED::YES
carol::ipsec status::home.*ESTABLISHED::YES
testing/tests/ikev2/ocsp-multi-level/evaltest.dat
+3 -3
View File
@@ -1,9 +1,9 @@
moon::ipsec listocspcerts::altNames.*ocsp.*strongswan.org::YES
carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
dave::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
moon::cat /var/log/daemon.log::certificate is good::YES
carol::cat /var/log/daemon.log::certificate is good::YES
dave::cat /var/log/daemon.log::certificate is good::YES
moon::cat /var/log/daemon.log::certificate status is good::YES
carol::cat /var/log/daemon.log::certificate status is good::YES
dave::cat /var/log/daemon.log::certificate status is good::YES
moon::ipsec status::ESTABLISHED.*carol::YES
moon::ipsec status::ESTABLISHED.*dave::YES
carol::ipsec status::ESTABLISHED::YES
testing/tests/ikev2/ocsp-no-signer-cert/evaltest.dat
+4 -3
View File
@@ -1,5 +1,6 @@
moon::cat /var/log/daemon.log::received valid http response::YES
moon::cat /var/log/daemon.log::received certificate is no ocsp signer - rejected::YES
moon::cat /var/log/daemon.log::certificate status unknown::YES
moon::cat /var/log/daemon.log::requesting ocsp status from::YES
moon::cat /var/log/daemon.log::ocsp response verification failed::YES
moon::cat /var/log/daemon.log::certificate status is not available::YES
moon::cat /var/log/daemon.log::constraint check failed.*VALIDATION_FAILED.*VALIDATION_GOOD::YES
moon::ipsec status::rw.*ESTABLISHED::NO
carol::ipsec status::home.*ESTABLISHED::NO
testing/tests/ikev2/ocsp-no-signer-cert/posttest.dat
+1
View File
@@ -1,2 +1,3 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables -F
testing/tests/ikev2/ocsp-no-signer-cert/pretest.dat
+1
View File
@@ -1,3 +1,4 @@
moon::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP
moon::ipsec start
carol::ipsec start
carol::sleep 2
testing/tests/ikev2/ocsp-revoked/evaltest.dat
+4 -3
View File
@@ -1,6 +1,7 @@
moon::cat /var/log/daemon.log::received valid http response::YES
moon::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES
moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
moon::cat /var/log/daemon.log::requesting ocsp status from::YES
moon::cat /var/log/daemon.log::ocsp response correctly signed by::YES
moon::cat /var/log/daemon.log::certificate was revoked on::YES
moon::cat /var/log/daemon.log::authentication of.*[email protected].*with RSA signature failed
carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
moon::ipsec status::rw.*ESTABLISHED::NO
carol::ipsec status::home.*ESTABLISHED::NO
testing/tests/ikev2/ocsp-root-cert/evaltest.dat
+8 -4
View File
@@ -1,6 +1,10 @@
moon::cat /var/log/daemon.log::received valid http response::YES
carol::cat /var/log/daemon.log::received valid http response::YES
moon::cat /var/log/daemon.log::certificate is good::YES
carol::cat /var/log/daemon.log::certificate is good::YES
moon::cat /var/log/daemon.log::requesting ocsp status::YES
moon::cat /var/log/daemon.log::ocsp response correctly signed by::YES
moon::cat /var/log/daemon.log::ocsp response is valid::YES
moon::cat /var/log/daemon.log::certificate status is good::YES
carol::cat /var/log/daemon.log::requesting ocsp status::YES
carol::cat /var/log/daemon.log::ocsp response correctly signed by::YES
carol::cat /var/log/daemon.log::ocsp response is valid::YES
carol::cat /var/log/daemon.log::certificate status is good::YES
moon::ipsec status::rw.*ESTABLISHED::YES
carol::ipsec status::home.*ESTABLISHED::YES
testing/tests/ikev2/ocsp-signer-cert/description.txt
+1 -1
View File
@@ -4,7 +4,7 @@ is checked via the OCSP server <b>winnetou</b> which possesses an OCSP signer ce
issued by the strongSwan CA. This certificate contains an <b>OCSPSigning</b>
extended key usage flag. <b>carol</b>'s certificate includes an <b>OCSP URI</b>
in an authority information access extension pointing to <b>winnetou</b>.
Therefore no special ca section information is needed in ipsec.conf.
Therefore no special ca section information is needed in moon's ipsec.conf.
<p>
<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since
the status of both certificates is <b>good</b>.
testing/tests/ikev2/ocsp-signer-cert/evaltest.dat
+8 -9
View File
@@ -1,13 +1,12 @@
moon::ipsec listcainfos::ocspuris.*http://ocsp.strongswan.org::YES
carol::ipsec listcainfos::ocspuris.*http://ocsp.strongswan.org::YES
moon::cat /var/log/daemon.log::received valid http response::YES
carol::cat /var/log/daemon.log::received valid http response::YES
moon::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES
carol::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES
moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
moon::cat /var/log/daemon.log::certificate is good::YES
carol::cat /var/log/daemon.log::certificate is good::YES
moon::cat /var/log/daemon.log::requesting ocsp status::YES
moon::cat /var/log/daemon.log::ocsp response correctly signed by::YES
moon::cat /var/log/daemon.log::ocsp response is valid::YES
moon::cat /var/log/daemon.log::certificate status is good::YES
carol::cat /var/log/daemon.log::requesting ocsp status::YES
carol::cat /var/log/daemon.log::ocsp response correctly signed by::YES
carol::cat /var/log/daemon.log::ocsp response is valid::YES
carol::cat /var/log/daemon.log::certificate status is good::YES
moon::ipsec status::rw.*ESTABLISHED::YES
carol::ipsec status::home.*ESTABLISHED::YES
testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf
+5
View File
@@ -5,6 +5,11 @@ config setup
strictcrlpolicy=yes
plutostart=no
ca strongswan
cacert=strongswanCert.pem
ocspuri=http://ocsp.strongswan.org:8880
auto=add
conn %default
keyexchange=ikev2
ikelifetime=60m
testing/tests/ikev2/ocsp-strict-ifuri/evaltest.dat
+3 -2
View File
@@ -1,6 +1,7 @@
moon::cat /var/log/daemon.log::authentication of.*carol.*successful::YES
moon::cat /var/log/daemon.log::http post request using libcurl failed::YES
moon::cat /var/log/daemon.log::authentication of.*dave.*failed::YES
moon::cat /var/log/daemon.log::libcurl http request failed::YES
moon::cat /var/log/daemon.log::certificate status is not available::YES
moon::cat /var/log/daemon.log::constraint check failed.*VALIDATION_FAILED.*VALIDATION_SKIPPED::YES
moon::ipsec status::ESTABLISHED.*carol::YES
moon::ipsec status::ESTABLISHED.*dave::NO
carol::ipsec status::ESTABLISHED::YES
testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat
+10 -6
View File
@@ -1,9 +1,13 @@
moon::cat /var/log/daemon.log::http post request using libcurl failed::YES
carol::cat /var/log/daemon.log::http post request using libcurl failed::YES
moon::cat /var/log/daemon.log::received valid http response::YES
carol::cat /var/log/daemon.log::received valid http response::YES
moon::cat /var/log/daemon.log::certificate is good::YES
carol::cat /var/log/daemon.log::certificate is good::YES
moon::cat /var/log/daemon.log::libcurl http request failed::YES
moon::cat /var/log/daemon.log::ocsp request to.*ocsp2.strongswan.org:8880.*failed::YES
moon::cat /var/log/daemon.log::requesting ocsp status from.*ocsp.strongswan.org:8880::YES
moon::cat /var/log/daemon.log::ocsp response is valid::YES
moon::cat /var/log/daemon.log::certificate status is good::YES
carol::cat /var/log/daemon.log::libcurl http request failed::YES
carol::cat /var/log/daemon.log::ocsp request to.*bob.strongswan.org:8800.*failed::YES
carol::cat /var/log/daemon.log::requesting ocsp status from.*ocsp.strongswan.org:8880::YES
carol::cat /var/log/daemon.log::ocsp response is valid::YES
carol::cat /var/log/daemon.log::certificate status is good::YES
moon::ipsec status::rw.*ESTABLISHED::YES
carol::ipsec status::home.*ESTABLISHED::YES
testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf
+2 -1
View File
@@ -7,7 +7,8 @@ config setup
ca strongswan-ca
cacert=strongswanCert.pem
ocspuri2=http://bob.strongswan.org:8800
ocspuri1=http://bob.strongswan.org:8800
ocspuri2=http://ocsp.strongswan.org:8880
auto=add
conn %default
testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat
+3 -2
View File
@@ -1,5 +1,6 @@
moon::cat /var/log/daemon.log::http post request using libcurl failed::YES
moon::cat /var/log/daemon.log::certificate status unknown::YES
moon::cat /var/log/daemon.log::libcurl http request failed::YES
moon::cat /var/log/daemon.log::certificate status is not available::YES
moon::cat /var/log/daemon.log::constraint check failed::YES
carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED::YES
moon::ipsec status::rw.*ESTABLISHED::NO
carol::ipsec status::home.*ESTABLISHED::NO
testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat
+5 -3
View File
@@ -1,5 +1,7 @@
moon::cat /var/log/daemon.log::received valid http response::YES
moon::cat /var/log/daemon.log::received ocsp signer certificate is not trusted - rejected::YES
moon::cat /var/log/daemon.log::certificate status unknown::YES
moon::cat /var/log/daemon.log::requesting ocsp status from::YES
moon::cat /var/log/daemon.log::self-signed certificate.*is not trusted::YES
moon::cat /var/log/daemon.log::ocsp response verification failed::YES
moon::cat /var/log/daemon.log::certificate status is not available::YES
moon::cat /var/log/daemon.log::constraint check failed.*VALIDATION_FAILED.*VALIDATION_GOOD::YES
moon::ipsec status::rw.*ESTABLISHED::NO
carol::ipsec status::home.*ESTABLISHED::NO
testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat
+1
View File
@@ -1,2 +1,3 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables -F
testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat
+1
View File
@@ -1,3 +1,4 @@
moon::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP
moon::ipsec start
carol::ipsec start
carol::sleep 2
testing/tests/ikev2/two-certs/evaltest.dat
+4 -3
View File
@@ -1,6 +1,7 @@
moon::cat /var/log/daemon.log::candidate peer certificate was not successfully verified::YES
moon::cat /var/log/daemon.log::candidate peer certificate has a non-matching RSA public key::YES
moon::cat /var/log/daemon.log::candidate peer certificate has a matching RSA public key::YES
moon::cat /var/log/daemon.log::certificate was revoked::YES
moon::cat /var/log/daemon.log::authentication of.*[email protected].*with RSA signature successful::YES
moon::cat /var/log/daemon.log::signature validation failed, looking for another key::YES
moon::cat /var/log/daemon.log::authentication of.*[email protected].*with RSA signature successful::YES
moon::ipsec statusall::carol.*ESTABLISHED::YES
moon::ipsec statusall::dave.*ESTABLISHED::YES
carol::ipsec statusall::home.*ESTABLISHED::YES
testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf
-1
View File
@@ -1,7 +1,6 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2"
crlcheckinterval=180
strictcrlpolicy=yes
plutostart=no