denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

charon-tkm: Don't use starter/stroke with charon-tkm anymore

Browse Source 
For the tests, the unused init script that was used before switching to
charon-systemd is repurposed to manage the daemon.
This commit is contained in:
Tobias Brunner
2021-01-11 15:28:01 +01:00
parent b322539ef5
commit 16fcdb460a
70 changed files with 449 additions and 342 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/tkm/multiple-clients/evaltest.dat
+5 -9
View File
@@ -1,11 +1,7 @@
sun::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*sun.strongswan.org.*carol.strongswan.org::YES
sun::ipsec stroke status 2> /dev/null::conn2.*ESTABLISHED.*sun.strongswan.org.*dave.strongswan.org::YES
carol::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*carol.strongswan.org.*sun.strongswan.org::YES
dave::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*dave.strongswan.org.*sun.strongswan.org::YES
sun::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES
sun::ipsec stroke status 2> /dev/null::conn2.*INSTALLED, TRANSPORT::YES
carol::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
dave::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
sun:: swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.100/32]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::conn2.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn2.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.200/32]::YES
carol::swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.100/32] remote-ts=\[192.168.0.2/32]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=dave@strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.200/32] remote-ts=\[192.168.0.2/32]::YES
carol::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
dave::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
carol::tcpdump::IP carol.strongswan.org > sun.strongswan.org: ESP::YES
@@ -15,7 +11,7 @@ dave::tcpdump::IP sun.strongswan.org > dave.strongswan.org: ESP::YES
sun::cat /tmp/tkm.log::RSA private key '/etc/tkm/sunKey.der' loaded::YES
sun::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.2 <-> 192.168.0.100 \]::YES
sun::cat /tmp/tkm.log::Adding policy \[ 2, 192.168.0.2 <-> 192.168.0.200 \]::YES
sun::cat /tmp/tkm.log | grep "Certificate chain of CC context 1 is valid" | wc -l::2::YES
sun::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::2
sun::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
sun::cat /tmp/tkm.log::Authentication of ISA context 2 successful::YES
sun::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.2 <-> 192.168.0.100, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
testing/tests/tkm/multiple-clients/hosts/carol/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
conn host-host
left=PH_IP_CAROL
leftcert=carolCert.pem
[email protected]
right=PH_IP_SUN
rightid=sun.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/multiple-clients/hosts/carol/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
}
testing/tests/tkm/multiple-clients/hosts/carol/etc/swanctl/swanctl.conf
+25
View File
@@ -0,0 +1,25 @@
connections {
host-host {
local_addrs = PH_IP_CAROL
remote_addrs = PH_IP_SUN
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
host-host {
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/multiple-clients/hosts/dave/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
conn host-host
left=PH_IP_DAVE
leftcert=daveCert.pem
[email protected]
right=PH_IP_SUN
rightid=sun.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
}
testing/tests/tkm/multiple-clients/hosts/dave/etc/swanctl/swanctl.conf
+25
View File
@@ -0,0 +1,25 @@
connections {
host-host {
local_addrs = PH_IP_DAVE
remote_addrs = PH_IP_SUN
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
host-host {
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/multiple-clients/hosts/sun/etc/strongswan.conf.in
+3
View File
@@ -11,4 +11,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX
}
}
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
}
testing/tests/tkm/multiple-clients/posttest.dat
+3 -3
View File
@@ -1,5 +1,5 @@
sun::DAEMON_NAME=charon-tkm ipsec stop
sun::service charon-tkm stop
sun::killall tkm_keymanager
sun::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
carol::ipsec stop
dave::ipsec stop
carol::systemctl stop strongswan
dave::systemctl stop strongswan
testing/tests/tkm/multiple-clients/pretest.dat
+10 -10
View File
@@ -1,14 +1,14 @@
sun::rm /etc/ipsec.secrets
sun::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
sun::cat /etc/ipsec.conf
sun::rm /etc/swanctl/rsa/*
sun::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
sun::cat /etc/swanctl/swanctl.conf
sun::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/sunKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
sun::expect-file /tmp/tkm.rpc.ike
sun::DAEMON_NAME=charon-tkm ipsec start
carol::ipsec start
sun::service charon-tkm start
carol::systemctl start strongswan
carol::expect-connection host-host
dave::ipsec start
dave::systemctl start strongswan
dave::expect-connection host-host
sun::DAEMON_NAME=charon-tkm expect-connection conn1
sun::DAEMON_NAME=charon-tkm expect-connection conn2
carol::ipsec up host-host
dave::ipsec up host-host
sun::expect-connection conn1
sun::expect-connection conn2
carol::swanctl --initiate --child host-host 2> /dev/null
dave::swanctl --initiate --child host-host 2> /dev/null
testing/tests/tkm/multiple-clients/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="carol dave"
# Used for IPsec logging purposes
#
IPSECHOSTS="carol dave sun"
# charon controlled by swanctl
#
SWANCTL=1