denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

charon-tkm: Don't use starter/stroke with charon-tkm anymore

Browse Source 
For the tests, the unused init script that was used before switching to
charon-systemd is repurposed to manage the daemon.
This commit is contained in:
Tobias Brunner
2021-01-11 15:28:01 +01:00
parent b322539ef5
commit 16fcdb460a
70 changed files with 449 additions and 342 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon-tkm/Makefile.am
+1 -1
View File
@@ -29,7 +29,7 @@ PLUGINS = \
pem \ pem \
socket-default \ socket-default \
openssl \ openssl \
stroke vici
all: build_charon all: build_charon
testing/hosts/default/etc/init.d/charon → testing/hosts/default/etc/init.d/charon-tkm
+6 -6
View File
@@ -1,12 +1,12 @@
#! /bin/sh #! /bin/sh
### BEGIN INIT INFO ### BEGIN INIT INFO
# Provides: charon # Provides: charon-tkm
# Required-Start: $remote_fs $syslog # Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog # Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5 # Default-Start: 2 3 4 5
# Default-Stop: 0 1 6 # Default-Stop: 0 1 6
# Short-Description: strongSwan charon IKE daemon # Short-Description: strongSwan charon-tkm IKE daemon
# Description: with swanctl the strongSwan charon daemon must be # Description: with swanctl the strongSwan charon-tkm daemon must be
# running in the background # running in the background
### END INIT INFO ### END INIT INFO
@@ -16,12 +16,12 @@
# PATH should only include /usr/* if it runs after the mountnfs.sh script # PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/bin:/usr/bin PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="strongSwan charon IKE daemon" DESC="strongSwan charon-tkm IKE daemon"
NAME=charon NAME=charon-tkm
DAEMON=/usr/local/libexec/ipsec/$NAME DAEMON=/usr/local/libexec/ipsec/$NAME
DAEMON_ARGS="" DAEMON_ARGS=""
PIDFILE=/var/run/$NAME.pid PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/charon SCRIPTNAME=/etc/init.d/charon-tkm
# Exit if the package is not installed # Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0 [ -x "$DAEMON" ] || exit 0
testing/scripts/recipes/010_tkm.mk
+1 -1
View File
@@ -2,7 +2,7 @@
PKG = tkm PKG = tkm
SRC = https://git.codelabs.ch/git/$(PKG).git SRC = https://git.codelabs.ch/git/$(PKG).git
REV = 8184cc0976a5b00c9d042bef2032223ae261f948 REV = b99aeb158b7701ea4a77184bff5ff38f8e26013a
export ADA_PROJECT_PATH=/usr/local/ada/lib/gnat export ADA_PROJECT_PATH=/usr/local/ada/lib/gnat
testing/tests/tkm/host2host-initiator/evaltest.dat
+3 -5
View File
@@ -1,7 +1,5 @@
moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
sun::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES
sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
@@ -11,7 +9,7 @@ moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
moon::DAEMON_NAME=charon-tkm ipsec down conn1 && sleep 1::no output expected::NO moon::swanctl --terminate --ike conn1 && sleep 1::no output expected::NO
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
testing/tests/tkm/host2host-initiator/hosts/moon/etc/strongswan.conf.in
+3
View File
@@ -11,4 +11,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX fingerprint = CA_SPK_HEX
} }
} }
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
} }
testing/tests/tkm/host2host-initiator/hosts/sun/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn host-host
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
right=PH_IP_MOON
rightid=moon.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/host2host-initiator/hosts/sun/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/host2host-initiator/hosts/sun/etc/swanctl/swanctl.conf
+25
View File
@@ -0,0 +1,25 @@
connections {
host-host {
local_addrs = PH_IP_SUN
remote_addrs = PH_IP_MOON
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
host-host {
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/host2host-initiator/posttest.dat
+2 -2
View File
@@ -1,4 +1,4 @@
moon::DAEMON_NAME=charon-tkm ipsec stop moon::service charon-tkm stop
moon::killall tkm_keymanager moon::killall tkm_keymanager
moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
sun::ipsec stop sun::systemctl stop strongswan
testing/tests/tkm/host2host-initiator/pretest.dat
+7 -7
View File
@@ -1,10 +1,10 @@
moon::rm /etc/ipsec.secrets moon::rm /etc/swanctl/rsa/*
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
moon::cat /etc/ipsec.conf moon::cat /etc/swanctl/swanctl.conf
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 & moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
moon::expect-file /tmp/tkm.rpc.ike moon::expect-file /tmp/tkm.rpc.ike
moon::DAEMON_NAME=charon-tkm ipsec start moon::service charon-tkm start
sun::ipsec start sun::systemctl start strongswan
sun::expect-connection host-host sun::expect-connection host-host
moon::DAEMON_NAME=charon-tkm expect-connection conn1 moon::expect-connection conn1
moon::DAEMON_NAME=charon-tkm ipsec up conn1 moon::swanctl --initiate --child conn1 2> /dev/null
testing/tests/tkm/host2host-initiator/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="sun"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon sun" IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tkm/host2host-responder/evaltest.dat
+2 -4
View File
@@ -1,7 +1,5 @@
moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
sun::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES
sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/tkm/host2host-responder/hosts/moon/etc/strongswan.conf.in
+3
View File
@@ -11,4 +11,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX fingerprint = CA_SPK_HEX
} }
} }
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
} }
testing/tests/tkm/host2host-responder/hosts/sun/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn host-host
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
right=PH_IP_MOON
rightid=moon.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
auto=add
type=transport
testing/tests/tkm/host2host-responder/hosts/sun/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/host2host-responder/hosts/sun/etc/swanctl/swanctl.conf
+25
View File
@@ -0,0 +1,25 @@
connections {
host-host {
local_addrs = PH_IP_SUN
remote_addrs = PH_IP_MOON
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
host-host {
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/host2host-responder/posttest.dat
+2 -2
View File
@@ -1,4 +1,4 @@
moon::DAEMON_NAME=charon-tkm ipsec stop moon::service charon-tkm stop
moon::killall tkm_keymanager moon::killall tkm_keymanager
moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
sun::ipsec stop sun::systemctl stop strongswan
testing/tests/tkm/host2host-responder/pretest.dat
+7 -7
View File
@@ -1,10 +1,10 @@
moon::rm /etc/ipsec.secrets moon::rm /etc/swanctl/rsa/*
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
moon::cat /etc/ipsec.conf moon::cat /etc/swanctl/swanctl.conf
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 & moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
moon::expect-file /tmp/tkm.rpc.ike moon::expect-file /tmp/tkm.rpc.ike
moon::DAEMON_NAME=charon-tkm ipsec start moon::service charon-tkm start
sun::ipsec start sun::systemctl start strongswan
sun::expect-connection host-host sun::expect-connection host-host
moon::DAEMON_NAME=charon-tkm expect-connection conn1 moon::expect-connection conn1
sun::ipsec up host-host sun::swanctl --initiate --child host-host 2> /dev/null
testing/tests/tkm/host2host-responder/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="sun"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon sun" IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tkm/host2host-xfrmproxy/evaltest.dat
+2 -4
View File
@@ -1,7 +1,5 @@
moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
sun::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES
sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/tkm/host2host-xfrmproxy/hosts/moon/etc/strongswan.conf.in
+3
View File
@@ -11,4 +11,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX fingerprint = CA_SPK_HEX
} }
} }
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
} }
testing/tests/tkm/host2host-xfrmproxy/hosts/sun/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn host-host
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
right=PH_IP_MOON
rightid=moon.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/host2host-xfrmproxy/hosts/sun/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/host2host-xfrmproxy/hosts/sun/etc/swanctl/swanctl.conf
+25
View File
@@ -0,0 +1,25 @@
connections {
host-host {
local_addrs = PH_IP_SUN
remote_addrs = PH_IP_MOON
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
host-host {
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/host2host-xfrmproxy/posttest.dat
+2 -2
View File
@@ -1,5 +1,5 @@
moon::DAEMON_NAME=charon-tkm ipsec stop moon::service charon-tkm stop
moon::killall xfrm_proxy moon::killall xfrm_proxy
moon::killall tkm_keymanager moon::killall tkm_keymanager
moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log
sun::ipsec stop sun::systemctl stop strongswan
testing/tests/tkm/host2host-xfrmproxy/pretest.dat
+7 -7
View File
@@ -1,12 +1,12 @@
sun::ipsec start sun::systemctl start strongswan
moon::rm /etc/ipsec.secrets moon::rm /etc/swanctl/rsa/*
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
moon::cat /etc/ipsec.conf moon::cat /etc/swanctl/swanctl.conf
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 & moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
moon::expect-file /tmp/tkm.rpc.ike moon::expect-file /tmp/tkm.rpc.ike
moon::DAEMON_NAME=charon-tkm ipsec start moon::service charon-tkm start
moon::expect-file /tmp/tkm.rpc.ees moon::expect-file /tmp/tkm.rpc.ees
moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 & moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 &
moon::DAEMON_NAME=charon-tkm expect-connection conn1 moon::expect-connection conn1
sun::expect-connection host-host sun::expect-connection host-host
moon::ping -c 3 192.168.0.2 moon::ping -c 3 -W 1 -i 0.2 192.168.0.2
testing/tests/tkm/host2host-xfrmproxy/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="sun"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon sun" IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tkm/multiple-clients/evaltest.dat
+5 -9
View File
@@ -1,11 +1,7 @@
sun::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*sun.strongswan.org.*carol.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.100/32]::YES
sun::ipsec stroke status 2> /dev/null::conn2.*ESTABLISHED.*sun.strongswan.org.*dave.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::conn2.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn2.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.200/32]::YES
carol::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*carol.strongswan.org.*sun.strongswan.org::YES carol::swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.100/32] remote-ts=\[192.168.0.2/32]::YES
dave::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*dave.strongswan.org.*sun.strongswan.org::YES dave:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=dave@strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.200/32] remote-ts=\[192.168.0.2/32]::YES
sun::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES
sun::ipsec stroke status 2> /dev/null::conn2.*INSTALLED, TRANSPORT::YES
carol::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
dave::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
carol::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES carol::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
dave::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES dave::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
carol::tcpdump::IP carol.strongswan.org > sun.strongswan.org: ESP::YES carol::tcpdump::IP carol.strongswan.org > sun.strongswan.org: ESP::YES
@@ -15,7 +11,7 @@ dave::tcpdump::IP sun.strongswan.org > dave.strongswan.org: ESP::YES
sun::cat /tmp/tkm.log::RSA private key '/etc/tkm/sunKey.der' loaded::YES sun::cat /tmp/tkm.log::RSA private key '/etc/tkm/sunKey.der' loaded::YES
sun::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.2 <-> 192.168.0.100 \]::YES sun::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.2 <-> 192.168.0.100 \]::YES
sun::cat /tmp/tkm.log::Adding policy \[ 2, 192.168.0.2 <-> 192.168.0.200 \]::YES sun::cat /tmp/tkm.log::Adding policy \[ 2, 192.168.0.2 <-> 192.168.0.200 \]::YES
sun::cat /tmp/tkm.log | grep "Certificate chain of CC context 1 is valid" | wc -l::2::YES sun::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::2
sun::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES sun::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
sun::cat /tmp/tkm.log::Authentication of ISA context 2 successful::YES sun::cat /tmp/tkm.log::Authentication of ISA context 2 successful::YES
sun::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.2 <-> 192.168.0.100, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES sun::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.2 <-> 192.168.0.100, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
testing/tests/tkm/multiple-clients/hosts/carol/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
conn host-host
left=PH_IP_CAROL
leftcert=carolCert.pem
[email protected]
right=PH_IP_SUN
rightid=sun.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/multiple-clients/hosts/carol/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/multiple-clients/hosts/carol/etc/swanctl/swanctl.conf
+25
View File
@@ -0,0 +1,25 @@
connections {
host-host {
local_addrs = PH_IP_CAROL
remote_addrs = PH_IP_SUN
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
host-host {
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/multiple-clients/hosts/dave/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
conn host-host
left=PH_IP_DAVE
leftcert=daveCert.pem
[email protected]
right=PH_IP_SUN
rightid=sun.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/multiple-clients/hosts/dave/etc/swanctl/swanctl.conf
+25
View File
@@ -0,0 +1,25 @@
connections {
host-host {
local_addrs = PH_IP_DAVE
remote_addrs = PH_IP_SUN
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
host-host {
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/multiple-clients/hosts/sun/etc/strongswan.conf.in
+3
View File
@@ -11,4 +11,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX fingerprint = CA_SPK_HEX
} }
} }
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
} }
testing/tests/tkm/multiple-clients/posttest.dat
+3 -3
View File
@@ -1,5 +1,5 @@
sun::DAEMON_NAME=charon-tkm ipsec stop sun::service charon-tkm stop
sun::killall tkm_keymanager sun::killall tkm_keymanager
sun::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log sun::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
carol::ipsec stop carol::systemctl stop strongswan
dave::ipsec stop dave::systemctl stop strongswan
testing/tests/tkm/multiple-clients/pretest.dat
+10 -10
View File
@@ -1,14 +1,14 @@
sun::rm /etc/ipsec.secrets sun::rm /etc/swanctl/rsa/*
sun::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd sun::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
sun::cat /etc/ipsec.conf sun::cat /etc/swanctl/swanctl.conf
sun::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/sunKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 & sun::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/sunKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
sun::expect-file /tmp/tkm.rpc.ike sun::expect-file /tmp/tkm.rpc.ike
sun::DAEMON_NAME=charon-tkm ipsec start sun::service charon-tkm start
carol::ipsec start carol::systemctl start strongswan
carol::expect-connection host-host carol::expect-connection host-host
dave::ipsec start dave::systemctl start strongswan
dave::expect-connection host-host dave::expect-connection host-host
sun::DAEMON_NAME=charon-tkm expect-connection conn1 sun::expect-connection conn1
sun::DAEMON_NAME=charon-tkm expect-connection conn2 sun::expect-connection conn2
carol::ipsec up host-host carol::swanctl --initiate --child host-host 2> /dev/null
dave::ipsec up host-host dave::swanctl --initiate --child host-host 2> /dev/null
testing/tests/tkm/multiple-clients/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="carol dave"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="carol dave sun" IPSECHOSTS="carol dave sun"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tkm/net2net-initiator/evaltest.dat
+2 -4
View File
@@ -1,7 +1,5 @@
moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
sun::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TUNNEL::YES
sun::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/tkm/net2net-initiator/hosts/moon/etc/strongswan.conf.in
+3
View File
@@ -11,4 +11,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX fingerprint = CA_SPK_HEX
} }
} }
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
} }
testing/tests/tkm/net2net-initiator/hosts/sun/etc/ipsec.conf
-23
View File
@@ -1,23 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
conn net-net
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
leftsubnet=10.2.0.0/16
right=PH_IP_MOON
rightid=moon.strongswan.org
rightsubnet=10.1.0.0/16
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
auto=add
testing/tests/tkm/net2net-initiator/hosts/sun/etc/strongswan.conf
+6 -3
View File
@@ -1,6 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
multiple_authentication = no }
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/net2net-initiator/hosts/sun/etc/swanctl/swanctl.conf
+26
View File
@@ -0,0 +1,26 @@
connections {
net-net {
local_addrs = PH_IP_SUN
remote_addrs = PH_IP_MOON
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
net-net {
local_ts = 10.2.0.0/16
remote_ts = 10.1.0.0/16
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/net2net-initiator/posttest.dat
+2 -2
View File
@@ -1,4 +1,4 @@
moon::DAEMON_NAME=charon-tkm ipsec stop moon::service charon-tkm stop
moon::killall tkm_keymanager moon::killall tkm_keymanager
moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
sun::ipsec stop sun::systemctl stop strongswan
testing/tests/tkm/net2net-initiator/pretest.dat
+7 -7
View File
@@ -1,10 +1,10 @@
moon::rm /etc/ipsec.secrets moon::rm /etc/swanctl/rsa/*
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
moon::cat /etc/ipsec.conf moon::cat /etc/swanctl/swanctl.conf
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 & moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
moon::expect-file /tmp/tkm.rpc.ike moon::expect-file /tmp/tkm.rpc.ike
moon::DAEMON_NAME=charon-tkm ipsec start moon::service charon-tkm start
sun::ipsec start sun::systemctl start strongswan
sun::expect-connection net-net sun::expect-connection net-net
moon::DAEMON_NAME=charon-tkm expect-connection conn1 moon::expect-connection conn1
moon::DAEMON_NAME=charon-tkm ipsec up conn1 moon::swanctl --initiate --child conn1 2> /dev/null
testing/tests/tkm/net2net-initiator/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="sun"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon sun" IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tkm/net2net-xfrmproxy/evaltest.dat
+2 -4
View File
@@ -1,7 +1,5 @@
moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
sun::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TUNNEL::YES
sun::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/tkm/net2net-xfrmproxy/hosts/moon/etc/strongswan.conf.in
+3
View File
@@ -11,4 +11,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX fingerprint = CA_SPK_HEX
} }
} }
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
} }
testing/tests/tkm/net2net-xfrmproxy/hosts/sun/etc/ipsec.conf
-23
View File
@@ -1,23 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
conn net-net
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
leftsubnet=10.2.0.0/16
right=PH_IP_MOON
rightid=moon.strongswan.org
rightsubnet=10.1.0.0/16
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
auto=add
testing/tests/tkm/net2net-xfrmproxy/hosts/sun/etc/strongswan.conf
+6 -3
View File
@@ -1,6 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
multiple_authentication = no }
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/net2net-xfrmproxy/hosts/sun/etc/swanctl/swanctl.conf
+26
View File
@@ -0,0 +1,26 @@
connections {
net-net {
local_addrs = PH_IP_SUN
remote_addrs = PH_IP_MOON
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
net-net {
local_ts = 10.2.0.0/16
remote_ts = 10.1.0.0/16
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/net2net-xfrmproxy/posttest.dat
+3 -2
View File
@@ -1,4 +1,5 @@
moon::DAEMON_NAME=charon-tkm ipsec stop moon::service charon-tkm stop
moon::killall xfrm_proxy
moon::killall tkm_keymanager moon::killall tkm_keymanager
moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log
sun::ipsec stop sun::systemctl stop strongswan
testing/tests/tkm/net2net-xfrmproxy/pretest.dat
+7 -7
View File
@@ -1,12 +1,12 @@
sun::ipsec start sun::systemctl start strongswan
moon::rm /etc/ipsec.secrets moon::rm /etc/swanctl/rsa/*
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
moon::cat /etc/ipsec.conf moon::cat /etc/swanctl/swanctl.conf
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 & moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
moon::expect-file /tmp/tkm.rpc.ike moon::expect-file /tmp/tkm.rpc.ike
moon::DAEMON_NAME=charon-tkm ipsec start moon::service charon-tkm start
moon::expect-file /tmp/tkm.rpc.ees moon::expect-file /tmp/tkm.rpc.ees
moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 & moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 &
moon::DAEMON_NAME=charon-tkm expect-connection conn1 moon::expect-connection conn1
sun::expect-connection net-net sun::expect-connection net-net
alice::ping -c 3 PH_IP_BOB alice::ping -c 3 -W 1 -i 0.2 PH_IP_BOB
testing/tests/tkm/net2net-xfrmproxy/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="sun"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon sun" IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tkm/xfrmproxy-expire/evaltest.dat
+4 -6
View File
@@ -1,8 +1,6 @@
moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
sun::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES moon::sleep 3::wait for rekeying::NO
sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::sleep 2::wait for rekeying::NO
moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES
moon::cat /var/log/daemon.log::ees: expire received for reqid 1, spi.*, dst 192.168.0.2::YES moon::cat /var/log/daemon.log::ees: expire received for reqid 1, spi.*, dst 192.168.0.2::YES
moon::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES moon::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES
@@ -20,7 +18,7 @@ moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
moon::cat /tmp/tkm.log::Creating first new ESA context with ID 1 (Isa 1, Sp 1, Ea 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES moon::cat /tmp/tkm.log::Creating first new ESA context with ID 1 (Isa 1, Sp 1, Ea 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 1, Sp 1, Ea 1, Dh_Id 1, Nc_Loc_Id 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 1, Sp 1, Ea 1, Dh_Id 1, Nc_Loc_Id 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES
moon::cat /tmp/tkm.log | grep 'Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 4, hard 60 \]' | wc -l::2::YES moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 4, hard 60 \]::2
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES
testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/strongswan.conf.in
+3
View File
@@ -13,4 +13,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX fingerprint = CA_SPK_HEX
} }
} }
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
} }
testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn host-host
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
right=PH_IP_MOON
rightid=moon.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/swanctl/swanctl.conf
+25
View File
@@ -0,0 +1,25 @@
connections {
host-host {
local_addrs = PH_IP_SUN
remote_addrs = PH_IP_MOON
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
host-host {
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/xfrmproxy-expire/posttest.dat
+2 -2
View File
@@ -1,5 +1,5 @@
moon::DAEMON_NAME=charon-tkm ipsec stop moon::service charon-tkm stop
moon::killall xfrm_proxy moon::killall xfrm_proxy
moon::killall tkm_keymanager moon::killall tkm_keymanager
moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log
sun::ipsec stop sun::systemctl stop strongswan
testing/tests/tkm/xfrmproxy-expire/pretest.dat
+7 -7
View File
@@ -1,12 +1,12 @@
sun::ipsec start sun::systemctl start strongswan
moon::rm /etc/ipsec.secrets moon::rm /etc/swanctl/rsa/*
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
moon::cat /etc/ipsec.conf moon::cat /etc/swanctl/swanctl.conf
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 & moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
moon::expect-file /tmp/tkm.rpc.ike moon::expect-file /tmp/tkm.rpc.ike
moon::DAEMON_NAME=charon-tkm ipsec start moon::service charon-tkm start
moon::expect-file /tmp/tkm.rpc.ees moon::expect-file /tmp/tkm.rpc.ees
moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 & moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 &
moon::DAEMON_NAME=charon-tkm expect-connection conn1 moon::expect-connection conn1
sun::expect-connection host-host sun::expect-connection host-host
moon::ping -c 3 192.168.0.2 moon::ping -c 3 -W 1 -i 0.2 192.168.0.2
testing/tests/tkm/xfrmproxy-expire/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="sun"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon sun" IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/tkm/xfrmproxy-rekey/evaltest.dat
+4 -6
View File
@@ -1,8 +1,6 @@
moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
sun::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES moon::sleep 3::wait for rekeying::NO
sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::sleep 2::wait for rekeying::NO
sun::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES sun::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
@@ -18,7 +16,7 @@ moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
moon::cat /tmp/tkm.log::Creating first new ESA context with ID 1 (Isa 1, Sp 1, Ea 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES moon::cat /tmp/tkm.log::Creating first new ESA context with ID 1 (Isa 1, Sp 1, Ea 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 1, Sp 1, Ea 1, Dh_Id 1, Nc_Loc_Id 1, Initiator FALSE, spi_loc.*, spi_rem.*)::YES moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 1, Sp 1, Ea 1, Dh_Id 1, Nc_Loc_Id 1, Initiator FALSE, spi_loc.*, spi_rem.*)::YES
moon::cat /tmp/tkm.log | grep 'Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]' | wc -l::2::YES moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::2
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES
testing/tests/tkm/xfrmproxy-rekey/hosts/moon/etc/strongswan.conf.in
+3
View File
@@ -13,4 +13,7 @@ charon-tkm {
fingerprint = CA_SPK_HEX fingerprint = CA_SPK_HEX
} }
} }
start-scripts {
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
}
} }
testing/tests/tkm/xfrmproxy-rekey/hosts/sun/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=10s
rekeymargin=6s
rekeyfuzz=0%
keyingtries=1
keyexchange=ikev2
conn host-host
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
right=PH_IP_MOON
rightid=moon.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/xfrmproxy-rekey/hosts/sun/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { swanctl {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown load = pem pkcs1 gmp x509 revocation random
}
charon-systemd {
load = aes sha1 sha2 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc vici kernel-netlink socket-default updown
} }
testing/tests/tkm/xfrmproxy-rekey/hosts/sun/etc/swanctl/swanctl.conf
+28
View File
@@ -0,0 +1,28 @@
connections {
host-host {
local_addrs = PH_IP_SUN
remote_addrs = PH_IP_MOON
proposals = aes256-sha512-modp4096
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
host-host {
life_time=10s
rekey_time=4s
rand_time=0
mode = transport
esp_proposals = aes256-sha512-modp4096
}
}
}
}
testing/tests/tkm/xfrmproxy-rekey/posttest.dat
+2 -2
View File
@@ -1,5 +1,5 @@
moon::DAEMON_NAME=charon-tkm ipsec stop moon::service charon-tkm stop
moon::killall xfrm_proxy moon::killall xfrm_proxy
moon::killall tkm_keymanager moon::killall tkm_keymanager
moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log
sun::ipsec stop sun::systemctl stop strongswan
testing/tests/tkm/xfrmproxy-rekey/pretest.dat
+7 -7
View File
@@ -1,12 +1,12 @@
sun::ipsec start sun::systemctl start strongswan
moon::rm /etc/ipsec.secrets moon::rm /etc/swanctl/rsa/*
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
moon::cat /etc/ipsec.conf moon::cat /etc/swanctl/swanctl.conf
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 & moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
moon::expect-file /tmp/tkm.rpc.ike moon::expect-file /tmp/tkm.rpc.ike
moon::DAEMON_NAME=charon-tkm ipsec start moon::service charon-tkm start
moon::expect-file /tmp/tkm.rpc.ees moon::expect-file /tmp/tkm.rpc.ees
moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 & moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 &
moon::DAEMON_NAME=charon-tkm expect-connection conn1 moon::expect-connection conn1
sun::expect-connection host-host sun::expect-connection host-host
moon::ping -c 3 192.168.0.2 moon::ping -c 3 -W 1 -i 0.2 192.168.0.2
testing/tests/tkm/xfrmproxy-rekey/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="sun"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon sun" IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1