denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Migrated openssl alg-ecp-high scenarios

Browse Source
This commit is contained in:
Andreas Steffen
2018-11-09 11:52:59 +01:00
parent a4c085978c
commit 21735750df
28 changed files with 202 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/openssl-ikev1/alg-ecp-high/description.txt
+2 -2
View File
@@ -10,8 +10,8 @@ to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>
ECP_256 and ECP_521. Since <b>moon</b> does not support ECP_256 the roadwarriors ECP_256 and ECP_521. Since <b>moon</b> does not support ECP_256 the roadwarriors
fall back to ECP_384 and ECP_521, respectively. fall back to ECP_384 and ECP_521, respectively.
<p> <p>
Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b> Upon the successful establishment of the IPsec tunnels, the updown script automatically
automatically inserts iptables-based firewall rules that let pass the tunneled traffic. inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
the client <b>alice</b> behind the gateway <b>moon</b>. the client <b>alice</b> behind the gateway <b>moon</b>.
testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat
+4 -10
View File
@@ -1,15 +1,9 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384::YES
dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=1 state=ESTABLISHED local-host=192.168.0.100 local-port=500 [email protected] remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192 prf-alg=PRF_HMAC_SHA2_384 dh-group=ECP_384.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=192.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=1 state=ESTABLISHED local-host=192.168.0.200 local-port=500 [email protected] remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=ECP_521.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=256.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=1 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=500 [email protected].*encr-alg=AES_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192 prf-alg=PRF_HMAC_SHA2_384 dh-group=ECP_384.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=192.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=1 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=500 [email protected].*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=ECP_521.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=256.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/openssl-ikev1/alg-ecp-high/hosts/carol/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
ike=aes128-sha256-ecp256,aes192-sha384-ecp384!
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
[email protected]
rightsubnet=10.1.0.0/16
auto=add
testing/tests/openssl-ikev1/alg-ecp-high/hosts/carol/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = pem pkcs1 openssl curl revocation random nonce hmac stroke kernel-netlink socket-default updown load = random nonce pem pkcs1 openssl curl revocation vici kernel-netlink socket-default updown
} }
testing/tests/openssl-ikev1/alg-ecp-high/hosts/carol/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256,aes192gcm16-ecp384
}
}
version = 1
proposals = aes128-sha256-ecp256,aes192-sha384-ecp384
}
}
testing/tests/openssl-ikev1/alg-ecp-high/hosts/dave/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
ike=aes128-sha256-ecp256,aes256-sha512-ecp521!
conn home
left=PH_IP_DAVE
leftcert=daveCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
[email protected]
rightsubnet=10.1.0.0/16
auto=add
testing/tests/openssl-ikev1/alg-ecp-high/hosts/dave/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = aes des sha1 sha2 md5 pem pkcs1 gmp pem pkcs1 x509 openssl curl revocation random nonce hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 gmp pem pkcs1 hmac x509 openssl curl revocation vici kernel-netlink socket-default updown
} }
testing/tests/openssl-ikev1/alg-ecp-high/hosts/dave/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256,aes256gcm16-ecp521
}
}
version = 1
proposals = aes128-sha256-ecp256,aes256-sha512-ecp521
}
}
testing/tests/openssl-ikev1/alg-ecp-high/hosts/moon/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
ike=aes192-sha384-ecp384,aes256-sha512-ecp521!
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
[email protected]
leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any
auto=add
testing/tests/openssl-ikev1/alg-ecp-high/hosts/moon/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = pem pkcs1 openssl curl revocation random nonce hmac stroke kernel-netlink socket-default updown load = random nonce pem pkcs1 openssl curl revocation vici kernel-netlink socket-default updown
} }
testing/tests/openssl-ikev1/alg-ecp-high/hosts/moon/etc/swanctl/swanctl.conf
Executable
+25
View File
@@ -0,0 +1,25 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes192gcm16-ecp384,aes256gcm16-ecp521
}
}
version = 1
proposals = aes192-sha384-ecp384,aes256-sha512-ecp521
}
}
testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat
+3 -3
View File
@@ -1,6 +1,6 @@
moon::ipsec stop carol::systemctl stop strongswan-swanctl
carol::ipsec stop dave::systemctl stop strongswan-swanctl
dave::ipsec stop moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush dave::iptables-restore < /etc/iptables.flush
testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat
+5 -5
View File
@@ -1,11 +1,11 @@
moon::iptables-restore < /etc/iptables.rules moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules dave::iptables-restore < /etc/iptables.rules
moon::ipsec start moon::systemctl start strongswan-swanctl
carol::ipsec start carol::systemctl start strongswan-swanctl
dave::ipsec start dave::systemctl start strongswan-swanctl
moon::expect-connection rw moon::expect-connection rw
carol::expect-connection home carol::expect-connection home
carol::ipsec up home carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home dave::expect-connection home
dave::ipsec up home dave::swanctl --initiate --child home 2> /dev/null
testing/tests/openssl-ikev1/alg-ecp-high/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon carol dave" IPSECHOSTS="moon carol dave"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/openssl-ikev2/alg-ecp-high/description.txt
+2 -2
View File
@@ -10,8 +10,8 @@ to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>
ECP_256 and ECP_521. Since <b>moon</b> does not support ECP_256 the roadwarriors ECP_256 and ECP_521. Since <b>moon</b> does not support ECP_256 the roadwarriors
fall back to ECP_384 and ECP_521, respectively. fall back to ECP_384 and ECP_521, respectively.
<p> <p>
Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b> Upon the successful establishment of the IPsec tunnels, the updown script automatically
automatically inserts iptables-based firewall rules that let pass the tunneled traffic. inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
the client <b>alice</b> behind the gateway <b>moon</b>. the client <b>alice</b> behind the gateway <b>moon</b>.
testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat
+4 -10
View File
@@ -1,17 +1,11 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
moon:: ipsec status 2> /dev/null::rw\[4]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
carol::cat /var/log/daemon.log::ECP_256.*ECP_384::YES carol::cat /var/log/daemon.log::ECP_256.*ECP_384::YES
dave:: cat /var/log/daemon.log::ECP_256.*ECP_521::YES dave:: cat /var/log/daemon.log::ECP_256.*ECP_521::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384::YES
dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192 prf-alg=PRF_HMAC_SHA2_384 dh-group=ECP_384.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=192.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=ECP_521.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=256.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192 prf-alg=PRF_HMAC_SHA2_384 dh-group=ECP_384.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=192.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 4 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=ECP_521.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=256.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/openssl-ikev2/alg-ecp-high/hosts/carol/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-sha256-ecp256,aes192-sha384-ecp384!
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
[email protected]
rightsubnet=10.1.0.0/16
auto=add
testing/tests/openssl-ikev2/alg-ecp-high/hosts/carol/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = pem pkcs1 openssl curl revocation random nonce hmac stroke kernel-netlink socket-default updown load = random nonce pem pkcs1 openssl curl revocation vici kernel-netlink socket-default updown
} }
testing/tests/openssl-ikev2/alg-ecp-high/hosts/carol/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256,aes192gcm16-ecp384
}
}
version = 2
proposals = aes128-sha256-ecp256,aes192-sha384-ecp384
}
}
testing/tests/openssl-ikev2/alg-ecp-high/hosts/dave/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-sha256-ecp256,aes256-sha512-ecp521!
conn home
left=PH_IP_DAVE
leftcert=daveCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
[email protected]
rightsubnet=10.1.0.0/16
auto=add
testing/tests/openssl-ikev2/alg-ecp-high/hosts/dave/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = aes des sha1 sha2 md5 pem pkcs1 gmp pem pkcs1 x509 openssl curl revocation random nonce hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 gmp pem pkcs1 hmac x509 openssl curl revocation vici kernel-netlink socket-default updown
} }
testing/tests/openssl-ikev2/alg-ecp-high/hosts/dave/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm16-ecp256,aes256gcm16-ecp521
}
}
version = 2
proposals = aes128-sha256-ecp256,aes256-sha512-ecp521
}
}
testing/tests/openssl-ikev2/alg-ecp-high/hosts/moon/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes192-sha384-ecp384,aes256-sha512-ecp521!
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
[email protected]
leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any
auto=add
testing/tests/openssl-ikev2/alg-ecp-high/hosts/moon/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = pem pkcs1 openssl curl revocation random nonce hmac stroke kernel-netlink socket-default updown load = random nonce pem pkcs1 openssl curl revocation vici kernel-netlink socket-default updown
} }
testing/tests/openssl-ikev2/alg-ecp-high/hosts/moon/etc/swanctl/swanctl.conf
Executable
+25
View File
@@ -0,0 +1,25 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes192gcm16-ecp384,aes256gcm16-ecp521
}
}
version = 2
proposals = aes192-sha384-ecp384,aes256-sha512-ecp521
}
}
testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat
+3 -3
View File
@@ -1,6 +1,6 @@
moon::ipsec stop carol::systemctl stop strongswan-swanctl
carol::ipsec stop dave::systemctl stop strongswan-swanctl
dave::ipsec stop moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush dave::iptables-restore < /etc/iptables.flush
testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat
+5 -5
View File
@@ -1,11 +1,11 @@
moon::iptables-restore < /etc/iptables.rules moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules dave::iptables-restore < /etc/iptables.rules
moon::ipsec start moon::systemctl start strongswan-swanctl
carol::ipsec start carol::systemctl start strongswan-swanctl
dave::ipsec start dave::systemctl start strongswan-swanctl
moon::expect-connection rw moon::expect-connection rw
carol::expect-connection home carol::expect-connection home
carol::ipsec up home carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home dave::expect-connection home
dave::ipsec up home dave::swanctl --initiate --child home 2> /dev/null
testing/tests/openssl-ikev2/alg-ecp-high/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon carol dave" IPSECHOSTS="moon carol dave"
# charon controlled by swanctl
#
SWANCTL=1