From 277ef8c2fa506e0152d33f615d2b5d3acfd633be Mon Sep 17 00:00:00 2001 From: Andreas Steffen Date: Wed, 10 Aug 2016 14:19:32 +0200 Subject: [PATCH] testing: Added ikev2/rw-newhope-bliss scenario --- testing/scripts/recipes/013_strongswan.mk | 3 +- .../ikev2/rw-newhope-bliss/description.txt | 15 ++++++++++ .../tests/ikev2/rw-newhope-bliss/evaltest.dat | 26 ++++++++++++++++++ .../hosts/carol/etc/ipsec.conf | 26 ++++++++++++++++++ .../ipsec.d/cacerts/strongswan_blissCert.der | Bin 0 -> 2086 bytes .../carol/etc/ipsec.d/certs/carolCert.der | Bin 0 -> 2175 bytes .../carol/etc/ipsec.d/private/carolKey.der | Bin 0 -> 1182 bytes .../hosts/carol/etc/ipsec.secrets | 3 ++ .../hosts/carol/etc/strongswan.conf | 7 +++++ .../hosts/dave/etc/ipsec.conf | 26 ++++++++++++++++++ .../ipsec.d/cacerts/strongswan_blissCert.der | Bin 0 -> 2086 bytes .../hosts/dave/etc/ipsec.d/certs/daveCert.der | Bin 0 -> 2179 bytes .../dave/etc/ipsec.d/private/daveKey.der | Bin 0 -> 1310 bytes .../hosts/dave/etc/ipsec.secrets | 3 ++ .../hosts/dave/etc/strongswan.conf | 7 +++++ .../hosts/moon/etc/ipsec.conf | 26 ++++++++++++++++++ .../ipsec.d/cacerts/strongswan_blissCert.der | Bin 0 -> 2086 bytes .../hosts/moon/etc/ipsec.d/certs/moonCert.der | Bin 0 -> 2200 bytes .../moon/etc/ipsec.d/private/moonKey.der | Bin 0 -> 1310 bytes .../hosts/moon/etc/ipsec.secrets | 3 ++ .../hosts/moon/etc/strongswan.conf | 7 +++++ .../tests/ikev2/rw-newhope-bliss/posttest.dat | 9 ++++++ .../tests/ikev2/rw-newhope-bliss/pretest.dat | 14 ++++++++++ .../tests/ikev2/rw-newhope-bliss/test.conf | 21 ++++++++++++++ 24 files changed, 195 insertions(+), 1 deletion(-) create mode 100644 testing/tests/ikev2/rw-newhope-bliss/description.txt create mode 100644 testing/tests/ikev2/rw-newhope-bliss/evaltest.dat create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.conf create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.d/cacerts/strongswan_blissCert.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.d/certs/carolCert.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.d/private/carolKey.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/strongswan.conf create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.conf create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/cacerts/strongswan_blissCert.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/certs/daveCert.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/private/daveKey.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/strongswan.conf create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.d/cacerts/strongswan_blissCert.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.d/certs/moonCert.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.d/private/moonKey.der create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/ikev2/rw-newhope-bliss/posttest.dat create mode 100644 testing/tests/ikev2/rw-newhope-bliss/pretest.dat create mode 100644 testing/tests/ikev2/rw-newhope-bliss/test.conf diff --git a/testing/scripts/recipes/013_strongswan.mk b/testing/scripts/recipes/013_strongswan.mk index f205df33b..5c4fdd829 100644 --- a/testing/scripts/recipes/013_strongswan.mk +++ b/testing/scripts/recipes/013_strongswan.mk @@ -99,7 +99,8 @@ CONFIG_OPTS = \ --enable-ntru \ --enable-lookip \ --enable-bliss \ - --enable-sha3 + --enable-sha3 \ + --enable-newhope export ADA_PROJECT_PATH=/usr/local/ada/lib/gnat diff --git a/testing/tests/ikev2/rw-newhope-bliss/description.txt b/testing/tests/ikev2/rw-newhope-bliss/description.txt new file mode 100644 index 000000000..eb7678496 --- /dev/null +++ b/testing/tests/ikev2/rw-newhope-bliss/description.txt @@ -0,0 +1,15 @@ +The roadwarriors carol and dave set up a connection each to gateway moon. +The IKEv2 key exchange is based on the NewHope lattice-based post-quantum algorithm +with a cryptographical strength of 128 bits. Authentication is based on the BLISS +algorithm with strengths 128 bits (BLISS I), 160 bits (BLISS III) and 192 bits (BLISS IV) for +carol, dave and moon, respectively. +

+Both carol and dave request a virtual IP via the IKEv2 configuration payload +by using the leftsourceip=%config parameter. The gateway moon assigns virtual +IP addresses from a simple pool defined by rightsourceip=10.3.0.0/28 in a monotonously +increasing order. +

+leftfirewall=yes automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnels, carol and dave then ping +the client alice behind the gateway moon. The source IP addresses of the two +pings will be the virtual IPs carol1 and dave1, respectively. diff --git a/testing/tests/ikev2/rw-newhope-bliss/evaltest.dat b/testing/tests/ikev2/rw-newhope-bliss/evaltest.dat new file mode 100644 index 000000000..a2df0a3c0 --- /dev/null +++ b/testing/tests/ikev2/rw-newhope-bliss/evaltest.dat @@ -0,0 +1,26 @@ +carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with BLISS_WITH_SHA2_512 successful::YES +carol::ipsec statusall 2> /dev/null::home.*IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/NEWHOPE_128::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES +carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES +dave::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with BLISS_WITH_SHA2_512 successful::YES +dave:: ipsec statusall 2> /dev/null::home.*IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/NEWHOPE_128::YES +dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES +dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES +moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with BLISS_WITH_SHA2_256 successful::YES +moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with BLISS_WITH_SHA2_384 successful::YES +moon:: ipsec statusall 2> /dev/null::rw\[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/NEWHOPE_128::YES +moon:: ipsec statusall 2> /dev/null::rw\[2]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/NEWHOPE_128::YES +moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::ESP +moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::ESP +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES +alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES +alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..6f561ab50 --- /dev/null +++ b/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=yes + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + ike=aes256-sha256-newhope128! + esp=aes256-sha256! + authby=pubkey + fragmentation=yes + +conn home + left=PH_IP_CAROL + leftsourceip=%config + leftcert=carolCert.der + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.d/cacerts/strongswan_blissCert.der b/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.d/cacerts/strongswan_blissCert.der new file mode 100644 index 0000000000000000000000000000000000000000..fdfd39f138368750d6d2dc478ce4823851ef2023 GIT binary patch literal 2086 zcmb`Hc{~#iAIEoLbK7Pzx4DmOOLG@v5_8TZqM2)>pL5HP4(28*%A%P2$WcOSQ*x9m zmFQ7FJheQ|Us05frJpDN^?E)3K7V~*@6YFt@9X==_l-@5YGczO!&P7q5Cnokls1$d zC~G3DoVb*+I1mC%uQCz?1H}MXcbpU!CJv@T#1SAz7n}-Kc^4!R@I+QZY)m92DI`YI zD8>5E$|jNf;k><6`&-8{~iC| z>(as1SoCiv0fD~(2ntRIa{#>wnbd#}jSx!&H5Pds*;*O>H|eFtv7C#Ve_YdiVVDMD zPIu6DTue2-T~MB5E2%0r!uMJ91Wal$`Cn}Q3NtpBR66!N75=)jf2KarW#p6sW=aT; z`?ivqeV~E%r*OfzJQ1(;h(^`DE*9WG%?``|sJd9QL@xpWs(jHKtnc*50AxX|;xVz? zCaen%Vt1~2$@R4A>6r5x^ZeDdf@gJU@Q&5fAJ~v5o^g)`gBt!BR^j_`iQR;k59aP1 zRp9iv=|_nHA8p-g0CmDO%Lm2M3RGA`?tK(3$ju^ z-7s6%>vifv9zT!DngBY^TB>grz`2-0f8-Xw#BZq5s=0JV4#rUU{CFLhV^=4`IB0|{ zyuU|m%Cl0XM5b|+Inm7!y?iL^gi&mxK5+Y&*#v1HAo`1-ivc!?|KaMUTgSULiL2bS>heif3$Y4vS8lW_K@e<5-vLqW zu-7HpS1v16!&H_h-I(Gfj__tr9p3w^4N`-0s%I+pg_BVL#grpr)vp7`3IYX-5><>; z6-%-r(O>2^@al1o3D>RUfm^9Xo$bs8D#qY3<(X<6eMOsD@vPQLe$;K83n)T0_$C*e zB=l8W#4qOK^V>?=N_W)qj{tjXoS&Sbj6Y^bh9eP}*#Z&7NL*ni_5sj-6)rId zyR2T=(gwCN&s!t-$DYee5A)^{?@ULyoXVA9^NUvPT)s>Uz)nS^$t70u>bw83_BCv_xCF`G1a!&2qw{)~?bunU(zNrdiIU%IVI?a*A8}$Atvr?8qKx zWc8C0T3B2hskce1JVfuPqt}N*1$dyj3`f-m16Y@Tkp)Zn+$6K18e*sS>4`K3_fdfr zRMXMB)$F!%xP$*$o?ABQlTyi-mJG9wzw!80Q1Csydh6ha=QWK zm!ib6YP&28K|zo!p&UQA=tx6Iki~WT(&W|Y%(pK8wxO$6-E(V#Neh^({fH0SnP zt@<@@Dy0rcV(sDa9e@{h2A?>ntec#K`PvZ48o{`!Cq)P2_g2_nYUK^nwAvrI4`0*$ zX2TUUNw_Bw3g8-tQ_2iU(A>;Ri)QQFeQJ-cx<3z@PBJ7%`0D!@-_04li1AFFnwgV= zG|MwY!A;T=Mm&I#E0yk2WH!XB(K&=!9*UyeXL&e#NLZ~N{85d(z^=_xS0gz~Y&+Wt zlpNs804GQFK#zxDXx-l--IsUjBRZ!%lp4Uo^U69R?O||A|Ia+yRDt~*e>3Cyd<}rS z%=_zx_Am*MB)=9V4FGV-AmQ0_@ib-8b4rfg_MwIHPW?N}>-dgXE$epErR23-8PbXU zXxW|u{V_|2R*TcK=;cDZ&)x3s)1~ncd-Ifu14XsXikq@M><#f$4#Huym}lE3@F@yl zMAOhvJPCT}lipY0n*sWS`b9Q*G0X3n?B|swqRC^LFxUuA`f*aLrVyJKGA224E-7YK z;ZObJq*wgBKDzWnL0nMDP8Qg!uwda8I6=)8U0zZ z35_8oW=Bre@7=!TI9MjCC(czIRZ_?{I+;+JVHpX>(V*Gnu|<_ftzWc3uS&;@GocYB zh7Wh{XO?z2aX?nEp)e!)+k|)6`&xSQa0ypCQdL{Vg9{@8sDq;KX4!td{Ym-;BzR9b zC^~w$4!%w6zNg$_OK%Q`Oprs>M`*>yxB}G+$y?bV?N&NLS+mR<>_wFt)Y{^plZ5tV z7{~BBn+|J02Yhq_xG}-)QIj5ZC5>|Ws7$?p2{k6UCXKVWY3r&)6;Q#;t literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.d/certs/carolCert.der b/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.d/certs/carolCert.der new file mode 100644 index 0000000000000000000000000000000000000000..8a520c0b4e5cedeefd6c775637615623bbea39b5 GIT binary patch literal 2175 zcmb7^dpy&NAI9xsNVHrx8k04Y%h&yqnM>~QdG<>rPHEQr%r$T`n`U?f6kxJ>v>+U=lT5cc>~#!nLxI zE4!OV96LRLEima_Fc1`!U9(dh0umPk2!_&t6b!N-3X=yrxEQJe$nRp4yj*e$H6fnt zofa04_M|3IB1tKR8i4wD6C#iJ$+UNO_4Y;+6B1I;4t9W=vW%fAU~Xh?Xl`t5WD=+> zV+8ypfdl`d4i3nEualOS_|f5Nhyqmq8K9s*3Zo{(+Wwf4{B5It0+kG8L%4v-PX~fP zKMAlnBpX5#b8cBV(|s_ihmUi4egLN%s-L=Xnv=hzw4-hYX^Y@W4IxYDsmMoC<(*`p z7NZt9N;Y}xqzx*83i6XEEbE?@>P8BSl*%O9SKicd3&;z_*!R_R>|^H%F}g+Mb2>u| z$0ji`tA3t|eSX-husF;qvBdka8oKT8RE~I=UaOP=?(b6O>5J882wsb zmY1dC!(}Xc9-F7f#zJ}r;!eS1pcHI<@k%(IdyYx^_%!AQO*7*C=vjqrN#9z~*9x1n+u0sH9Tk>Us$qndXwi6{svJNf zPTgJvCG}A3^63qouaPDoX&gbtxh)6VHX4w7oe*A?OUfSZgI!fK18nqOq;YNOeii$# zUk`t(&ghWmrkRJ;1@4K0x)!6*+}Uv<@jlVPEmTyuDf&`FWJ9!iUfR1&wCbSRtje_E zuCPyg(FV><$Y*)hQ4&4yh0+q*4*W}SX^>yUD;=s%d^x{iJWK7K@w=`?j_kSljBVi| zYFBXMFdwW%WithGbEo^1t77xTINjNn4AC2pP|>eXG@7V53%`L>7%C%chTH2dq)*(b z;RKNr?Pn371wh{EGIg%#MRExc>08F}ZZpNMH?1<9L>c$(x}xXtA2rb`)^$42&RnEA zZ@R`Y_?RVi^fgq`7!6v^Wd45G>B<(-%1W-gul%J#Ix6Eej&w@8O;^;nAqMj3osug( z!FUvb>_M)k0rA9_ALHb^sPn{&w*)a-utiixf-JCez$9!h%hOjD+!hb%{ zU(IlEDMs0S9-d+Gu)7AGtRiMTBkjg`!5;my9)7?rxECb+So-o8j=~xgbD}i(NZ+a5!9^7z2~Z|4)#Aej6c)=TYr39(O0p2A0jSyx1x+bO?;84D~2%2wsdp&)UvilwWp#H!$}O3i!g z`b^d-0Q(PFUu4%9SucD&l;9!=As~8HyoQpB75d?z+N_e)z}}UsMsFAM;Z}u);dC{Q z&4q{E?Uyn=if{wzC32F0=8VY!u?}MJg9ar>tGc}!qe1VJv|WDAl?Q7;h#vDet`yYDxYtFKO*)GB>_T9E2JtLXD& z#7q0&D^^l8<8X|}c7M#Yw>V95ng+iP-i*yDsp32?plfs1iMLOi^H=Bvnn88y{!hVo z8zIR@^507~swP}k*xO@Q0h_<$6+bd^oMI$n(ec>WSvWYA^ob->dvjXVHnrRFfbGK+*mIAi#sC|F$%n(E=9}=^HmqlT%dIFFg=lM;V?24WNwwMssR_JQvz1sN~ zIl_>;)JWJrA1w`tJk$lFcdjkbXyz^ssel?(p^ENMe(8v8Yy-c=ZHW+R1Zu`y>Of(4 zPvPTd`cq$HSvTcJ=>;dL%FvVqL`OVSBdNk(t@81E@m3B4!f6mcjmDwqaB?( zw+d&>u5cDYyWKN-8 zCLpcc%PcQHg9VF0_12qg{@yhUf$%~2Um~{#P<$;>I&)!8eHhs!+<@wqopLjq;@7N> z;Q^nnEjLng!P?Q(p=viKo?^8SB_un?4zmulFL1VEh@qK{WB1!>y@4ZS^VOFW9C0Qf ztsuINtAeqRPrkIAIi4F~O{{46*M=JsFk@2Q$m{`ezG^{>h^DpX88iV4Jxv-%u7f77 z)menRO=6yeV}j7Y2Du(KFg`8eccDOtSDaP6ykgrQinJ4zI~-B|qW< zm|Rz6_EovUgC!zxVPNfoQFZ7k%h zdHCl~VEC}vA*ymcI9J7X1|4~TWJFOppsl?a6;r50qZamMzeD0k>PWeFlAPn zl2fiVCi<%JibnW(%|W+l=|A@)AR0WRDFn5I86T@`rGA$g-s6Ul@))M92A zIx;{onqwa#en@}Mp^97{=yn}wSpahSlpZ-I{zIznl?9TTT~@`$kOP5%0005p0002Y z006`Q0|3kr5EMW&5COo$@BkeX00RUN0dogH0Wbp)05k*y!0-hy7sCX>01ylS5CH%X z05HRFbU*+wRMcDmGXnr~P!tD1%)mt-F~9%=00aOG05CiO001yR000mi05Ai<07L)) z1H}ZvG&2AI#0(D|06+mT`~!i30MGys00Rd^F${B53{1dJ0K@=53i zA3*>^0RI3G8~_vy08hX$&_GN;006*1Fb^>Y0RRwO%s>D!0}ucJ09OD6JU|3M!2|$A wKmY_&!wdvK6ac`$KnDN-3_ZXDK*I$A1VIb|Ffb7SGywn%1OsqD01N=bFmb=)-2eap literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..c2225646d --- /dev/null +++ b/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: BLISS carolKey.der diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..32eaea5c1 --- /dev/null +++ b/testing/tests/ikev2/rw-newhope-bliss/hosts/carol/etc/strongswan.conf @@ -0,0 +1,7 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = random nonce aes sha1 sha2 sha3 chapoly newhope bliss x509 revocation pem pkcs1 curl hmac stroke kernel-netlink socket-default updown + send_vendor_id = yes + fragment_size = 1500 +} diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.conf new file mode 100644 index 000000000..caf99ddf0 --- /dev/null +++ b/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=yes + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + ike=aes256-sha256-newhope128! + esp=aes256-sha256! + authby=pubkey + fragmentation=yes + +conn home + left=PH_IP_DAVE + leftsourceip=%config + leftcert=daveCert.der + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/cacerts/strongswan_blissCert.der b/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/cacerts/strongswan_blissCert.der new file mode 100644 index 0000000000000000000000000000000000000000..fdfd39f138368750d6d2dc478ce4823851ef2023 GIT binary patch literal 2086 zcmb`Hc{~#iAIEoLbK7Pzx4DmOOLG@v5_8TZqM2)>pL5HP4(28*%A%P2$WcOSQ*x9m zmFQ7FJheQ|Us05frJpDN^?E)3K7V~*@6YFt@9X==_l-@5YGczO!&P7q5Cnokls1$d zC~G3DoVb*+I1mC%uQCz?1H}MXcbpU!CJv@T#1SAz7n}-Kc^4!R@I+QZY)m92DI`YI zD8>5E$|jNf;k><6`&-8{~iC| z>(as1SoCiv0fD~(2ntRIa{#>wnbd#}jSx!&H5Pds*;*O>H|eFtv7C#Ve_YdiVVDMD zPIu6DTue2-T~MB5E2%0r!uMJ91Wal$`Cn}Q3NtpBR66!N75=)jf2KarW#p6sW=aT; z`?ivqeV~E%r*OfzJQ1(;h(^`DE*9WG%?``|sJd9QL@xpWs(jHKtnc*50AxX|;xVz? zCaen%Vt1~2$@R4A>6r5x^ZeDdf@gJU@Q&5fAJ~v5o^g)`gBt!BR^j_`iQR;k59aP1 zRp9iv=|_nHA8p-g0CmDO%Lm2M3RGA`?tK(3$ju^ z-7s6%>vifv9zT!DngBY^TB>grz`2-0f8-Xw#BZq5s=0JV4#rUU{CFLhV^=4`IB0|{ zyuU|m%Cl0XM5b|+Inm7!y?iL^gi&mxK5+Y&*#v1HAo`1-ivc!?|KaMUTgSULiL2bS>heif3$Y4vS8lW_K@e<5-vLqW zu-7HpS1v16!&H_h-I(Gfj__tr9p3w^4N`-0s%I+pg_BVL#grpr)vp7`3IYX-5><>; z6-%-r(O>2^@al1o3D>RUfm^9Xo$bs8D#qY3<(X<6eMOsD@vPQLe$;K83n)T0_$C*e zB=l8W#4qOK^V>?=N_W)qj{tjXoS&Sbj6Y^bh9eP}*#Z&7NL*ni_5sj-6)rId zyR2T=(gwCN&s!t-$DYee5A)^{?@ULyoXVA9^NUvPT)s>Uz)nS^$t70u>bw83_BCv_xCF`G1a!&2qw{)~?bunU(zNrdiIU%IVI?a*A8}$Atvr?8qKx zWc8C0T3B2hskce1JVfuPqt}N*1$dyj3`f-m16Y@Tkp)Zn+$6K18e*sS>4`K3_fdfr zRMXMB)$F!%xP$*$o?ABQlTyi-mJG9wzw!80Q1Csydh6ha=QWK zm!ib6YP&28K|zo!p&UQA=tx6Iki~WT(&W|Y%(pK8wxO$6-E(V#Neh^({fH0SnP zt@<@@Dy0rcV(sDa9e@{h2A?>ntec#K`PvZ48o{`!Cq)P2_g2_nYUK^nwAvrI4`0*$ zX2TUUNw_Bw3g8-tQ_2iU(A>;Ri)QQFeQJ-cx<3z@PBJ7%`0D!@-_04li1AFFnwgV= zG|MwY!A;T=Mm&I#E0yk2WH!XB(K&=!9*UyeXL&e#NLZ~N{85d(z^=_xS0gz~Y&+Wt zlpNs804GQFK#zxDXx-l--IsUjBRZ!%lp4Uo^U69R?O||A|Ia+yRDt~*e>3Cyd<}rS z%=_zx_Am*MB)=9V4FGV-AmQ0_@ib-8b4rfg_MwIHPW?N}>-dgXE$epErR23-8PbXU zXxW|u{V_|2R*TcK=;cDZ&)x3s)1~ncd-Ifu14XsXikq@M><#f$4#Huym}lE3@F@yl zMAOhvJPCT}lipY0n*sWS`b9Q*G0X3n?B|swqRC^LFxUuA`f*aLrVyJKGA224E-7YK z;ZObJq*wgBKDzWnL0nMDP8Qg!uwda8I6=)8U0zZ z35_8oW=Bre@7=!TI9MjCC(czIRZ_?{I+;+JVHpX>(V*Gnu|<_ftzWc3uS&;@GocYB zh7Wh{XO?z2aX?nEp)e!)+k|)6`&xSQa0ypCQdL{Vg9{@8sDq;KX4!td{Ym-;BzR9b zC^~w$4!%w6zNg$_OK%Q`Oprs>M`*>yxB}G+$y?bV?N&NLS+mR<>_wFt)Y{^plZ5tV z7{~BBn+|J02Yhq_xG}-)QIj5ZC5>|Ws7$?p2{k6UCXKVWY3r&)6;Q#;t literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/certs/daveCert.der b/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/certs/daveCert.der new file mode 100644 index 0000000000000000000000000000000000000000..75a114339ab20f3e9b5b03e23bb16ee7719dd5dc GIT binary patch literal 2179 zcmb7^dpOe#AI8mQhU74rmE&kKncvJg!eX*bCdbHeF^4f>l4o8vhn$jSPSKOY5<){1 z$)T5$s1(wXBB4S;^y=xY=lSF5z25hq_s`FDf3NGlzkl2}z=b6NT(O| z%9Vhxk5PaOR7w{Lf`GW?7%?zNOaySmNdXd2up0yl7d>zgw+lf21WCAjOl&kWlJ0UM zAX1$g%?t~o#o{yowVxswuJnsYpg6d=s2^rBW7QAX0ICRSoDpDRV1hF-1n_2F2x$Z0 z7X*&}A9nJ9>`yx>xWr!`4h{}DWnkx@5ftFZ0^)+K|H={bBP5m?O$WH(iXZylAA&%? zfT%c_3+9LfMY0jf5p~-O?wAIT0frZeU|cQP>imG=?n7J5ZB2^7AD8w~t)^}c-ovBu zX;1QOvvim(Qsp0yr3S^l3IxkwBCdxvKo9zS(N;t`cpfg7ZG(5vvfL)jJa37r3Rtqw zofD7L@wk}bIyt!h6H=bas&&pgH2LItp?Z z{bCZPmjE&Qco%7faLK-wfzhSwRPtpU`lGubl6qZu+W!VhAzd-WGwm~MJCGrbQcpT=9b=TG&qsJquzzk~v!5aXvP=iJ%^Rj8mu zH9)u{Ym*ug;zJJ(WO8d(vj(1rOv?94*YJ*9`+YF8J$zeV8fe9SH%}ri58|d>4EAn* zk-|iGN-na$Fs5qkunhk60N(`-AKA5dx%5-!zuInRBW<1t*rV6t-O!vzYD2L||NQx# zx1k>?Z&9#UII;S#0AZm1YY0*6=rOJ1H`gbIO9;>@I!o^#rHfjJUxjkQJJc7(3Mzh^ zp}KxQL^)!JLpR)=YHD3Zg)(ULUf~n|K$6Id68@2gjU<$O6K{Bql#6+kr)zv|)nhf3 zY>^+Q{LcHGa=njk%EYL4+rz7K)J9~Ac@ZpQ7*XxsEM!U5X(UfZ@%YJmxtPkVq5v|) zxApr&-N?eOO3xnIILvAEhszPEnP_5JL!w!O?PKey?hE^G?kJRzDLsEmR39tO>(KwC zBqA9uy}n{_`D?b9WwFwO zF_7854(2$*-(Nyg2jWu2Ndq|CKbJ&B6QTqtCM(R*IPTw0q}IClw|#m zkDjZ@K@h+W&j0MX)lXdwVhR`ohUEt3Ksq)gHa5y!U!NAu!2ahh=>Ls=fsD|Y80?Rm z|C+)d>p&4{ZA|q4vie{U(rZMFaAWI1lQi=}!14fwiQSJxpMu7bijct>E9b zm89kt`rk-tn0bu3r(PD-a04fVIaCz%v&osrmNPMt*4LH2o*b>J>lP8kk4^Fgn~cP$ z8>J$PuyA@Mk}$fNu3PW?ZUk*bV@AqIpAVZlnX#$xR)~O@*r{Gw#H7F6434YO9<;wF zYvjRf%ke-o@w8%pt7P+Xu^M}Yu5x?PpJH2d)$ei#cOK7v{6IYJP*HtZu5+&&6-Lf6 ziWbw3Fqif2s@iE0k`3LHM(#R2jmhXtdPy?AHH=%eRGCJ+K0;pr8B|Ej@Wjo&*Piob zO{3P=Xjp>2`^M7Db19KOJk~Ikc79Vxd4S-FzeTI0Ol-c5YBN|a)@7xs62?-cNEf{{ z2{!A5p!%Lj0<3O}ZfYu_azbuJTu?QW%!AH6;=Q_0=dOjogn|T1{<(A;t=Ihlf#Xm2 z*g#Gq7Ht&f&r-nBPQJ&(|YaivUxMS{yC)LTvojxegnEms!+W% zgdIxt6hwPJ9|Fw|*}eDiQj&LS>fTdINe`=O*pfQxq3O5+6Xqn#eHJ8yj_E5hsOIRD zKfG7o%yRY(w@c{p@fj8Lwp{4;feR(o3C+iQH7~7eD<*I_9!)dR7xwaJ!oaG7<<^BF zR43AY2+=1a7}O3;9zEPeVYCMMm{?_1v4uiMV#^ki>|n)LHq4RBmv(9w+OYhx8#hwR z{Z607;)kK%zF=a~(cjD+QyDRssMF9OSHj2lo!!+IFDctrPn`k7B_{5dnPIPJjYVL< zpX02PVS(n0#|ZB!W4ojnfy?eD|Fn7Q6rpr%u2Z-9&W*0=h(kfsC{xrPC)?DmfU~|g QC(=xTOXDBz8l*-48`(ypDF6Tf literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/private/daveKey.der b/testing/tests/ikev2/rw-newhope-bliss/hosts/dave/etc/ipsec.d/private/daveKey.der new file mode 100644 index 0000000000000000000000000000000000000000..0ec528ddf6695691e10aaffc4f5655c76bb5477e GIT binary patch literal 1310 zcmV+(1>yQIf(04|3o8Zz1ObAeDg^=q1A+sA0A+4`7aVP>4wc6^X4Nn>rA7lWsY^ed z$TTHR{BI1g7G~}5J5WF1y~@ioCNqWCkVJ|pZ?g-a?PP>ycHUwG4=QcAX{`oGUH2yz zB1u?Mpb)kbx?_q}*g06j0v@Dw5Zh6GS*n!3X1z;2ph{8fTSQc&BYjxefJU|Tq|sXs zHM)ZH>GgNEkoI+_s5y?mhY?#COn6d>xvh6W_(qv3+P+4yDu7BCGe^jLv*b_Og2XnM z(c*+Xa$}Yb>3A)qGgSEEQK^-INh=?wooG}uZB+0@M87sQ(Z(2%#Sj6L-?3@&Bpw2+ zBgIBHaF$RL!D^5x8%wPQj0d$T6cMFgb9&?NFa<|=Qw)bF@ZORF&^?N$k! zls-yGx#4D7@Z*eZE@d*o15|4vL6cI@FHn!V`ssz*ObVA z0Nk0BSB@q3tIIPs zYjv6`@=#Vv*sveON>+X5b|qJ9%$JAN-G2%|y1=(-78VrqAe$*BEHz1WQ!0F%VCn=A zUzMPG78&em(hH1D!D{9;e4NGRHIfy!=AfeE)-y?PS{Z*=be*s`0}l(t4jnJljSsYD zTFJm665NPhh5^THtYXIY@-nOXi&{OH7|+!KIXk*<))!!42_q>4Qv-p)02~4c1CBrd z0)GG?2mllS00000f)C&Uz$72X0CA4s00#q*0N{VXAMgl2fC&Kq&jj!=p01g2p5D){7Km-5)Ao5S+fCnHBdgO2jpL5HP4(28*%A%P2$WcOSQ*x9m zmFQ7FJheQ|Us05frJpDN^?E)3K7V~*@6YFt@9X==_l-@5YGczO!&P7q5Cnokls1$d zC~G3DoVb*+I1mC%uQCz?1H}MXcbpU!CJv@T#1SAz7n}-Kc^4!R@I+QZY)m92DI`YI zD8>5E$|jNf;k><6`&-8{~iC| z>(as1SoCiv0fD~(2ntRIa{#>wnbd#}jSx!&H5Pds*;*O>H|eFtv7C#Ve_YdiVVDMD zPIu6DTue2-T~MB5E2%0r!uMJ91Wal$`Cn}Q3NtpBR66!N75=)jf2KarW#p6sW=aT; z`?ivqeV~E%r*OfzJQ1(;h(^`DE*9WG%?``|sJd9QL@xpWs(jHKtnc*50AxX|;xVz? zCaen%Vt1~2$@R4A>6r5x^ZeDdf@gJU@Q&5fAJ~v5o^g)`gBt!BR^j_`iQR;k59aP1 zRp9iv=|_nHA8p-g0CmDO%Lm2M3RGA`?tK(3$ju^ z-7s6%>vifv9zT!DngBY^TB>grz`2-0f8-Xw#BZq5s=0JV4#rUU{CFLhV^=4`IB0|{ zyuU|m%Cl0XM5b|+Inm7!y?iL^gi&mxK5+Y&*#v1HAo`1-ivc!?|KaMUTgSULiL2bS>heif3$Y4vS8lW_K@e<5-vLqW zu-7HpS1v16!&H_h-I(Gfj__tr9p3w^4N`-0s%I+pg_BVL#grpr)vp7`3IYX-5><>; z6-%-r(O>2^@al1o3D>RUfm^9Xo$bs8D#qY3<(X<6eMOsD@vPQLe$;K83n)T0_$C*e zB=l8W#4qOK^V>?=N_W)qj{tjXoS&Sbj6Y^bh9eP}*#Z&7NL*ni_5sj-6)rId zyR2T=(gwCN&s!t-$DYee5A)^{?@ULyoXVA9^NUvPT)s>Uz)nS^$t70u>bw83_BCv_xCF`G1a!&2qw{)~?bunU(zNrdiIU%IVI?a*A8}$Atvr?8qKx zWc8C0T3B2hskce1JVfuPqt}N*1$dyj3`f-m16Y@Tkp)Zn+$6K18e*sS>4`K3_fdfr zRMXMB)$F!%xP$*$o?ABQlTyi-mJG9wzw!80Q1Csydh6ha=QWK zm!ib6YP&28K|zo!p&UQA=tx6Iki~WT(&W|Y%(pK8wxO$6-E(V#Neh^({fH0SnP zt@<@@Dy0rcV(sDa9e@{h2A?>ntec#K`PvZ48o{`!Cq)P2_g2_nYUK^nwAvrI4`0*$ zX2TUUNw_Bw3g8-tQ_2iU(A>;Ri)QQFeQJ-cx<3z@PBJ7%`0D!@-_04li1AFFnwgV= zG|MwY!A;T=Mm&I#E0yk2WH!XB(K&=!9*UyeXL&e#NLZ~N{85d(z^=_xS0gz~Y&+Wt zlpNs804GQFK#zxDXx-l--IsUjBRZ!%lp4Uo^U69R?O||A|Ia+yRDt~*e>3Cyd<}rS z%=_zx_Am*MB)=9V4FGV-AmQ0_@ib-8b4rfg_MwIHPW?N}>-dgXE$epErR23-8PbXU zXxW|u{V_|2R*TcK=;cDZ&)x3s)1~ncd-Ifu14XsXikq@M><#f$4#Huym}lE3@F@yl zMAOhvJPCT}lipY0n*sWS`b9Q*G0X3n?B|swqRC^LFxUuA`f*aLrVyJKGA224E-7YK z;ZObJq*wgBKDzWnL0nMDP8Qg!uwda8I6=)8U0zZ z35_8oW=Bre@7=!TI9MjCC(czIRZ_?{I+;+JVHpX>(V*Gnu|<_ftzWc3uS&;@GocYB zh7Wh{XO?z2aX?nEp)e!)+k|)6`&xSQa0ypCQdL{Vg9{@8sDq;KX4!td{Ym-;BzR9b zC^~w$4!%w6zNg$_OK%Q`Oprs>M`*>yxB}G+$y?bV?N&NLS+mR<>_wFt)Y{^plZ5tV z7{~BBn+|J02Yhq_xG}-)QIj5ZC5>|Ws7$?p2{k6UCXKVWY3r&)6;Q#;t literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.d/certs/moonCert.der b/testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.d/certs/moonCert.der new file mode 100644 index 0000000000000000000000000000000000000000..d0ea364b0e645d5cc91aae74ee1be3a3132f3ddc GIT binary patch literal 2200 zcmb7^dpy$%AIEJo=9bHt`~5EFH+Pat#0U{)BXY}ixoi_oWLpzPvbltu4q~~SoCr;l zCif^4(&^z4bE%^jaw<7TM^As8UeELV^Zfbwe!j2Q=kxvJ`v$165`YRtRztubFc=nn zF&I65ng|2L1w;-DfcQbwY6B<)1my!fQ6hkl0K}hP01kFSqZ9%8uR<6uMI;dt6QX@n z!xGfI35juMBSWdp#LLI@}TWOoCqBDEyE3iQUVmdHGrQ>OiVz2t3f>Ih)g6z15`-Of&b5eAkcRL z41-W16h4>fVBz;S9q-Kb5^@4|TRI*y;JO{!35C{&>eL%I#vD1|dF=$X!7=go*S)1y z=rYTZ28`K{6Ei7OaZj>kmy9OapHlL*Q$h!?r3$;nPFi&fdhFX|gnbEzEgsTED{tK~G!7=P$(afts&7y)S zv}*J&xs%(vzs>~>`#@G@uG6g_-Pw$eAi3X)?Ou#O|NBH*pI>%NDRg0q^@Vb*X!Lg& zB3(N{;aPu3yhilOF1$Xu(e%YBj!zwcnU(f6Q62x}K3>l{jP0|U@M<{UwM>nVa>kG+ zw)59jN*vCyX`{qMqXJ0Vg4vY`j|xL_6(({C2Zwky$IgPboc=N%Qye8Rf7K6SwUOP`Ni710XKSh!pLS%Sys~lI%fIK34a5&}H4QV3JrWcp0yCI4^L4|J zYP8ruhqeO)*5oW#bc4}h58X^_WgKR^IAlxW?4`->6W8yjTrCz;ml;Ej{|$p zde0u63zx0jHvK@D>Bz;~;!gERg+9X#zPFOl@NzBBb#@nlHP5oT-!i~Z5@5c0qRM67 z4Xblf(x{1#Qg!W1$vgQI(`)dH8xJVi#cZ)~9k(DVs)gMLd=Vc=wpu{fD!w{&<85<8 z@s{DtmSa4!q4%BP;7(%=vD|gYBcxT6kuNWA_~a5swTv^Js7uxrA(plXt0?MM-luRdI3@n# z>c;AqrG-_Ij;xc<-K10klxzP6iLxfY9DpE8uSHNWC*q^^`GYMR9m>34KZUC*Nr!!)&;6))nq8AR)$T3B&O;ZkpboYZJ_Ij!Th)<;%!YUm zYxaQNxnD({-c}rI1gw!dCJC}M%lTQQyP~x&t!THs;T4315C1P+?u`m2L{=4URTc@2 z5sMhLu)TWaXQtWpYf2Ckz?TLIamu{BFn6;~jr$|>IoVW1$Dy5*Vy<4y_?P;{B6YKw zk9Ul;9$IbzSKaPy<^|^HtWG#L_FohFOX^v_OpH#%Fdvg?ePd6Ryr}(TZmvJ}cJ^;sjC~$8 zcdTnFHP4nnS(t0&GDOHa8n>-?f<` zy^gGC4xeCLHoajD2Ce;MQ71?3tSYKGZgDi^F?FSSlNw9zOWkpaHd#z_RnPqF*Zx6E kSkG*Q&w1DBuuLeTFV7H{J`^8-w7ZmUOjy4wKjTRL8{S~8-~a#s literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.d/private/moonKey.der b/testing/tests/ikev2/rw-newhope-bliss/hosts/moon/etc/ipsec.d/private/moonKey.der new file mode 100644 index 0000000000000000000000000000000000000000..c989f91e58a61c46f4b4c4fc23ce0cb32be59822 GIT binary patch literal 1310 zcmV+(1>yQIf(04|3o8Zz1ObAeDg^=r1A+sA07lha3iG2uu-(6MhgbQowZoAUC$%MR zjyVpbA*t=mLBRsvC2kCpkmQ3K}{n~FKWu<&PNbV{db zyWwkg?9h0^RE21j1>n@C|A9h~%IpXhc_nTd&%|D9B4_6L6QyyfGuKkVQKT?d*c4MT zAIPS=etQ})FDCCq@ir^uH9?KL%0H_tc>ZYI{NEl<}Vv6KwvLxkB=f<}=A{gc2LS(d#DPv#$ zROMJTq84BymRq}Yr$IcS4dr$#eQ_N3#rw~{Wj)h-^GrQo<5o&soOv zI1nOEN0^92N(%_9*rvPdkpcyDFg5T?oJQVBSSC*qEvf*4oR|NU?iowf=o5bJyn%(2 zxD8?^Nn3(3uDHT5{}07+IN(U48`}<^>#L}f@hsNyL2E9kzwRu?^r@k9m`BGogsSujKUoMJwR%^z zq6S+j2jt}syr;?+BdwLy6?yOAs#y5 z5C{N}P$2Qg0DeFKl5iYi2LA#;;Q$CD@(%;yzypE700*9Ufx!R*Pve4k1n@W=amVBV zz(0a901?Ol5CQ-KKU|Ip00IExfPmwGQ3UV^C-5-+0EQr*4;!J#Ab^M*4hI|%2P5(M z_yRcG@xULDKj3fx00H