testing: Add TKM scenarios with multiple key exchanges
This commit is contained in:
Tobias Brunner
@@ -176,9 +176,9 @@ do
|
|||||||
done
|
done
|
||||||
|
|
||||||
# Put DER-encoded moon private key and Root CA certificate into tkm scenarios
|
# Put DER-encoded moon private key and Root CA certificate into tkm scenarios
|
||||||
for t in host2host-initiator host2host-responder host2host-xfrmproxy \
|
for t in host2host-initiator host2host-initiator-multi-ke host2host-responder \
|
||||||
multi-level-ca net2net-initiator net2net-xfrmproxy xfrmproxy-expire \
|
host2host-responder-multi-ke host2host-xfrmproxy multi-level-ca \
|
||||||
xfrmproxy-rekey
|
net2net-initiator net2net-xfrmproxy xfrmproxy-expire xfrmproxy-rekey
|
||||||
do
|
do
|
||||||
TEST="${TEST_DIR}/tkm/${t}"
|
TEST="${TEST_DIR}/tkm/${t}"
|
||||||
mkdir -p ${TEST}/hosts/moon/${TKM_DIR}
|
mkdir -p ${TEST}/hosts/moon/${TKM_DIR}
|
||||||
@@ -1919,9 +1919,9 @@ done
|
|||||||
# TKM CA ID mapping #
|
# TKM CA ID mapping #
|
||||||
################################################################################
|
################################################################################
|
||||||
|
|
||||||
for t in host2host-initiator host2host-responder host2host-xfrmproxy \
|
for t in host2host-initiator host2host-initiator-multi-ke host2host-responder \
|
||||||
multi-level-ca net2net-initiator net2net-xfrmproxy xfrmproxy-expire \
|
host2host-responder-multi-ke host2host-xfrmproxy multi-level-ca \
|
||||||
xfrmproxy-rekey
|
net2net-initiator net2net-xfrmproxy xfrmproxy-expire xfrmproxy-rekey
|
||||||
do
|
do
|
||||||
for h in moon
|
for h in moon
|
||||||
do
|
do
|
||||||
|
|||||||
@@ -0,0 +1,5 @@
|
|||||||
|
A connection between the hosts <b>moon</b> and <b>sun</b> is set up using
|
||||||
|
multiple key exchanges. The host <b>moon</b> uses the Trusted Key Manager (TKM)
|
||||||
|
and is the initiator of the transport connection. The authentication is based
|
||||||
|
on X.509 certificates. Rekeyings are initiated by <b>moon</b> for both the IKE
|
||||||
|
and the ESP SA to test rekeying with multiple key exchanges.
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
|
||||||
|
sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
|
||||||
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||||
|
moon::swanctl --rekey --ike conn1
|
||||||
|
moon::sleep 1
|
||||||
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||||
|
moon::swanctl --rekey --child conn1
|
||||||
|
moon::sleep 1
|
||||||
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||||
|
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::3
|
||||||
|
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::3
|
||||||
|
moon::cat /tmp/tkm.log::Updating ISA context with ID 1 (KE 1)::YES
|
||||||
|
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
|
||||||
|
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
|
||||||
|
moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
|
||||||
|
moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
|
||||||
|
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
|
||||||
|
moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
|
||||||
|
moon::cat /tmp/tkm.log::Creating new child ISA context with ID 2 (Parent Isa 1, KE 1 #1 / 2, nonce 1, spi_loc.*::YES
|
||||||
|
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 2, Sp 1, Ea 1, Ke_Id 1 #1 / 2, Nc_Loc_Id 1, Initiator TRUE, spi_loc.*::YES
|
||||||
|
moon::swanctl --terminate --ike conn1 && sleep 1::no output expected::NO
|
||||||
|
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES
|
||||||
|
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
|
||||||
|
moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon-tkm {
|
||||||
|
ke_mapping {
|
||||||
|
15 = 1
|
||||||
|
16 = 2
|
||||||
|
}
|
||||||
|
ca_mapping {
|
||||||
|
strongswan_ca {
|
||||||
|
id = 1
|
||||||
|
fingerprint = CA_SPK_HEX
|
||||||
|
}
|
||||||
|
}
|
||||||
|
start-scripts {
|
||||||
|
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
# pre-generated and modified as tkm_cfgtool doesn't support multiple KEs yet
|
||||||
|
|
||||||
|
connections {
|
||||||
|
conn1 {
|
||||||
|
local_addrs=192.168.0.1
|
||||||
|
remote_addrs=192.168.0.2
|
||||||
|
proposals=aes256-sha512-modp3072-ke1_modp4096
|
||||||
|
local {
|
||||||
|
id=moon.strongswan.org
|
||||||
|
certs=moonCert.pem
|
||||||
|
}
|
||||||
|
remote {
|
||||||
|
id=sun.strongswan.org
|
||||||
|
}
|
||||||
|
children {
|
||||||
|
conn1 {
|
||||||
|
reqid=1
|
||||||
|
life_time=60
|
||||||
|
rekey_time=30
|
||||||
|
mode=transport
|
||||||
|
esp_proposals=aes256-sha512-modp3072-ke1_modp4096
|
||||||
|
start_action=trap
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
<tkmconfig>
|
||||||
|
<local_identity id="1">
|
||||||
|
<identity>moon.strongswan.org</identity>
|
||||||
|
<certificate>moonCert.pem</certificate>
|
||||||
|
</local_identity>
|
||||||
|
<policy id="1">
|
||||||
|
<mode>transport</mode>
|
||||||
|
<local>
|
||||||
|
<identity_id>1</identity_id>
|
||||||
|
<ip>192.168.0.1</ip>
|
||||||
|
</local>
|
||||||
|
<remote>
|
||||||
|
<identity>sun.strongswan.org</identity>
|
||||||
|
<ip>192.168.0.2</ip>
|
||||||
|
</remote>
|
||||||
|
<lifetime>
|
||||||
|
<soft>30</soft>
|
||||||
|
<hard>60</hard>
|
||||||
|
</lifetime>
|
||||||
|
</policy>
|
||||||
|
</tkmconfig>
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
connections {
|
||||||
|
|
||||||
|
host-host {
|
||||||
|
proposals = aes256-sha512-modp3072-ke1_modp4096
|
||||||
|
|
||||||
|
local {
|
||||||
|
auth = pubkey
|
||||||
|
certs = sunCert.pem
|
||||||
|
id = sun.strongswan.org
|
||||||
|
}
|
||||||
|
remote {
|
||||||
|
auth = pubkey
|
||||||
|
id = moon.strongswan.org
|
||||||
|
}
|
||||||
|
children {
|
||||||
|
host-host {
|
||||||
|
mode = transport
|
||||||
|
esp_proposals = aes256-sha512-modp3072-ke1_modp4096
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
moon::service charon-tkm stop
|
||||||
|
moon::killall tkm_keymanager
|
||||||
|
moon::rm -f /tmp/swanctl.conf /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
|
||||||
|
sun::systemctl stop strongswan
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
moon::rm /etc/swanctl/rsa/*
|
||||||
|
# swanctl.conf is not generated as tkm_cfgtool doesn't support multiple KEs yet
|
||||||
|
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /tmp/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
|
||||||
|
moon::cat /etc/swanctl/swanctl.conf
|
||||||
|
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
|
||||||
|
moon::expect-file /tmp/tkm.rpc.ike
|
||||||
|
moon::service charon-tkm start
|
||||||
|
sun::systemctl start strongswan
|
||||||
|
sun::expect-connection host-host
|
||||||
|
moon::expect-connection conn1
|
||||||
|
moon::swanctl --initiate --child conn1 2> /dev/null
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# This configuration file provides information on the
|
||||||
|
# guest instances used for this test
|
||||||
|
|
||||||
|
# All guest instances that are required for this test
|
||||||
|
#
|
||||||
|
VIRTHOSTS="moon winnetou sun"
|
||||||
|
|
||||||
|
# Corresponding block diagram
|
||||||
|
#
|
||||||
|
DIAGRAM="m-w-s.png"
|
||||||
|
|
||||||
|
# Guest instances on which tcpdump is to be started
|
||||||
|
#
|
||||||
|
TCPDUMPHOSTS="sun"
|
||||||
|
|
||||||
|
# Guest instances on which IPsec is started
|
||||||
|
# Used for IPsec logging purposes
|
||||||
|
#
|
||||||
|
IPSECHOSTS="moon sun"
|
||||||
|
|
||||||
|
# charon controlled by swanctl
|
||||||
|
#
|
||||||
|
SWANCTL=1
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
A connection between the hosts <b>moon</b> and <b>sun</b> is set up using
|
||||||
|
multiple key exchanges. The host <b>moon</b> uses the Trusted Key Manager (TKM)
|
||||||
|
and is the responder of the transport connection. The authentication is based
|
||||||
|
on X.509 certificates. Rekeyings are initiated by <b>sun</b> for both the IKE
|
||||||
|
and the ESP SA to test rekeying with multiple key exchanges.
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
|
||||||
|
sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
|
||||||
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||||
|
sun::swanctl --rekey --ike host-host
|
||||||
|
sun::sleep 1
|
||||||
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||||
|
sun::swanctl --rekey --child host-host
|
||||||
|
sun::sleep 1
|
||||||
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||||
|
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::3
|
||||||
|
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::3
|
||||||
|
moon::cat /tmp/tkm.log::Updating ISA context with ID 1 (KE 1)::YES
|
||||||
|
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
|
||||||
|
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
|
||||||
|
moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
|
||||||
|
moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
|
||||||
|
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
|
||||||
|
moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
|
||||||
|
moon::cat /tmp/tkm.log::Creating new child ISA context with ID 2 (Parent Isa 1, KE 1 #1 / 2, nonce 1, spi_loc.*::YES
|
||||||
|
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 2, Sp 1, Ea 1, Ke_Id 1 #1 / 2, Nc_Loc_Id 1, Initiator FALSE, spi_loc.*::YES
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon-tkm {
|
||||||
|
ke_mapping {
|
||||||
|
15 = 1
|
||||||
|
16 = 2
|
||||||
|
}
|
||||||
|
ca_mapping {
|
||||||
|
strongswan_ca {
|
||||||
|
id = 1
|
||||||
|
fingerprint = CA_SPK_HEX
|
||||||
|
}
|
||||||
|
}
|
||||||
|
start-scripts {
|
||||||
|
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
# pre-generated and modified as tkm_cfgtool doesn't support multiple KEs yet
|
||||||
|
|
||||||
|
connections {
|
||||||
|
conn1 {
|
||||||
|
local_addrs=192.168.0.1
|
||||||
|
remote_addrs=192.168.0.2
|
||||||
|
proposals=aes256-sha512-modp3072-ke1_modp4096
|
||||||
|
local {
|
||||||
|
id=moon.strongswan.org
|
||||||
|
certs=moonCert.pem
|
||||||
|
}
|
||||||
|
remote {
|
||||||
|
id=sun.strongswan.org
|
||||||
|
}
|
||||||
|
children {
|
||||||
|
conn1 {
|
||||||
|
reqid=1
|
||||||
|
life_time=60
|
||||||
|
rekey_time=30
|
||||||
|
mode=transport
|
||||||
|
esp_proposals=aes256-sha512-modp3072-ke1_modp4096
|
||||||
|
start_action=trap
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
<tkmconfig>
|
||||||
|
<local_identity id="1">
|
||||||
|
<identity>moon.strongswan.org</identity>
|
||||||
|
<certificate>moonCert.pem</certificate>
|
||||||
|
</local_identity>
|
||||||
|
<policy id="1">
|
||||||
|
<mode>transport</mode>
|
||||||
|
<local>
|
||||||
|
<identity_id>1</identity_id>
|
||||||
|
<ip>192.168.0.1</ip>
|
||||||
|
</local>
|
||||||
|
<remote>
|
||||||
|
<identity>sun.strongswan.org</identity>
|
||||||
|
<ip>192.168.0.2</ip>
|
||||||
|
</remote>
|
||||||
|
<lifetime>
|
||||||
|
<soft>30</soft>
|
||||||
|
<hard>60</hard>
|
||||||
|
</lifetime>
|
||||||
|
</policy>
|
||||||
|
</tkmconfig>
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
connections {
|
||||||
|
|
||||||
|
host-host {
|
||||||
|
local_addrs = PH_IP_SUN
|
||||||
|
remote_addrs = PH_IP_MOON
|
||||||
|
|
||||||
|
proposals = aes256-sha512-modp3072-ke1_modp4096
|
||||||
|
|
||||||
|
local {
|
||||||
|
auth = pubkey
|
||||||
|
certs = sunCert.pem
|
||||||
|
id = sun.strongswan.org
|
||||||
|
}
|
||||||
|
remote {
|
||||||
|
auth = pubkey
|
||||||
|
id = moon.strongswan.org
|
||||||
|
}
|
||||||
|
children {
|
||||||
|
host-host {
|
||||||
|
mode = transport
|
||||||
|
esp_proposals = aes256-sha512-modp3072-ke1_modp4096
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
moon::service charon-tkm stop
|
||||||
|
moon::killall tkm_keymanager
|
||||||
|
moon::cat /tmp/tkm.log
|
||||||
|
moon::rm -f /tmp/swanctl.conf /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
|
||||||
|
sun::systemctl stop strongswan
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
moon::rm /etc/swanctl/rsa/*
|
||||||
|
# swanctl.conf is not generated as tkm_cfgtool doesn't support multiple KEs yet
|
||||||
|
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /tmp/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
|
||||||
|
moon::cat /etc/swanctl/swanctl.conf
|
||||||
|
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
|
||||||
|
moon::expect-file /tmp/tkm.rpc.ike
|
||||||
|
moon::service charon-tkm start
|
||||||
|
sun::systemctl start strongswan
|
||||||
|
sun::expect-connection host-host
|
||||||
|
moon::expect-connection conn1
|
||||||
|
sun::swanctl --initiate --child host-host 2> /dev/null
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# This configuration file provides information on the
|
||||||
|
# guest instances used for this test
|
||||||
|
|
||||||
|
# All guest instances that are required for this test
|
||||||
|
#
|
||||||
|
VIRTHOSTS="moon winnetou sun"
|
||||||
|
|
||||||
|
# Corresponding block diagram
|
||||||
|
#
|
||||||
|
DIAGRAM="m-w-s.png"
|
||||||
|
|
||||||
|
# Guest instances on which tcpdump is to be started
|
||||||
|
#
|
||||||
|
TCPDUMPHOSTS="sun"
|
||||||
|
|
||||||
|
# Guest instances on which IPsec is started
|
||||||
|
# Used for IPsec logging purposes
|
||||||
|
#
|
||||||
|
IPSECHOSTS="moon sun"
|
||||||
|
|
||||||
|
# charon controlled by swanctl
|
||||||
|
#
|
||||||
|
SWANCTL=1
|
||||||
Reference in New Issue
Block a user