From 9fcf4fdda1acafbdebb099564e25633677877e55 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 25 Apr 2018 10:48:21 +0200 Subject: [PATCH 01/11] x509: Add flag that marks compliance with RFC 4945 According to RFC 4945, section 5.1.3.2, a certificate for IKE must either not contain the keyUsage extension, or, if it does, have at least one of the digitalSignature or nonReputiation bits set. --- src/libstrongswan/credentials/certificates/x509.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/libstrongswan/credentials/certificates/x509.h b/src/libstrongswan/credentials/certificates/x509.h index 2c640e2da..3f8af3106 100644 --- a/src/libstrongswan/credentials/certificates/x509.h +++ b/src/libstrongswan/credentials/certificates/x509.h @@ -62,6 +62,9 @@ enum x509_flag_t { X509_IKE_INTERMEDIATE = (1<<8), /** cert has Microsoft Smartcard Logon usage */ X509_MS_SMARTCARD_LOGON = (1<<9), + /** cert either lacks keyUsage bits, or includes either digitalSignature + * or nonRepudiation as per RFC 4945, section 5.1.3.2. */ + X509_IKE_COMPLIANT = (1<<10), }; extern enum_name_t *x509_flag_names; From 920366e688dc755fd49a8c2421590bed4490a184 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 25 Apr 2018 10:50:03 +0200 Subject: [PATCH 02/11] x509: Set IKE compliance flag depending on keyUsage --- src/libstrongswan/plugins/x509/x509_cert.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c index d1f9d9aac..bc3a44346 100644 --- a/src/libstrongswan/plugins/x509/x509_cert.c +++ b/src/libstrongswan/plugins/x509/x509_cert.c @@ -704,6 +704,9 @@ static void parse_keyUsage(chunk_t blob, private_x509_cert_t *this) KU_DECIPHER_ONLY = 8, }; + /* to be compliant with RFC 4945 specific KUs have to be included */ + this->flags &= ~X509_IKE_COMPLIANT; + if (asn1_unwrap(&blob, &blob) == ASN1_BIT_STRING && blob.len) { int bit, byte, unused = blob.ptr[0]; @@ -724,10 +727,12 @@ static void parse_keyUsage(chunk_t blob, private_x509_cert_t *this) case KU_CRL_SIGN: this->flags |= X509_CRL_SIGN; break; - case KU_KEY_CERT_SIGN: - /* we use the caBasicConstraint, MUST be set */ case KU_DIGITAL_SIGNATURE: case KU_NON_REPUDIATION: + this->flags |= X509_IKE_COMPLIANT; + break; + case KU_KEY_CERT_SIGN: + /* we use the caBasicConstraint, MUST be set */ case KU_KEY_ENCIPHERMENT: case KU_DATA_ENCIPHERMENT: case KU_KEY_AGREEMENT: @@ -1381,6 +1386,9 @@ static bool parse_certificate(private_x509_cert_t *this) parser = asn1_parser_create(certObjects, this->encoding); + /* unless we see a keyUsage extension we are compliant with RFC 4945 */ + this->flags |= X509_IKE_COMPLIANT; + while (parser->iterate(parser, &objectID, &object)) { u_int level = parser->get_level(parser)+1; From 504e12326d471182a48f172bd42dbecde738b83d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 25 Apr 2018 10:51:51 +0200 Subject: [PATCH 03/11] openssl: Set IKE compliance flag depending on keyUsage --- src/libstrongswan/plugins/openssl/openssl_x509.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c index 60c08770b..fae2d678f 100644 --- a/src/libstrongswan/plugins/openssl/openssl_x509.c +++ b/src/libstrongswan/plugins/openssl/openssl_x509.c @@ -668,6 +668,9 @@ static bool parse_keyUsage_ext(private_openssl_x509_t *this, { ASN1_BIT_STRING *usage; + /* to be compliant with RFC 4945 specific KUs have to be included */ + this->flags &= ~X509_IKE_COMPLIANT; + usage = X509V3_EXT_d2i(ext); if (usage) { @@ -682,6 +685,11 @@ static bool parse_keyUsage_ext(private_openssl_x509_t *this, { this->flags |= X509_CRL_SIGN; } + if (flags & X509v3_KU_DIGITAL_SIGNATURE || + flags & X509v3_KU_NON_REPUDIATION) + { + this->flags |= X509_IKE_COMPLIANT; + } if (flags & X509v3_KU_KEY_CERT_SIGN) { /* we use the caBasicContraint, MUST be set */ @@ -988,6 +996,9 @@ static bool parse_extensions(private_openssl_x509_t *this) STACK_OF(X509_EXTENSION) *extensions; int i, num; + /* unless we see a keyUsage extension we are compliant with RFC 4945 */ + this->flags |= X509_IKE_COMPLIANT; + extensions = X509_get0_extensions(this->x509); if (extensions) { From 6143f926eff1685ec073e13d458734225742503f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 25 Apr 2018 11:10:48 +0200 Subject: [PATCH 04/11] ike: Reject certificates that are not compliant with RFC 4945 --- .../authenticators/pubkey_v1_authenticator.c | 27 ++++++++++++++++- .../authenticators/pubkey_authenticator.c | 29 +++++++++++++++++-- 2 files changed, 53 insertions(+), 3 deletions(-) diff --git a/src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c b/src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c index 41be15a08..9e5833efc 100644 --- a/src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c +++ b/src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c @@ -18,6 +18,7 @@ #include #include #include +#include typedef struct private_pubkey_v1_authenticator_t private_pubkey_v1_authenticator_t; @@ -130,6 +131,29 @@ METHOD(authenticator_t, build, status_t, return status; } +/** + * Check if the end-entity certificate, if any, is compliant with RFC 4945 + */ +static bool is_compliant_cert(auth_cfg_t *auth) +{ + certificate_t *cert; + x509_t *x509; + + cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT); + if (!cert || cert->get_type(cert) != CERT_X509) + { + return TRUE; + } + x509 = (x509_t*)cert; + if (x509->get_flags(x509) & X509_IKE_COMPLIANT) + { + return TRUE; + } + DBG1(DBG_IKE, "rejecting certificate without digitalSignature or " + "nonRepudiation keyUsage flags"); + return FALSE; +} + METHOD(authenticator_t, process, status_t, private_pubkey_v1_authenticator_t *this, message_t *message) { @@ -176,7 +200,8 @@ METHOD(authenticator_t, process, status_t, id, auth, TRUE); while (enumerator->enumerate(enumerator, &public, ¤t_auth)) { - if (public->verify(public, scheme, NULL, hash, sig)) + if (public->verify(public, scheme, NULL, hash, sig) && + is_compliant_cert(current_auth)) { DBG1(DBG_IKE, "authentication of '%Y' with %N successful", id, signature_scheme_names, scheme); diff --git a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c index c6c482910..652b837fe 100644 --- a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c +++ b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008-2017 Tobias Brunner + * Copyright (C) 2008-2018 Tobias Brunner * Copyright (C) 2005-2009 Martin Willi * Copyright (C) 2005 Jan Hutter * HSR Hochschule fuer Technik Rapperswil @@ -23,6 +23,7 @@ #include #include #include +#include typedef struct private_pubkey_authenticator_t private_pubkey_authenticator_t; @@ -414,6 +415,29 @@ METHOD(authenticator_t, build, status_t, return status; } +/** + * Check if the end-entity certificate, if any, is compliant with RFC 4945 + */ +static bool is_compliant_cert(auth_cfg_t *auth) +{ + certificate_t *cert; + x509_t *x509; + + cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT); + if (!cert || cert->get_type(cert) != CERT_X509) + { + return TRUE; + } + x509 = (x509_t*)cert; + if (x509->get_flags(x509) & X509_IKE_COMPLIANT) + { + return TRUE; + } + DBG1(DBG_IKE, "rejecting certificate without digitalSignature or " + "nonRepudiation keyUsage flags"); + return FALSE; +} + METHOD(authenticator_t, process, status_t, private_pubkey_authenticator_t *this, message_t *message) { @@ -479,7 +503,8 @@ METHOD(authenticator_t, process, status_t, while (enumerator->enumerate(enumerator, &public, ¤t_auth)) { if (public->verify(public, params->scheme, params->params, octets, - auth_data)) + auth_data) && + is_compliant_cert(current_auth)) { if (auth_method != AUTH_DS) { From a0902d1ae0356acbbf4e0278e51c756fe2196d51 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 25 Apr 2018 11:37:43 +0200 Subject: [PATCH 05/11] x509: Fail CRL validity check if thisUpdate is in the future --- src/libstrongswan/plugins/x509/x509_crl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/x509/x509_crl.c b/src/libstrongswan/plugins/x509/x509_crl.c index 5c5010b97..95cb11cf4 100644 --- a/src/libstrongswan/plugins/x509/x509_crl.c +++ b/src/libstrongswan/plugins/x509/x509_crl.c @@ -546,7 +546,7 @@ METHOD(certificate_t, get_validity, bool, { *not_after = this->nextUpdate; } - return (t <= this->nextUpdate); + return (t >= this->thisUpdate && t <= this->nextUpdate); } METHOD(certificate_t, get_encoding, bool, From 9c6b102ee0a687985fa0f1ed834aacef3064b1a4 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 25 Apr 2018 11:38:22 +0200 Subject: [PATCH 06/11] openssl: Fail CRL validity check if thisUpdate is in the future --- src/libstrongswan/plugins/openssl/openssl_crl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c index 88f7a67c2..bb5f20dcf 100644 --- a/src/libstrongswan/plugins/openssl/openssl_crl.c +++ b/src/libstrongswan/plugins/openssl/openssl_crl.c @@ -358,7 +358,7 @@ METHOD(certificate_t, get_validity, bool, { *not_after = this->nextUpdate; } - return t <= this->nextUpdate; + return (t >= this->thisUpdate && t <= this->nextUpdate); } METHOD(certificate_t, get_encoding, bool, From 13f76a241cef93cda07823e0e92760b3df45e5d4 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 25 Apr 2018 11:38:38 +0200 Subject: [PATCH 07/11] revocation: Ignore CRLs that are not yet valid Using such CRLs can be a problem if the clock on the host doing the revocation check is trailing behind that of the host issuing CRLs in scenarios where expired certificates are removed from CRLs. As revoked certificates that expired will then not be part of new CRLs a host with trailing clock might still accept such a certificate if it is still valid according to its system clock but is not contained anymore in the not yet valid CRL. --- .../plugins/revocation/revocation_validator.c | 40 ++++++++++++++++--- 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c index 0611be43e..0e3ab2dfd 100644 --- a/src/libstrongswan/plugins/revocation/revocation_validator.c +++ b/src/libstrongswan/plugins/revocation/revocation_validator.c @@ -1,8 +1,9 @@ /* + * Copyright (C) 2015-2018 Tobias Brunner * Copyright (C) 2010 Martin Willi * Copyright (C) 2010 revosec AG * Copyright (C) 2009 Andreas Steffen - * Hochschule fuer Technik Rapperswil + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -15,6 +16,8 @@ * for more details. */ +#include + #include "revocation_validator.h" #include @@ -417,11 +420,11 @@ static bool verify_crl(certificate_t *crl) /** * Report the given CRL's validity and cache it if valid and requested */ -static bool is_crl_valid(certificate_t *crl, bool cache) +static bool is_crl_valid(certificate_t *crl, time_t now, bool cache) { time_t valid_until; - if (crl->get_validity(crl, NULL, NULL, &valid_until)) + if (crl->get_validity(crl, &now, NULL, &valid_until)) { DBG1(DBG_CFG, " crl is valid: until %T", &valid_until, FALSE); if (cache) @@ -434,6 +437,25 @@ static bool is_crl_valid(certificate_t *crl, bool cache) return FALSE; } +/** + * Check if the CRL should be used yet + */ +static bool is_crl_not_valid_yet(certificate_t *crl, time_t now) +{ + time_t this_update; + + if (!crl->get_validity(crl, &now, &this_update, NULL)) + { + if (this_update > now) + { + DBG1(DBG_CFG, " crl is not valid: until %T", &this_update, FALSE); + return TRUE; + } + /* we accept stale CRLs */ + } + return FALSE; +} + /** * Get the better of two CRLs, and check for usable CRL info */ @@ -442,7 +464,7 @@ static certificate_t *get_better_crl(certificate_t *cand, certificate_t *best, bool cache, crl_t *base) { enumerator_t *enumerator; - time_t revocation; + time_t now, revocation; crl_reason_t reason; chunk_t subject_serial, serial; crl_t *crl = (crl_t*)cand; @@ -472,6 +494,12 @@ static certificate_t *get_better_crl(certificate_t *cand, certificate_t *best, cand->destroy(cand); return best; } + now = time(NULL); + if (is_crl_not_valid_yet(cand, now)) + { + cand->destroy(cand); + return best; + } subject_serial = chunk_skip_zero(subject->get_serial(subject)); enumerator = crl->create_enumerator(crl); @@ -488,7 +516,7 @@ static certificate_t *get_better_crl(certificate_t *cand, certificate_t *best, /* if the cert is on hold, a newer CRL might not contain it */ *valid = VALIDATION_ON_HOLD; } - is_crl_valid(cand, cache); + is_crl_valid(cand, now, cache); DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N", &revocation, TRUE, crl_reason_names, reason); enumerator->destroy(enumerator); @@ -503,7 +531,7 @@ static certificate_t *get_better_crl(certificate_t *cand, certificate_t *best, { DESTROY_IF(best); best = cand; - if (is_crl_valid(best, cache)) + if (is_crl_valid(best, now, cache)) { *valid = VALIDATION_GOOD; } From b00d3adbd1645e44517deb17930b346b83802f24 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 3 May 2018 11:07:59 +0200 Subject: [PATCH 08/11] revocation: Also store validation results for intermediate CA certificates If the certificate is revoked, we immediately returned and the chain was invalid, however, if we couldn't fetch the CRL that result was not stored for intermediate CAs and we weren't able to enforce a strict CRL policy later. --- .../plugins/revocation/revocation_validator.c | 36 ++++++++----------- 1 file changed, 14 insertions(+), 22 deletions(-) diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c index 0e3ab2dfd..1a7013b0f 100644 --- a/src/libstrongswan/plugins/revocation/revocation_validator.c +++ b/src/libstrongswan/plugins/revocation/revocation_validator.c @@ -354,13 +354,10 @@ static cert_validation_t check_ocsp(x509_t *subject, x509_t *issuer, { valid = VALIDATION_FAILED; } - if (auth) - { - auth->add(auth, AUTH_RULE_OCSP_VALIDATION, valid); - if (valid == VALIDATION_GOOD) - { /* successful OCSP check fulfills also CRL constraint */ - auth->add(auth, AUTH_RULE_CRL_VALIDATION, VALIDATION_GOOD); - } + auth->add(auth, AUTH_RULE_OCSP_VALIDATION, valid); + if (valid == VALIDATION_GOOD) + { /* successful OCSP check fulfills also CRL constraint */ + auth->add(auth, AUTH_RULE_CRL_VALIDATION, VALIDATION_GOOD); } DESTROY_IF(best); return valid; @@ -777,18 +774,15 @@ static cert_validation_t check_crl(x509_t *subject, x509_t *issuer, { valid = VALIDATION_FAILED; } - if (auth) + if (valid == VALIDATION_SKIPPED) + { /* if we skipped CRL validation, we use the result of OCSP for + * constraint checking */ + auth->add(auth, AUTH_RULE_CRL_VALIDATION, + auth->get(auth, AUTH_RULE_OCSP_VALIDATION)); + } + else { - if (valid == VALIDATION_SKIPPED) - { /* if we skipped CRL validation, we use the result of OCSP for - * constraint checking */ - auth->add(auth, AUTH_RULE_CRL_VALIDATION, - auth->get(auth, AUTH_RULE_OCSP_VALIDATION)); - } - else - { - auth->add(auth, AUTH_RULE_CRL_VALIDATION, valid); - } + auth->add(auth, AUTH_RULE_CRL_VALIDATION, valid); } DESTROY_IF(best); return valid; @@ -808,8 +802,7 @@ METHOD(cert_validator_t, validate, bool, if (this->enable_ocsp) { - switch (check_ocsp((x509_t*)subject, (x509_t*)issuer, - pathlen ? NULL : auth)) + switch (check_ocsp((x509_t*)subject, (x509_t*)issuer, auth)) { case VALIDATION_GOOD: DBG1(DBG_CFG, "certificate status is good"); @@ -834,8 +827,7 @@ METHOD(cert_validator_t, validate, bool, if (this->enable_crl) { - switch (check_crl((x509_t*)subject, (x509_t*)issuer, - pathlen ? NULL : auth)) + switch (check_crl((x509_t*)subject, (x509_t*)issuer, auth)) { case VALIDATION_GOOD: DBG1(DBG_CFG, "certificate status is good"); From cae43b890a4a23154f73c58112541de13ed9ee59 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 3 May 2018 11:19:18 +0200 Subject: [PATCH 09/11] revocation: Set defaults if CRL/OCSP checking is disabled in config --- .../plugins/revocation/revocation_validator.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c index 1a7013b0f..edb2f8074 100644 --- a/src/libstrongswan/plugins/revocation/revocation_validator.c +++ b/src/libstrongswan/plugins/revocation/revocation_validator.c @@ -824,6 +824,10 @@ METHOD(cert_validator_t, validate, bool, break; } } + else + { + auth->add(auth, AUTH_RULE_OCSP_VALIDATION, VALIDATION_SKIPPED); + } if (this->enable_crl) { @@ -847,6 +851,11 @@ METHOD(cert_validator_t, validate, bool, break; } } + else + { + auth->add(auth, AUTH_RULE_CRL_VALIDATION, + auth->get(auth, AUTH_RULE_OCSP_VALIDATION)); + } lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED, subject); From 0cf35496756b6005f1c2bc4b3eaaeacff7248789 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 3 May 2018 11:38:07 +0200 Subject: [PATCH 10/11] revocation: Fix memory leak if fetching CRL/OCSP fails We might get a 404 error page back. --- src/libstrongswan/plugins/revocation/revocation_validator.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c index edb2f8074..f8e78ac0c 100644 --- a/src/libstrongswan/plugins/revocation/revocation_validator.c +++ b/src/libstrongswan/plugins/revocation/revocation_validator.c @@ -59,7 +59,7 @@ static certificate_t *fetch_ocsp(char *url, certificate_t *subject, certificate_t *issuer) { certificate_t *request, *response; - chunk_t send, receive; + chunk_t send, receive = chunk_empty; /* TODO: requestor name, signature */ request = lib->creds->create(lib->creds, @@ -87,6 +87,7 @@ static certificate_t *fetch_ocsp(char *url, certificate_t *subject, FETCH_END) != SUCCESS) { DBG1(DBG_CFG, "ocsp request to %s failed", url); + chunk_free(&receive); chunk_free(&send); return NULL; } @@ -369,12 +370,13 @@ static cert_validation_t check_ocsp(x509_t *subject, x509_t *issuer, static certificate_t* fetch_crl(char *url) { certificate_t *crl; - chunk_t chunk; + chunk_t chunk = chunk_empty; DBG1(DBG_CFG, " fetching crl from '%s' ...", url); if (lib->fetcher->fetch(lib->fetcher, url, &chunk, FETCH_END) != SUCCESS) { DBG1(DBG_CFG, "crl fetching failed"); + chunk_free(&chunk); return NULL; } crl = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509_CRL, From 9746c308ff6c2f96ff6ba7af7b5409d76bdfc3b7 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 3 May 2018 11:26:34 +0200 Subject: [PATCH 11/11] testing: Add ikev2/multi-level-ca-skipped scenario --- .../multi-level-ca-skipped/description.txt | 4 +++ .../ikev2/multi-level-ca-skipped/evaltest.dat | 4 +++ .../hosts/carol/etc/ipsec.conf | 21 +++++++++++++++ .../carol/etc/ipsec.d/certs/carolCert.pem | 25 +++++++++++++++++ .../carol/etc/ipsec.d/private/carolKey.pem | 27 +++++++++++++++++++ .../hosts/carol/etc/ipsec.secrets | 3 +++ .../hosts/carol/etc/strongswan.conf | 5 ++++ .../hosts/moon/etc/ipsec.conf | 25 +++++++++++++++++ .../moon/etc/ipsec.d/cacerts/researchCert.pem | 23 ++++++++++++++++ .../hosts/moon/etc/strongswan.conf | 5 ++++ .../ikev2/multi-level-ca-skipped/posttest.dat | 3 +++ .../ikev2/multi-level-ca-skipped/pretest.dat | 5 ++++ .../ikev2/multi-level-ca-skipped/test.conf | 21 +++++++++++++++ 13 files changed, 171 insertions(+) create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/description.txt create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/evaltest.dat create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.conf create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.d/certs/carolCert.pem create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.d/private/carolKey.pem create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/strongswan.conf create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/posttest.dat create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/pretest.dat create mode 100644 testing/tests/ikev2/multi-level-ca-skipped/test.conf diff --git a/testing/tests/ikev2/multi-level-ca-skipped/description.txt b/testing/tests/ikev2/multi-level-ca-skipped/description.txt new file mode 100644 index 000000000..a5571d00c --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/description.txt @@ -0,0 +1,4 @@ +The roadwarrior carol possesses a certificate issued by the Research CA. +The CRL for the root CA can't be fetched and thus the status of the certificate +of the Research CA is unknown and the authentication is rejected due to the +strict CRL policy enforced by the gateway moon. diff --git a/testing/tests/ikev2/multi-level-ca-skipped/evaltest.dat b/testing/tests/ikev2/multi-level-ca-skipped/evaltest.dat new file mode 100644 index 000000000..5d445c27f --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/evaltest.dat @@ -0,0 +1,4 @@ +moon:: cat /var/log/daemon.log::constraint check failed: RULE_CRL_VALIDATION is FAILED, but requires at least GOOD::YES +carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES +moon:: ipsec status 2> /dev/null::alice.*ESTABLISHED::NO +carol::ipsec status 2> /dev/null::home.*INSTALLED::NO diff --git a/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..297e348ea --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=yes + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA" + auto=add diff --git a/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.d/certs/carolCert.pem new file mode 100644 index 000000000..698e47cc0 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.d/certs/carolCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIELDCCAxSgAwIBAgIBCzANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjERMA8GA1UECxMIUmVzZWFyY2gxFDAS +BgNVBAMTC1Jlc2VhcmNoIENBMB4XDTE1MDQyNjEwMjUwNFoXDTE5MDQwMzEwMjUw +NFowWjELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAP +BgNVBAsTCFJlc2VhcmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCC +ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKupuHqUUqSufsEtjSTZEkTF +sTGWXQkwZoLbAPNlZ4PV0Dx1ju3xRvVtjQHN3Tsx6IsB1JO3k/dMExwttbeBA8HK +oKYw+CFG8+6XWUU+tBT5xlwa5sdVUHIo8On1x7Rb3s+RDhJ2/YvCf/H13aOtqG+L +7Xyt7OwRQZNx4Gx60sgU2Zhr9WsMslWJQeS92va6UiGYN4c6qRNyrS9zTZEJ0yib +tflhd07LLcgz+jHqCdUcPK4g8+TH8HCtek0n2QRu3IfbEM+i6EaZjUJq1kp6k9HA +IgKR48r9HVk3zBsWJBo6sxUn8/avFM54vdwD8NAClNn9xobEXsO3jwGljc5mb40C +AwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRd +qfnvgHGNOog5OOLebmYkmJ/faTBtBgNVHSMEZjBkgBTndfCg8q0gzc1gI8zHyA8p +891UIKFJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3 +YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIBIDAfBgNVHREEGDAWgRRj +YXJvbEBzdHJvbmdzd2FuLm9yZzA3BgNVHR8EMDAuMCygKqAohiZodHRwOi8vY3Js +LnN0cm9uZ3N3YW4ub3JnL3Jlc2VhcmNoLmNybDANBgkqhkiG9w0BAQsFAAOCAQEA +TgUJbXL83e11Fzo+XGMQ24FfxdUvlex9IcnnNZnjsy4cYaUhofdI1AIkOhdh7R4i +9dtdfbFLLQR3qc2jmL9ubdQP83FiZZQOXX55XV5/Gb4E4g2T2ZU8ahby+ZzQsEcI +jGeot7fRfbxUrcjnIKxZd7JsQSaR45rMrNcUOQpFT212urojUngrEoAeaC5USEiX +sF11P654UejR8DCczwLi4QBvjRTH3bcMC57FjsWt1n/KCB08dS0ojD+T+6lN7/1K +yLreeRNynXzc1GAln5G03Ivwm9STFT1mYjkBMOCY+3ihEOpzlR9pWCWl9p728db3 +mk0VsDm1jdOf3PK1Xd2PJw== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.d/private/carolKey.pem new file mode 100644 index 000000000..3a5d7c487 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.d/private/carolKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAq6m4epRSpK5+wS2NJNkSRMWxMZZdCTBmgtsA82Vng9XQPHWO +7fFG9W2NAc3dOzHoiwHUk7eT90wTHC21t4EDwcqgpjD4IUbz7pdZRT60FPnGXBrm +x1VQcijw6fXHtFvez5EOEnb9i8J/8fXdo62ob4vtfK3s7BFBk3HgbHrSyBTZmGv1 +awyyVYlB5L3a9rpSIZg3hzqpE3KtL3NNkQnTKJu1+WF3TsstyDP6MeoJ1Rw8riDz +5MfwcK16TSfZBG7ch9sQz6LoRpmNQmrWSnqT0cAiApHjyv0dWTfMGxYkGjqzFSfz +9q8Uzni93APw0AKU2f3GhsRew7ePAaWNzmZvjQIDAQABAoIBAEJqa+GhOUhV6ty6 +zv0Ory7EfgX9cwl3HHJMYVXKSf6L3wFFSoNs8lNKi1/DUnDwolQF5UUxpaHsYQhp +9wCEffugdf9WuunFFeOd0wAjfnEPIlvIXLmKnJFOnccnPJjfYplUOemS+A32tqHa +ymHlcmGV9dBjSmMbWg+942KVMrAOHtCnAk0yT2WlE+9efLTuXoZIQCx+Ico6Lwp8 +JCmZYW2pfUk9co9di6UCl50C+A5RcvpsE7CZcXCzEAqz06eFz4imgQuzQSLaedup +F77cyPd13nD2N7+YGfWrWKbdqGMuQnmfrOQWZf94rlOsQjyCzbHIeItJsXT+DBKT +0SwEIQECgYEA1mcoUiCYOcQcA+FtSO8byzSu0uQZO1cS/VES5mbtRIuLo33L0P0y +bVnBIfk3iaBq70GU98XjhCGUwNwQDQm+zbLK+p+j+4L2ayvjtOV5ql0b2gk6eyRZ +oX14evsmxC2OFqGmGD+VePN4pP+Q39QMCFvf26BMtKHyXQnkwA61G30CgYEAzPfH +Lp3iT9xLqpp9zP9j2m9Ts6m6/Uzzuazpzl7rYMlLkd6fBWBquQ46qbO5Wv+SO7yZ +aWU7OuWGe6zng1VWSrLBZlRMfu+ze1uEETNdedRI858nv1bMlHmt9+RiZgOgZe7H +3D4dLphrQrJC8tlsaP0GWYRZkf64n+37KZX2QVECgYEAyKcmbyYeEQHeDius8XMF +mfmmG6xpiMWG+hgkDgkJyPqoJswWMXKk/P3g6ACq31yId33zAqfqs8ARzSSmyOzz +6uKHYGKDP2FjaQ1cP/H7GVumMzorxw9P6vjYBpCByVuw/LEwFsV7CAUkRZcAaNm0 +oSYKrSqqXuqpPjWCJdQd3qkCgYAdIf6ylohLN5GdrxXAZHBp5Lbt62sDg8OEmZol +1gH4oMPX+N97YSfqI6ac5kmrMHY1fWoEu/m+Nk92Fq5VUXTRazTn+YVh6WoGV4ye +8UERBuZTkkSRAqJTXDQo7tI5k7xhoJ3RpRZ6v/lG4pV3dQXeqlATuycMBDtzp9yy +HXmB8QKBgQCut7SsOJ0DtgpzjatYzKBh43WgwjbeRyReyT6OWuPiLUiKQYN8W5od +pZ51zorvFxu6iEMjAzXs0k1zbM4/EaQwwatTEZF0ZQMYMvm46f0ndhN3fY0O0ENY +zZES5DrfCgboPlmrWoVexU3xEDCWO8hO0fLmwqIK8F4EU8ByOVsHcg== +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..fac55d63b --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey.pem diff --git a/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..7a64dce30 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default +} diff --git a/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.conf new file mode 100644 index 000000000..fe69abe92 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=yes + +ca strongswan + cacert=strongswanCert.pem + crluri=http://crl.strongswan.org/not-available.crl + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn alice + leftsubnet=PH_IP_ALICE/32 + right=%any + rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA" + auto=add diff --git a/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem new file mode 100644 index 000000000..4d9fed09a --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIIDwTCCAqmgAwIBAgIBKDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTE0MDMyMjEzNTYyMloXDTE5MDMyMTEzNTYyMlowUTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMRQwEgYDVQQDEwtSZXNlYXJjaCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBALY5sjqm4AdbWKc/T7JahWpy9xtdPbHngBN6lbnpYaHfrxnGsvmD +FCFZHCd7egRqQ/AuJHHcEv3DUdfJWWAypVnUvdlcp58hBjpxfTPXP9IDBxzQaQyU +zsExIGWOVUY2e7xJ5BKBnXVkok3htY4Hr1GdqNh+3LEmbegJBngTRSRx4PKJ54FO +/b78LUzB+rMxrzxw/lnI8jEmAtKlugQ7c9auMeFCz+NmlSfnSoWhHN5qm+0iNKy0 +C+25IuE8Nq+i3jtBiI8BwBqHY3u2IuflUh9Nc9d/R6vGsRPMHs30X1Ha/m0Ug494 ++wwqwfEBZRjzxMmMF/1SG4I1E3TDOJ3srjkCAwEAAaOBrzCBrDAPBgNVHRMBAf8E +BTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQU53XwoPKtIM3NYCPMx8gPKfPd +VCAwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJv +bmdTd2FuIFJvb3QgQ0GCAQAwDQYJKoZIhvcNAQELBQADggEBAKHj4oUmSaG9u3QC +wjbETgexmKo6EViRjaf++QlK54ILHmPHCkN6Smzr5xpmi7P/FnBLqMlfMIQ3DCD7 +Fof/8SqaE/V9cP7TXK6c5vZHLoVU/NZW1A/HucMHSxd1DEiTfmrz8Q9RNb/r5adZ +Epbje7IRlufhpDD2hDNs1FyjmY9V9G4VfOBA/JBWlgs+A810uidNVD+YEFxDlIZG +6Kr0d5/WZowOUX7G8LUaa5kjoCS7MJONeEX2D/wtsx7Zw3f7GjFDdJfdi+CbAwBN +d8kt2l7yt7oEW9AfOcMQ7+HZOqihNrV8mCErk39p9f6zcZtYHnjM5fJlNRmc+EXC +mk13kTA= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..7a64dce30 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default +} diff --git a/testing/tests/ikev2/multi-level-ca-skipped/posttest.dat b/testing/tests/ikev2/multi-level-ca-skipped/posttest.dat new file mode 100644 index 000000000..f84b7e37b --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/posttest.dat @@ -0,0 +1,3 @@ +moon::ipsec stop +carol::ipsec stop +moon::rm /etc/ipsec.d/cacerts/* diff --git a/testing/tests/ikev2/multi-level-ca-skipped/pretest.dat b/testing/tests/ikev2/multi-level-ca-skipped/pretest.dat new file mode 100644 index 000000000..1d847c013 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/pretest.dat @@ -0,0 +1,5 @@ +moon::ipsec start +carol::ipsec start +moon::expect-connection alice +carol::expect-connection home +carol::ipsec up home diff --git a/testing/tests/ikev2/multi-level-ca-skipped/test.conf b/testing/tests/ikev2/multi-level-ca-skipped/test.conf new file mode 100644 index 000000000..892f51cd9 --- /dev/null +++ b/testing/tests/ikev2/multi-level-ca-skipped/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol"