From 43d92475998f85b977ca98dd8ac81fc630a19000 Mon Sep 17 00:00:00 2001 From: Andreas Steffen Date: Fri, 28 Nov 2014 13:11:58 +0100 Subject: [PATCH] Created ikev2/rw-ntru-bliss scenario --- .../openssl/bliss/strongswan_blissCert.der | Bin 0 -> 2317 bytes .../etc/openssl/bliss/strongswan_blissKey.der | Bin 0 -> 1950 bytes .../hosts/winnetou/etc/openssl/generate-crl | 4 ++- testing/scripts/recipes/013_strongswan.mk | 3 +- .../tests/ikev2/rw-ntru-bliss/description.txt | 15 ++++++++++ .../tests/ikev2/rw-ntru-bliss/evaltest.dat | 26 ++++++++++++++++++ .../rw-ntru-bliss/hosts/carol/etc/ipsec.conf | 25 +++++++++++++++++ .../ipsec.d/cacerts/strongswan_blissCert.der | Bin 0 -> 2317 bytes .../carol/etc/ipsec.d/certs/carolCert.der | Bin 0 -> 2400 bytes .../carol/etc/ipsec.d/private/carolKey.der | Bin 0 -> 1950 bytes .../hosts/carol/etc/ipsec.secrets | 3 ++ .../hosts/carol/etc/strongswan.conf | 7 +++++ .../rw-ntru-bliss/hosts/dave/etc/ipsec.conf | 25 +++++++++++++++++ .../ipsec.d/cacerts/strongswan_blissCert.der | Bin 0 -> 2317 bytes .../hosts/dave/etc/ipsec.d/certs/daveCert.der | Bin 0 -> 2400 bytes .../dave/etc/ipsec.d/private/daveKey.der | Bin 0 -> 1950 bytes .../hosts/dave/etc/ipsec.secrets | 3 ++ .../hosts/dave/etc/strongswan.conf | 7 +++++ .../rw-ntru-bliss/hosts/moon/etc/ipsec.conf | 24 ++++++++++++++++ .../ipsec.d/cacerts/strongswan_blissCert.der | Bin 0 -> 2317 bytes .../hosts/moon/etc/ipsec.d/certs/moonCert.der | Bin 0 -> 2420 bytes .../moon/etc/ipsec.d/private/moonKey.der | Bin 0 -> 1950 bytes .../hosts/moon/etc/ipsec.secrets | 3 ++ .../hosts/moon/etc/strongswan.conf | 7 +++++ .../tests/ikev2/rw-ntru-bliss/posttest.dat | 9 ++++++ testing/tests/ikev2/rw-ntru-bliss/pretest.dat | 13 +++++++++ testing/tests/ikev2/rw-ntru-bliss/test.conf | 21 ++++++++++++++ 27 files changed, 193 insertions(+), 2 deletions(-) create mode 100644 testing/hosts/winnetou/etc/openssl/bliss/strongswan_blissCert.der create mode 100644 testing/hosts/winnetou/etc/openssl/bliss/strongswan_blissKey.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/description.txt create mode 100644 testing/tests/ikev2/rw-ntru-bliss/evaltest.dat create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.conf create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/cacerts/strongswan_blissCert.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/certs/carolCert.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/private/carolKey.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/strongswan.conf create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.conf create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/cacerts/strongswan_blissCert.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/certs/daveCert.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/private/daveKey.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/strongswan.conf create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.d/cacerts/strongswan_blissCert.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.d/certs/moonCert.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.d/private/moonKey.der create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/ikev2/rw-ntru-bliss/posttest.dat create mode 100644 testing/tests/ikev2/rw-ntru-bliss/pretest.dat create mode 100644 testing/tests/ikev2/rw-ntru-bliss/test.conf diff --git a/testing/hosts/winnetou/etc/openssl/bliss/strongswan_blissCert.der b/testing/hosts/winnetou/etc/openssl/bliss/strongswan_blissCert.der new file mode 100644 index 0000000000000000000000000000000000000000..db397a78c80b4f30e1eed254a1c335b3566908c7 GIT binary patch literal 2317 zcmb_cX;c%37M>-EA%V;c5ilss1f#fAli*f7RaONQS;Z<+hzlxJ2&6953PLD|R3U)2 z7Ep+|p+$4tmnu=8f(sIq#Xc1h6cG`J6FMzAS~{57RUgV71Nk7$OI%yrCf;(3yxy2_>f8-QlSL@QiA#8{!0?R!9kIcM1)+vmGJYCxH{QMXG^6X^Q4~A zIkP>Zo$NfmhX3DTN?0v%{^}eM{0cw}SP5qW2OfW`n6Iu^r_Khmj+AAp|ITd7iDD@n z)~T{Z*K*yQk>?6tcER|_fDIYispgnwLEyq8QSK++9btFpvsOHrqMQ3L>v9V< z#_hK$Q;sS+pH!9e99)Ya@TTfuJh4Z}Wlx$TRIwcWTfB>;5x+~)%JkN=s{m(?;k$&7 z88)TDtP%iQzT*$`Vmj^8QPIA(6(a9%14i!Ym-v((t$QrYJA2%BxJMVf>r71^2<(OKLRPC+?aAFnzb?}r~dD0_`Z&(D8)70FW`JlKD! zwU#fuP5-P-oVF}bwcV@Rkmag_P9cfXjvwx}w!oV#!X>{{8WhKGpbh@U)0aObT=w0) z{hrs7iEF2Du2zP}jFV64iY;nb-*oeKO5fh+G4@+zzA>c<$%6CVuFS`Kmb}PRMIxss zw03L?@tbjfV)SrlA#+o+LkX)jE456${2&yZH^}LVWoGxRiqL-G-fCfGZx?37YYzRS zj31v-A3D+V$ENS2lkfQwVRM_Zw!Op8?wox0LelHM_Vi_+_l(Q;C#&pd1Evyb{C0ZU z%Xyw-&M5w5% zBm8NEhuS@AZIAt*o6+Oqi#r|S?!274T)6m-pg>thH5T6upA)z>=$Cgn3-Ual-SU}V z0P)eackU%$%NK6i@PKD=`Ylb#=XWgVm@ew(0mr7iKN`$qs|AnXksF?VDz{a#lVG=D zmg7K;=>A~Nd(>m+JA_1q)>E-LJVkLH7466BkStG<(BKBvp%SphXEc zD}5#2qn-mtx$r@dW-ul2Xp->05XcvTF=|gNiOUzvV>mL#8iIe`pVhi7Yx=AgGYb@3 zRGD727yieyU?pP)@WFfWr{oO%ObFvOI5#A?#9kRgI(7q3Y_aU;HKn$aTvLAi#D)Dm z#u?nO<&2qmy|jg@nKmrXW~>s#VpxAgFU=A~8QJQTN|*4ho! zgxE={Ss`b@_K%$8S6$WhpW67=uqqovwe@x-TXF&O`WsekV5A@5WU^*Sf2YA_AfJXb z+jwCETtq)0Kf;vXW`vG|%WDP@fUR^wkBItwob}=aJoMi~(kO1&Q8Nhw`Af`ZT#u>p#@teydC&W(2{7o+Q3dy@ zomt6ZwB6R6^xo*R-X#ukEWZJ09frkoUzM+;j-+F5lRGscYwRvQU1cKN2Z#)jcJJqz zBt7Gv6CT<017)i26d~lGmNf1@X3>EC4FN+vDg5Lx+t^z(lPU@8d7IrSX4JP|eM><1 zAu{%0m%O6*_`19L8genheJ< zatJVeR&{=s9AKryeU?9@lb(b6qJGUQ_L>J){c0PPz^>>@y_UqD#IX1K4p;c-caMG3 zxWJCY9UF#v3RkjxmU0&KHp-Mv(g%!&iov8$gXOzG+{KClwnR`r81m6eVfA8|!Rv6? z`L1Pk<^sVm!564EGH*pXre7S=oaAUS-eIxfh6|Z@hCyYMz-4f4bvu z8N^VRIM?cJvf^eB&#LJ%ON zBtRk*NJF3%#84W7a0EdCv;(sz#3)5tQ4+U;Cd7b35P>0j6dM&Lj*Pyi1hok- z007%C9^QjCicup#B~H@l)<>`(pJp=lK06-Z+XSpulnA(P_6{p|ZFXqTH%7l7E8LbJ K$Iw3f*M9)ZLfs?) literal 0 HcmV?d00001 diff --git a/testing/hosts/winnetou/etc/openssl/bliss/strongswan_blissKey.der b/testing/hosts/winnetou/etc/openssl/bliss/strongswan_blissKey.der new file mode 100644 index 0000000000000000000000000000000000000000..65376a449277d8a5d3a4eab27141c3ef758c43f3 GIT binary patch literal 1950 zcmYLH3s4kg9N*nr4&{nxV1NOKCnD%52qH|#8-Yj#6@y4G>00jMW9UYgQy? zU7P5(5-!IP84si9cl#S8ghsnQZ&D4lhWt7?4orm6p>N6WE zBnKYHNc@+rm}(h_2+<wTtuWD+4EAbVlxeKB7?N7mwc@_;+QsOzY6Mp{t@PvdR2{ z^z)cFm8fb~c+U3r*dwwa`xB+oVf#3r{H}{8dCJn#e;WE)EyUOL-&~Wsd>mGo<~KH| zvg>3{n#kRTK5Opl6(qeCN9;O2sHki*y%+pPZR7Lg#=vjWTKppBBsd#gJRTMQ{x;{) z4aN7q=)Q72bzWFi^jUjlTAq=xVP}ohHtbojLrqQf8agv1*R@SKaI5Qd$BX zRxj;V?RaWmpW)PeZtL)=+zItr?~VDvf7Y0LP=A%V$V9$5o09&EVO&h= z%ElvYXHvuZ>#`T*-tG`9a-vG2$_^@$tF{&`vUInt4;L!Sjz#+Sv!~ixH)*}o%S4Yd zjg%A8FY_#CXN*+K%QF*uMUx52e9yUp$E@4AvDBj7wRh~hqTO}#)+M|!|6#Lf<)ZT$ zmK$&MFI_7Ry@YdDVOraNr|_N-_F{f zskE>d@*Q%Oj2TlWoS#)h8qd&K-w{kTc?T6b#!9Q{vB4!)uYQu;e4X>m)P4SBl&ZXY zueM}Z9ksl`S2}NOSY&LiUjK>Q*U7raUl6glCS)cPl6-|#G89GW^?I7ZfYReba};C{ z(xd?~jWgK6K4h?B34bt4(~v+D7cz#U5YaT;$U>t6-Mlz|8Wjx+#9 z%1DA-WJMO5K{ld@SiXVg;no9&XGN1lW_m>g+@u8m$VY(}MB^x4V4lP%$U&Q52?oY! z)a4Ms|G+DOqGv4f=AX;L>+Jfidf_~ zLL!zZV-uagLpTW+c355l{6X?R4z>jx1c7vf3Dp5W7>Ef%!dGDco4gH*n!*%ZO%dNP zj4P1*hUE+13+*B<46P-+2ho-ESbbP1X3*Gz&FN#=7|x4WxfEr!3b#x3=%kT mo(=xd8^gZ?93((^SuE}owXjCScwwaGUozxmlQ2Q(DDFQP^RhJn literal 0 HcmV?d00001 diff --git a/testing/hosts/winnetou/etc/openssl/generate-crl b/testing/hosts/winnetou/etc/openssl/generate-crl index 839816bf5..f064bdb0b 100755 --- a/testing/hosts/winnetou/etc/openssl/generate-crl +++ b/testing/hosts/winnetou/etc/openssl/generate-crl @@ -44,4 +44,6 @@ cd /etc/openssl/rfc3779 openssl ca -gencrl -crldays 15 -config /etc/openssl/rfc3779/openssl.cnf -out crl.pem openssl crl -in crl.pem -outform der -out strongswan_rfc3779.crl cp strongswan_rfc3779.crl ${ROOT} - +cd /etc/openssl/bliss +pki --signcrl --cacert strongswan_blissCert.der --cakey strongswan_blissKey.der --lifetime 30 --digest sha512 > strongswan_bliss.crl +cp strongswan_bliss.crl ${ROOT} diff --git a/testing/scripts/recipes/013_strongswan.mk b/testing/scripts/recipes/013_strongswan.mk index 2b7bde5a5..221f4f312 100644 --- a/testing/scripts/recipes/013_strongswan.mk +++ b/testing/scripts/recipes/013_strongswan.mk @@ -92,7 +92,8 @@ CONFIG_OPTS = \ --enable-tkm \ --enable-ntru \ --enable-lookip \ - --enable-swanctl + --enable-swanctl \ + --enable-bliss export ADA_PROJECT_PATH=/usr/local/ada/lib/gnat diff --git a/testing/tests/ikev2/rw-ntru-bliss/description.txt b/testing/tests/ikev2/rw-ntru-bliss/description.txt new file mode 100644 index 000000000..b81fdb7cf --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/description.txt @@ -0,0 +1,15 @@ +The roadwarriors carol and dave set up a connection each to gateway moon. +The key exchange is based on NTRU encryption with a cryptographical strength of 128 bit and +192 bit for carol and dave, respectively. Authentication is based on the BLISS +algorithm with strengths 128 bits (BLISS I), 160 bits (BLISS III) and 192 bits (BLISS IV) for +carol, dave and moon, respectively. +

+Both carol and dave request a virtual IP via the IKEv2 configuration payload +by using the leftsourceip=%config parameter. The gateway moon assigns virtual +IP addresses from a simple pool defined by rightsourceip=10.3.0.0/28 in a monotonously +increasing order. +

+leftfirewall=yes automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnels, carol and dave then ping +the client alice behind the gateway moon. The source IP addresses of the two +pings will be the virtual IPs carol1 and dave1, respectively. diff --git a/testing/tests/ikev2/rw-ntru-bliss/evaltest.dat b/testing/tests/ikev2/rw-ntru-bliss/evaltest.dat new file mode 100644 index 000000000..c7b5be412 --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/evaltest.dat @@ -0,0 +1,26 @@ +carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with BLISS signature successful::YES +carol::ipsec statusall 2> /dev/null::home.*IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/NTRU_128::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES +carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +dave::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with BLISS signature successful::YES +dave:: ipsec statusall 2> /dev/null::home.*IKE proposal: AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/NTRU_192::YES +dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES +dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES +dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES +moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with BLISS signature successful::YES +moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with BLISS signature successful::YES +moon:: ipsec statusall 2> /dev/null::rw\[1]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/NTRU_128::YES +moon:: ipsec statusall 2> /dev/null::rw\[2]: IKE proposal: AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/NTRU_192::YES +moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::ESP +moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::ESP +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES +alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES +alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..f13e47a71 --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + ike=aes128-sha256-ntru128! + esp=aes128-sha256! + authby=pubkey + fragmentation=yes + +conn home + left=PH_IP_CAROL + leftsourceip=%config + leftcert=carolCert.der + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/cacerts/strongswan_blissCert.der b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/cacerts/strongswan_blissCert.der new file mode 100644 index 0000000000000000000000000000000000000000..db397a78c80b4f30e1eed254a1c335b3566908c7 GIT binary patch literal 2317 zcmb_cX;c%37M>-EA%V;c5ilss1f#fAli*f7RaONQS;Z<+hzlxJ2&6953PLD|R3U)2 z7Ep+|p+$4tmnu=8f(sIq#Xc1h6cG`J6FMzAS~{57RUgV71Nk7$OI%yrCf;(3yxy2_>f8-QlSL@QiA#8{!0?R!9kIcM1)+vmGJYCxH{QMXG^6X^Q4~A zIkP>Zo$NfmhX3DTN?0v%{^}eM{0cw}SP5qW2OfW`n6Iu^r_Khmj+AAp|ITd7iDD@n z)~T{Z*K*yQk>?6tcER|_fDIYispgnwLEyq8QSK++9btFpvsOHrqMQ3L>v9V< z#_hK$Q;sS+pH!9e99)Ya@TTfuJh4Z}Wlx$TRIwcWTfB>;5x+~)%JkN=s{m(?;k$&7 z88)TDtP%iQzT*$`Vmj^8QPIA(6(a9%14i!Ym-v((t$QrYJA2%BxJMVf>r71^2<(OKLRPC+?aAFnzb?}r~dD0_`Z&(D8)70FW`JlKD! zwU#fuP5-P-oVF}bwcV@Rkmag_P9cfXjvwx}w!oV#!X>{{8WhKGpbh@U)0aObT=w0) z{hrs7iEF2Du2zP}jFV64iY;nb-*oeKO5fh+G4@+zzA>c<$%6CVuFS`Kmb}PRMIxss zw03L?@tbjfV)SrlA#+o+LkX)jE456${2&yZH^}LVWoGxRiqL-G-fCfGZx?37YYzRS zj31v-A3D+V$ENS2lkfQwVRM_Zw!Op8?wox0LelHM_Vi_+_l(Q;C#&pd1Evyb{C0ZU z%Xyw-&M5w5% zBm8NEhuS@AZIAt*o6+Oqi#r|S?!274T)6m-pg>thH5T6upA)z>=$Cgn3-Ual-SU}V z0P)eackU%$%NK6i@PKD=`Ylb#=XWgVm@ew(0mr7iKN`$qs|AnXksF?VDz{a#lVG=D zmg7K;=>A~Nd(>m+JA_1q)>E-LJVkLH7466BkStG<(BKBvp%SphXEc zD}5#2qn-mtx$r@dW-ul2Xp->05XcvTF=|gNiOUzvV>mL#8iIe`pVhi7Yx=AgGYb@3 zRGD727yieyU?pP)@WFfWr{oO%ObFvOI5#A?#9kRgI(7q3Y_aU;HKn$aTvLAi#D)Dm z#u?nO<&2qmy|jg@nKmrXW~>s#VpxAgFU=A~8QJQTN|*4ho! zgxE={Ss`b@_K%$8S6$WhpW67=uqqovwe@x-TXF&O`WsekV5A@5WU^*Sf2YA_AfJXb z+jwCETtq)0Kf;vXW`vG|%WDP@fUR^wkBItwob}=aJoMi~(kO1&Q8Nhw`Af`ZT#u>p#@teydC&W(2{7o+Q3dy@ zomt6ZwB6R6^xo*R-X#ukEWZJ09frkoUzM+;j-+F5lRGscYwRvQU1cKN2Z#)jcJJqz zBt7Gv6CT<017)i26d~lGmNf1@X3>EC4FN+vDg5Lx+t^z(lPU@8d7IrSX4JP|eM><1 zAu{%0m%O6*_`19L8genheJ< zatJVeR&{=s9AKryeU?9@lb(b6qJGUQ_L>J){c0PPz^>>@y_UqD#IX1K4p;c-caMG3 zxWJCY9UF#v3RkjxmU0&KHp-Mv(g%!&iov8$gXOzG+{KClwnR`r81m6eVfA8|!Rv6? z`L1Pk<^sVm!564EGH*pXre7S=oaAUS-eIxfh6|Z@hCyYMz-4f4bvu z8N^VRIM?cJvf^eB&#LJ%ON zBtRk*NJF3%#84W7a0EdCv;(sz#3)5tQ4+U;Cd7b35P>0j6dM&Lj*Pyi1hok- z007%C9^QjCicup#B~H@l)<>`(pJp=lK06-Z+XSpulnA(P_6{p|ZFXqTH%7l7E8LbJ K$Iw3f*M9)ZLfs?) literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/certs/carolCert.der b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/certs/carolCert.der new file mode 100644 index 0000000000000000000000000000000000000000..dd6f1877267670c7f244a35d8432eb18f5f6acab GIT binary patch literal 2400 zcma)+X;c$w8ilK}0ZB-z!oEln6s1LzBH~611O){}2na2xZ33ul3IViTx&;D=8#`*N z2n6xijvxps$DM!zW4jRCMqHp!K|~={VU;B{*!DTyb7p?b&*y#bckX?Ed>2VI*np%` zO_gL4NFwQf*Loo^tX4rm*ffR%4Wxjn%Gp#hNCl8pjtsFTj7ZD894!#DuRu3~ ze4=7^?BXSEPl$_+ShF)U){&2Jzplte=6?-&OMSf8tl}>u9YqU8 z$h-wkPV1&{@f0rj6OoYr+YCZjU(Fasdfyzp9j75yf7lxvhleJ_Z54kDkvNr15SI{v zq>@V!%fB55f`0=NNKPdyfQmqUd+yeM9%y`gIIQUm_;OA&t%YN|yR5-1Z^GjiGd+ysQ4EZU`Yh3b$Msw|dbB`{MwUjAC4TuD1;n}it*qoEu;=seJ9TmHVueHsO zuXm?3@gnEiZdsnMP^`9}1I=jYcU^o$RpeJcb2fi;h5e$84Q*#)`7vVWRYUPUnoKXo zmh+zX;0FJJ)Gg)}9xkRa<~#jr4E?G3hc-c*_=6GO zprS}Tsyv-#c~L7~_V8dMHFPFK^%VN<_P4xh_?)q0v;R($U+hW3kP{iHD|(ose1ArO zrF(eP!vZ-qxQDq(HRHYe`}n5o+pcHmt3xaHqGt=+D0Y_Uv#3j4m#UYhwtky&|BnsT zp`6HC6-?`{cwh_%EM1r0RMIr_$ldhMlm>LAsbiXmc2uo#0NQ^#hK8d zt9#JQjk}H?ORw@ipYgEvH;=vYIq$sW%xw{_rCmdx3w^6U%{xjbhh?<X9g(zgYkz=aOVMg>Q^vqs|?OuA>?_Fd-Wbd!@RS#+wwQqUV zdY}C)e|$w+MWyxrgo*Hw{7Btw?;ej`zI~Cb(}Bqkf9fSvRncvv)2mCouEd&A9Mr?) zFS72P5mnN~%|;;C?Q+VA`^TQczosvJS;f7YXjff+d-a0-=VSEFJjrKyMK>ptbWu&B z2;JRcyBA1nvdy|cZ%yg&(Rmpmcy!p^wWirmUO3l-CBEdfH(vu~iVQ@N_D79On@%xD zOjC?IeRgN1{cCla!@O65oP@2p3b*D<-vsbif#QFEcDJb}n8u|nLKYxSN|6%D5JYa@ zE_W6R!xOd&{<9c_f1xyNYgA&QU`q2}HAqgS%mpk`=2@m3w7@(KWyx6UHC)^}j#`cI zv|7Jo6Oy%Kl1rn-M+YE8D|RDmHuOjc3#FU2CU#KTs|6TLPB0@+1oBF_^7&T298^Vcn||E`mit4?JWvPZlB-XBQU6SnsK=ziGkgcfQ6GxmEfAT5 zt0GKDg#j1#^bGHW=Vt02ELW#!^B24i6ArF_fJ3r07TcRoX3TaUZtoRb%8uKPNYoh zfPvTZW3dLBNAH!)(VU!-YB3@F#Wc^Il{{kzntCpucw}rLduA{F(wFVe z+?Y5aTxi&m_C+M&vjRVdno+98COhdmDPaz!eHL^NC6B@vS7NuzP1N_>dfL)wD$EBpGD6+pL`LpQvy4%dL&2s{kYoesqAuqxawzCY4I2czm4e)CZw_ zw;L0_;`eo3WLET8RRdj?-Pit%B#Rl`_?jAa)*^Q?F1G>%W?glGl)S;W&<;BKZY-%_ zQYodz>P&b-^SX0p;{0(x&rX}nSChdMiRZ9_!>OFbad+xbCd@23G^FOfa|`9jBfCm` zaA6Kfx|Sx%B;!TTbHhPl$w*xpwQgck>^_kbt&dh2t8#(Ljy@p@VJJ@MFc@kDAWQ&3 zAP#a#EP%rW0T9F395oMz2pAy27!I%@LQAkv8w~(MlQvK%#3M*HS~ftiATEpx;0^*n z2^N5JP=JR6I1YiGwgUj0g+VZ2OK2d7gu{khfzXD<1Kx5wg%B49_){hX+XzGf0LB0a zgm}|&44uvbP>5{9A^`@7*~S<7yvs$sG5s+0vH=22{ArS0eBz`;vDQP zhkziQ#KyE37bajf$_62}5f{VYsb`%K3w?{>ys6wEjDZ{s#JFl;q3CL`hiP8xlA7gY lQj{I35y+ySl5Rcnj}7@3%@+iG7K!>eOOTURWuA$r{tbA*19AWW literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/private/carolKey.der b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.d/private/carolKey.der new file mode 100644 index 0000000000000000000000000000000000000000..a7feb85a88e2a9405f0593ea7e0a38da5d572317 GIT binary patch literal 1950 zcmZ8f4NOy46z(f+QCgKB1=gVqLb0JZ5W^HQ7+}%L1l9^_{h3e{3JeAs72Qy&wf-T- zRuJq!5P}3c5het6(-vsiR3iQnK~yr8Fmy675~t>M_uTi2&cn;Q=X~dU-*;|#fhzlx z9Il8%un1M9ADcEe|RGkZHqiyZX4o`pK~v-yV=SEH{y3g(2Sq`1gK!ZRKS z2P4MXOo=__E{`Z<*MvMXD?djzQtS9ikSM5Tj=BqkH+$N+W#>DS?1QQ=&l!K}E>oLk zhYw#96ioBlv!ppp8{jfecqTHVA)B96nLO3HIW(ZQy6zwUlSL5;hhyg#O2>tq1?()$>2{*Mq z`VXge=}T3ryFnc0n(4khzImFItv$3(%+0k<)%X>AmvBw`FJlsqf6hBtZ(ix*HPuia z@w)Q#5&pUHh{fFp&Fo}fM|N~T+zu(fZCWpP>n7>;Sw9My0rE19YUwa9NGs*a_>n2; z-MSq1>S5kSqtBDbC%Kl3Sr;`^dXf$KgSGlTmViHaH~kmSu*QB@@Ayq)(!bi9lAV>U zMkmgY;rdJ`S=1V}<&?$uc&GX~t9>xWb#!CxtnnVHpOf2zowdnx$4iG^B&~HwGu$mR zixjEN6%y6z@{XLEuvD%5Pv45)HfNUWzIiR-tm_|PglWJ`naZN3yK}=6q*~`JVf8yC+gqSTf|p{ z;^8b^$c5#}8`Vc<*KzpLcU6HpUb*qku|pcZs{PIL3680SBQBH{$CB*C^@$DX4|lef zh_)0RobU=PEZv{{0e3fJDsB*|kC>sk9RhkQ&lVTn%ej=*d)pyjv zCuJ-NH zy@s8BHRcW)c98XGhEn5Sb;Nm{bqSfZW@yML30wx>02 z2r|eouuhR*2RDYvq+ZI7n!{yj7_Sa|H*WA`lmt=J9W|HZapfs|xLU1qe z=I%Lb5|)itO%yNC$j34iovU1nZr=+v5vStpR{c7_V5yi46a>S{K#vtAa83qcMIBTF zi~>3+g+ZJ_3sPJHL}iF%V|>&@g9QB1dZ?Prum*a;i9ss?6^+oA-~i%OiFU(_qw>8D zr3oqsq^u@A00ebJ$3$?0Cbj|`>>#M_M?3^mveYes{6QcuR3nN_1Iy4ufZ>bN%D{sf z2SuY+LHk%??f(bflD;(Rz^(AeWKs<{@DzgRAw2C1!sPCQ1^Tx<(X+JrjbjagKQ$p}Cdi7b&jHbyXsE=})3Ss)BxSk)%- z{%S}Sg^iAeU=k2219>QI2Wn3)PXDL?+59jIiNh5pmFOjbiQ>H+-Wrvl1OF)KfEd(p N+D0iDq+x==_z&V5Jca-O literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..c2225646d --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: BLISS carolKey.der diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..ab824c993 --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/hosts/carol/etc/strongswan.conf @@ -0,0 +1,7 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = aes sha1 sha2 random nonce ntru bliss x509 revocation pem pkcs1 curl hmac stroke kernel-netlink socket-default updown + send_vendor_id = yes + fragment_size = 1500 +} diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.conf new file mode 100644 index 000000000..5f605a43d --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + ike=aes192-sha384-ntru192! + esp=aes192-sha384! + authby=pubkey + fragmentation=yes + +conn home + left=PH_IP_DAVE + leftsourceip=%config + leftcert=daveCert.der + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/cacerts/strongswan_blissCert.der b/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/cacerts/strongswan_blissCert.der new file mode 100644 index 0000000000000000000000000000000000000000..db397a78c80b4f30e1eed254a1c335b3566908c7 GIT binary patch literal 2317 zcmb_cX;c%37M>-EA%V;c5ilss1f#fAli*f7RaONQS;Z<+hzlxJ2&6953PLD|R3U)2 z7Ep+|p+$4tmnu=8f(sIq#Xc1h6cG`J6FMzAS~{57RUgV71Nk7$OI%yrCf;(3yxy2_>f8-QlSL@QiA#8{!0?R!9kIcM1)+vmGJYCxH{QMXG^6X^Q4~A zIkP>Zo$NfmhX3DTN?0v%{^}eM{0cw}SP5qW2OfW`n6Iu^r_Khmj+AAp|ITd7iDD@n z)~T{Z*K*yQk>?6tcER|_fDIYispgnwLEyq8QSK++9btFpvsOHrqMQ3L>v9V< z#_hK$Q;sS+pH!9e99)Ya@TTfuJh4Z}Wlx$TRIwcWTfB>;5x+~)%JkN=s{m(?;k$&7 z88)TDtP%iQzT*$`Vmj^8QPIA(6(a9%14i!Ym-v((t$QrYJA2%BxJMVf>r71^2<(OKLRPC+?aAFnzb?}r~dD0_`Z&(D8)70FW`JlKD! zwU#fuP5-P-oVF}bwcV@Rkmag_P9cfXjvwx}w!oV#!X>{{8WhKGpbh@U)0aObT=w0) z{hrs7iEF2Du2zP}jFV64iY;nb-*oeKO5fh+G4@+zzA>c<$%6CVuFS`Kmb}PRMIxss zw03L?@tbjfV)SrlA#+o+LkX)jE456${2&yZH^}LVWoGxRiqL-G-fCfGZx?37YYzRS zj31v-A3D+V$ENS2lkfQwVRM_Zw!Op8?wox0LelHM_Vi_+_l(Q;C#&pd1Evyb{C0ZU z%Xyw-&M5w5% zBm8NEhuS@AZIAt*o6+Oqi#r|S?!274T)6m-pg>thH5T6upA)z>=$Cgn3-Ual-SU}V z0P)eackU%$%NK6i@PKD=`Ylb#=XWgVm@ew(0mr7iKN`$qs|AnXksF?VDz{a#lVG=D zmg7K;=>A~Nd(>m+JA_1q)>E-LJVkLH7466BkStG<(BKBvp%SphXEc zD}5#2qn-mtx$r@dW-ul2Xp->05XcvTF=|gNiOUzvV>mL#8iIe`pVhi7Yx=AgGYb@3 zRGD727yieyU?pP)@WFfWr{oO%ObFvOI5#A?#9kRgI(7q3Y_aU;HKn$aTvLAi#D)Dm z#u?nO<&2qmy|jg@nKmrXW~>s#VpxAgFU=A~8QJQTN|*4ho! zgxE={Ss`b@_K%$8S6$WhpW67=uqqovwe@x-TXF&O`WsekV5A@5WU^*Sf2YA_AfJXb z+jwCETtq)0Kf;vXW`vG|%WDP@fUR^wkBItwob}=aJoMi~(kO1&Q8Nhw`Af`ZT#u>p#@teydC&W(2{7o+Q3dy@ zomt6ZwB6R6^xo*R-X#ukEWZJ09frkoUzM+;j-+F5lRGscYwRvQU1cKN2Z#)jcJJqz zBt7Gv6CT<017)i26d~lGmNf1@X3>EC4FN+vDg5Lx+t^z(lPU@8d7IrSX4JP|eM><1 zAu{%0m%O6*_`19L8genheJ< zatJVeR&{=s9AKryeU?9@lb(b6qJGUQ_L>J){c0PPz^>>@y_UqD#IX1K4p;c-caMG3 zxWJCY9UF#v3RkjxmU0&KHp-Mv(g%!&iov8$gXOzG+{KClwnR`r81m6eVfA8|!Rv6? z`L1Pk<^sVm!564EGH*pXre7S=oaAUS-eIxfh6|Z@hCyYMz-4f4bvu z8N^VRIM?cJvf^eB&#LJ%ON zBtRk*NJF3%#84W7a0EdCv;(sz#3)5tQ4+U;Cd7b35P>0j6dM&Lj*Pyi1hok- z007%C9^QjCicup#B~H@l)<>`(pJp=lK06-Z+XSpulnA(P_6{p|ZFXqTH%7l7E8LbJ K$Iw3f*M9)ZLfs?) literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/certs/daveCert.der b/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/certs/daveCert.der new file mode 100644 index 0000000000000000000000000000000000000000..379132b467361cc4ca9ed851b87d549718610bdd GIT binary patch literal 2400 zcma)+X;f2Z9>(8$vk=H~?Na`OW2<(NKQ$TCd7sv+>s!*!}%XA3YYiSrC|Bmz_2jEdZ{!;;OC3mnzP03 zVzJvIH!&`D_Y9wvUbE8UPl<>B-!Nkw{Rm@n4gVkn1_p|)am(KWm~dlu9N6jeM~dXx zXhLaHES^azo%R3v9R&TGfGLzriVRrZSZ0LcOJe;IYIdp z>pCSLDa!M{vA7JB*WFUlZw~y{N*kKFe~lL8e`$I)tyc6u|7ijFo@!v`cIo3xwNwJSzzpJ$W znfbi;#G&QPM@Am2)D;%fQB_g8iyy|h4>o=?Z*|exd%~gI9a+YjgE>hqrm& zk*tfG!`RVvGP`iSuJV_y9hsh&j=r#XmhtL(`Al@%w;>N4>d#c3^?H2RdoI7m!*c)6 zuYAv~b}5n5o>$xAZP!hnxYr$}A3VV`+rCp^>98id>D`YRHCOQGSEp0W18mqQp2uhX zjgPxTzhy~|)6-j{lw3$7zyDt9TU7=}YU<0&dulPs zp@*RXY2DR*bY4TPXZqFJ4Hid+)ng`S<{Vu9{c7(})37h+kF{=^sEAYD^4WgM?_vq< zk&PheW_W$~rVg)TN5S6VTtA0G#^Wp>bmP*1^A~D7OsX%{Zv3gjQ&w^9_#>C3l#25) z7t1C<%C5Cjw6Zr3c@d?%vBB(7NmN>1aqF)ubrRBTD(#ZA@zNEC#?9ZQ=FkUjZw!~% zYd(}cdunPt*ck_hFbbD;2{u2@yt2h)>5k!Ww(r^GEX9{amRL&PF|+Z@jJ9>M!?5|m z`p-67ZTsF~F!24F+sC%%+TY`@xaHVofBX~O)`zDGO-!y24}4Yi?eV5XH(z0StEd8( z&m8pcy8&YAvxfyeSL2-78K!%XTiG8^5daY5dFhv!+|j(8@(#>~jXe zpP(V9{To` z4ooFhR9{qWx!jdT)YVztQ zFNHd@_WN9E4mm8HA3U`n>c=oAXV8CoiCE`Zz0l+?(l+9Bs8CxQlu^{>doF9F&(Ja8 zYPl>2mu3FmBQ|rXJlrh9q<8J1+^iStvRoIu6y_)GDUf;Jug7g?_uK}fn&YOj|GDel zAALU66ZgQ~OWaEEqr%-ODT#|kqUfYO!vE|A(O)t$YEN8pvT*jzf7Ku*lR6&^wy3oQ zX0(u1)4^KJ$$Zm}R(8e>qk=p|hAk7A(}LE}r8xt4Q}mGq9~6_CrwG(?Pv6|jd^)3* zt>O|^V?EpK#g|7)_fKXl)etf2sOYKUE-PP-QEfMIVG#E5R*M>eh|4QX<%qqtSOr?+ z2YURw`75EP$yCt!TDn&qbi}gfwvjAY+nl8+ZR7GoATnh_l5C{((UvSgO5E+Rm6L^? z%vu>;e}oOHAR<6*>k8^x_3exi>Gz;+uQtKugDl&oxK#r+8j2uYLHKmg7K73iO!-m6 z{No_>z)+7RCQ0j$q+^k<%$BWSkiKS8E3B3@OH0J$Z)k#>6p{a+k1GppF-BIsXXAg6u3==#oGwt*a?vg{tZojBOBQ@B;O0+l3`FiUDu^!?zcL*>?XN2^m-3`GIH5rlL+xzVmp}C|X`2LtsXkgHMJYdaL}J68xH> zuQRE!X5no#qIGoHLPqUPT}z>5hGsgbaz=g&X8m2qd8XgTw;1gj`(mZaMm==#owYpJ zRNhS08!?C`HOXe80S3jTlvcE_J)Rp;#9byHlG{v3CIzLjyk3G)>SUE3!pVA#@Uu-x zXTjdjClc+41n*cS5%!5m1M)o#)cdXeytO{gToB2WT$yNjKu>3lCn&kX2Ebl87SU@{ zvYwVWZqUL5UuU{XWU-SHx0XV!-X$XW*@!jF`{xE}E7PnfA6& zpEit;F$(z$1O8l{Xx+HdN?B?#_T+&wGDq9%#(Xk7g-;LacdF#?oV!C{Orio5UNYSv zU1peJtQ~_WNQ4)Y4IJP9F?}KJ3c7%|GW>0by<^zaSqJocL0su(S&cR>;BM72bY0L*e zp~L{hM@Rx-dV*9EvqKVk0S5&z0V!Y=j6ehj;)pm1s(=-!Er%4U2xC+av2}WwA5xXL uH1sF>^k?pGBgzVtO^)*;EB*VI^4dO+y(U{Jl^?bqy$@bS&F|1DIsXDn;{3t@ literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/private/daveKey.der b/testing/tests/ikev2/rw-ntru-bliss/hosts/dave/etc/ipsec.d/private/daveKey.der new file mode 100644 index 0000000000000000000000000000000000000000..dfc623cad2b406364ce2df4f881269974a7cdaf6 GIT binary patch literal 1950 zcmXw12~bm46#e-LfhuUg$YvE(f?*MHLqKO-u!y*!2qI`FEGl4IT18n#MhHPsAX5|( za4lg+K#U+$aOr>xt*DF;wTcTAtO{)fmBsMWd*8#CJc8oQmRBS@2G&#I8rz<<6H@%74{N<9E+9 zQ-|o)3AaC~?#`aGmft)zd-IHZ-`e^Vvtq>nziZW&AaO(3Xn?=fu(w0lu@8pM8T}7z zBa81OJi7L(w8F8$q)mUwG$YZvKL5pWWzwaWT^kHmJKfGJQ$`28*(%D_g&FSoY#-Pf zy5gYco3)E$ZG6KA3#%igtb@mD6SoPTLGPU=e0^ZTo?R^tmy2v3k8gjK9=Brr-El6f zh6*h{hZKi!X9qt_y5o1k(K|2amebpe;AE5Gn3QIIxkspH?>5(KvUL$N41zVs6q%d2 zq9;MEa@T@Gk1QT0c2uZFLz_xkH7Uj6L#4nv`Rq0~6?{UZSTyOjH7xmi9ra3oN zi0>_^J|v7uH#gnB!`f1^M$z!*W@2Tjb9?#cSTnDwM(OR5$%n0+?L+@Il%)v|HirB= zi8p-l_PZ!I>D-cc!e{5sWIv6Ym@?Dm2ltHb4JDdNJiQc((L@)n! zv-!8bgd6uL{*i?wD9<(i`3)y~KW`+VAgaEgR8k*sIW|Suebp~eW-~mP|M31~lb*H+ z*2f@oiN-phMP9m9yd=0c&}ezi-sG1@@+^&`J5xrfj<+=~?}5 z&DGSP44Ye%R@T~TY|>_NLCsm2VsS-p_tE0hX$^~NI*gU81lIPuZFRDt^#xhICxi*= zxh2Q6md0z$M=Yj?uS|cauv5*9+*x!#@@Ztw>kJ3#+Drux z<`hS~&HS`~x}w_UhH!M^yzdf>7GBj~DU}SIvOam# zvAE}0ZueSVoFvodIVz^aE*xwV|6XFd&Bdu@*U`WFeE0GfiLi(C|x*$^Av|&vd|NSVH2m38mlnCA{SC22@RlwDbAC!4n0!iI7dL#1e6Je z#RJm?-a+e2hTe!gWy7Q6hfLuUkR-zjhvc}8Y10b;YQjid1D3-shof|m`h+4*6K|x> z>2w@91xgV+w22|TFN7fthu2MyPo$xWSAsrJnqcrH;D3M*HI`vnd?)y$4-P_(;RNLB zIhLbO=s}TXNd^c4qD?4qgax<=2W8VMst6Tp-EA%V;c5ilss1f#fAli*f7RaONQS;Z<+hzlxJ2&6953PLD|R3U)2 z7Ep+|p+$4tmnu=8f(sIq#Xc1h6cG`J6FMzAS~{57RUgV71Nk7$OI%yrCf;(3yxy2_>f8-QlSL@QiA#8{!0?R!9kIcM1)+vmGJYCxH{QMXG^6X^Q4~A zIkP>Zo$NfmhX3DTN?0v%{^}eM{0cw}SP5qW2OfW`n6Iu^r_Khmj+AAp|ITd7iDD@n z)~T{Z*K*yQk>?6tcER|_fDIYispgnwLEyq8QSK++9btFpvsOHrqMQ3L>v9V< z#_hK$Q;sS+pH!9e99)Ya@TTfuJh4Z}Wlx$TRIwcWTfB>;5x+~)%JkN=s{m(?;k$&7 z88)TDtP%iQzT*$`Vmj^8QPIA(6(a9%14i!Ym-v((t$QrYJA2%BxJMVf>r71^2<(OKLRPC+?aAFnzb?}r~dD0_`Z&(D8)70FW`JlKD! zwU#fuP5-P-oVF}bwcV@Rkmag_P9cfXjvwx}w!oV#!X>{{8WhKGpbh@U)0aObT=w0) z{hrs7iEF2Du2zP}jFV64iY;nb-*oeKO5fh+G4@+zzA>c<$%6CVuFS`Kmb}PRMIxss zw03L?@tbjfV)SrlA#+o+LkX)jE456${2&yZH^}LVWoGxRiqL-G-fCfGZx?37YYzRS zj31v-A3D+V$ENS2lkfQwVRM_Zw!Op8?wox0LelHM_Vi_+_l(Q;C#&pd1Evyb{C0ZU z%Xyw-&M5w5% zBm8NEhuS@AZIAt*o6+Oqi#r|S?!274T)6m-pg>thH5T6upA)z>=$Cgn3-Ual-SU}V z0P)eackU%$%NK6i@PKD=`Ylb#=XWgVm@ew(0mr7iKN`$qs|AnXksF?VDz{a#lVG=D zmg7K;=>A~Nd(>m+JA_1q)>E-LJVkLH7466BkStG<(BKBvp%SphXEc zD}5#2qn-mtx$r@dW-ul2Xp->05XcvTF=|gNiOUzvV>mL#8iIe`pVhi7Yx=AgGYb@3 zRGD727yieyU?pP)@WFfWr{oO%ObFvOI5#A?#9kRgI(7q3Y_aU;HKn$aTvLAi#D)Dm z#u?nO<&2qmy|jg@nKmrXW~>s#VpxAgFU=A~8QJQTN|*4ho! zgxE={Ss`b@_K%$8S6$WhpW67=uqqovwe@x-TXF&O`WsekV5A@5WU^*Sf2YA_AfJXb z+jwCETtq)0Kf;vXW`vG|%WDP@fUR^wkBItwob}=aJoMi~(kO1&Q8Nhw`Af`ZT#u>p#@teydC&W(2{7o+Q3dy@ zomt6ZwB6R6^xo*R-X#ukEWZJ09frkoUzM+;j-+F5lRGscYwRvQU1cKN2Z#)jcJJqz zBt7Gv6CT<017)i26d~lGmNf1@X3>EC4FN+vDg5Lx+t^z(lPU@8d7IrSX4JP|eM><1 zAu{%0m%O6*_`19L8genheJ< zatJVeR&{=s9AKryeU?9@lb(b6qJGUQ_L>J){c0PPz^>>@y_UqD#IX1K4p;c-caMG3 zxWJCY9UF#v3RkjxmU0&KHp-Mv(g%!&iov8$gXOzG+{KClwnR`r81m6eVfA8|!Rv6? z`L1Pk<^sVm!564EGH*pXre7S=oaAUS-eIxfh6|Z@hCyYMz-4f4bvu z8N^VRIM?cJvf^eB&#LJ%ON zBtRk*NJF3%#84W7a0EdCv;(sz#3)5tQ4+U;Cd7b35P>0j6dM&Lj*Pyi1hok- z007%C9^QjCicup#B~H@l)<>`(pJp=lK06-Z+XSpulnA(P_6{p|ZFXqTH%7l7E8LbJ K$Iw3f*M9)ZLfs?) literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.d/certs/moonCert.der b/testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.d/certs/moonCert.der new file mode 100644 index 0000000000000000000000000000000000000000..af4f7d792fc1d9beea038ca105231d655e3e7ebf GIT binary patch literal 2420 zcma)+X;c$g9>rf}g9J!bL6k*F1)4=sNd;WdCLj$80>%afZH0ie3ylc~?u;aeO1lBl zpdySxv|B`EQCzz&pAD3WfB4&MlFMbDe}qUKPv$A# zydKY_myYXyehz~E4QLE{CS3{A$n4ANY}qbEdc(`Vh~`q=SlGylTwH#iT*)r2&vAb_ zeSY;<6*hNJuD!k6z2r$TTU{5jahrWx2aByIJq&Z?eT{tgs$oh&^U163Atkk;KV4oN z6699+E}@8aa3L?Dal-SP4)jaU;y5bpyRW) zi}v(EqGv^7P$dhDP6V!!f7!==}|5`sInYAw&GwCp|-ovbU17QLkB z?+w4VFL?H=kmjVY1L5<=Vxz8|ucVFs+Q5ij{nNcCWyyh;=QhRlvy!faP_8af%7ZhF zC+fZ>>XzRS6y#nj-^F=g+BUgTc@3*a z?QW#-4r)pQwNXV5)+sn-2B_wEbqUBpHZB)nqyaCWWG?^ejn=X)G|HF zGhBPQw|2EI&;0)Tq=bS+!BX|)vSNoRF1a~tn=D5ucCp*N)6@)Ah33n#-~*xHS`#{1Rx@W;msejoE3I{bqV%;X%CiLHkLLFAr|9|MGOf)f+OU zq(J}TTtyf5CgFNt<`@E@>(zY!tt2G9H73%8!z2ly|<5OZpj(;5-dU|#L zlq1Ru3B#G`V@&U}8;}1B7MMqnkHRj+}gb{yEjRB}aYk`mYVdJzhMtU47zb*5fMO_WKvA!)U#x zC;ny1B3yawpEct61;Y-XsNm^BcO2gH_pm+FyxTl;HYepO#Sbpw{P8_^L>adDgv|fB z>o%WtSB53dVVRG&8Ix&7hj8)dA;y@C&&Fq}yj1u;&kbp5$v#5i+RaJ-Q5M2KyCXI} zX=7@t=lGrfsz!PyV+Jr~RGSSMDRT z>WF@>Zoo^{w{(m33==1#9!m)^bl8~-&yb!sbxt8YntaGuhW7)An=UWHRI`gNSq|h=^*S^5?JFR84Fy|$99uF<1^2=ad-X3y zB=-Pvi=}NxbFw&c_6N*J=>_j(D?SRWCzte$QoB2DA2N=qMil2*sw?m7r(&h~b|7-3 z{rD&B$5y9MR=cmc@Cz7S+G%BHcJXezCh)!dZojl=Sda?Er4QBL9rRl=kWy|gs_O+t zx-JI-K^%Vc*eQU74e;t~=ox!Jtk9s>vV;{5rO|`(Cv?9FAF(eiq$|5~u3G$TpyHO% zQAVr&thwgWC>qe+P-=dpr0jze>rW_T`!9M4$7 zB|7~Qlj3hi?NM6Q2ve@?Y>=A7n+V|#Z<}ClsS9=MG0$%*L5S!ohGj;PL26*;-ZAC1 zeX2U|EZ)G=D0x-cL%TH}mg)%68dGvPS$)CKX!ScGAFf#jiQ52{YG@qhC%>V^?6Z)D zamkxz3eRTXV~doI>0esM>F8Lk342Z{{C@XSy_3xAq+XN!i>_dS*{#G;eUGhZ!l1<3 z;dU@nUTNa9ITVMRtfc!M`=ofr|d)M_F=m2A%F-3nW5KnX7{tArK6-PAIIW0Ln*!0EH0&r3b(oU;>EbB07j>1xPLc2nJ}7UJE0Di)kTDfKdp6 znoyj8ggOMGFcLy(fYbsA1q4^q2*4OdeY^vN~MjTPOYn|R<4Q*bNgX2ojbv%+ce|Fgw6JiS6;05 zzbY~JmOF}>O^2jqVOI13dB4Tspg%*G`7KE+bxus1Quj;I6Nx;j+H6oL9(7tbv-qH0 zbhhC*fzu*c-b4|NGi7t6|n)>Ls-7S0JfsDm!>63*UdbYV# z*ahXry%e-u7HmBI@#2#>sklF;w?eL(_+iR&_qTrU7v(OsQpdMm<$D+xuWq>#yW`y} z?>?vP13l86lH0c)cFB$%dglBghhL`n+*WVi_0#cy-F?b{`JH+hiIS$H;zbWUJEFXk zBum*4|GF|2qj`9r7Z7-+>5g)@sCr3T=zD{x-#s}iOMhANx9Xglt$){i-(a4ZR#zG~ z_Qq)9)U~V4x3q1FNbxls_s@BUzkG}y#FX^qB&dYLE0f+Wy&tHV-mr(C+*2Ux^`Bk7 zxi-C~zb3vQSQIbrcw8cP{84i1aPj!X)63QR?Xqddyc}nB+569x^i~g51@@(nX?`6g z&2$%UX`G?VH?gryOAT)u_h0`SyM0-fBbScvO$`<0Z4Ov2+;(zbPj^WC-8tb#^KKk{ z9;x5wakjX%zwGf-w>(9@u&FyGaz&-5$~agRS?FmUy2}1#N7FP#aTLu_ zuyL?*9Ar6;rr?D;%+n0!;Q$YAc+0RPq&NnP@BtoDqdky%;H6mPh6uF~LDL)!1Uj^? z4l4nO^gss?vM~q;C{ch*(jjZ!5EHsL*{{$Fcz&>xX{^0b={CCc}}CZHocVT>BW4CqUT1*=F$ z6oHG-q6Fy$U84^qCk}OBjgE~_>y%+|00tt41%GhR>VaX%A_ppyR*?!~w4+;b4v^7M zFnn^v0wChyJSi3(6F9a3XH2jx7{fGv5`+;DX%uyINuVW`$>@n?7A>MX_+%Plp8X#= CJga>G literal 0 HcmV?d00001 diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..b4a9ee68d --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: BLISS moonKey.der diff --git a/testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..ab824c993 --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/hosts/moon/etc/strongswan.conf @@ -0,0 +1,7 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = aes sha1 sha2 random nonce ntru bliss x509 revocation pem pkcs1 curl hmac stroke kernel-netlink socket-default updown + send_vendor_id = yes + fragment_size = 1500 +} diff --git a/testing/tests/ikev2/rw-ntru-bliss/posttest.dat b/testing/tests/ikev2/rw-ntru-bliss/posttest.dat new file mode 100644 index 000000000..9ba8c5f55 --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/posttest.dat @@ -0,0 +1,9 @@ +carol::ipsec stop +dave::ipsec stop +moon::ipsec stop +moon::iptables-restore < /etc/iptables.flush +carol::iptables-restore < /etc/iptables.flush +dave::iptables-restore < /etc/iptables.flush +moon::rm /etc/ipsec.d/cacerts/strongswan_blissCert.der +carol::rm /etc/ipsec.d/cacerts/strongswan_blissCert.der +dave::rm /etc/ipsec.d/cacerts/strongswan_blissCert.der diff --git a/testing/tests/ikev2/rw-ntru-bliss/pretest.dat b/testing/tests/ikev2/rw-ntru-bliss/pretest.dat new file mode 100644 index 000000000..24249435e --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/pretest.dat @@ -0,0 +1,13 @@ +moon::iptables-restore < /etc/iptables.rules +carol::iptables-restore < /etc/iptables.rules +dave::iptables-restore < /etc/iptables.rules +moon::rm /etc/ipsec.d/cacerts/strongswanCert.pem +carol::rm /etc/ipsec.d/cacerts/strongswanCert.pem +dave::rm /etc/ipsec.d/cacerts/strongswanCert.pem +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up home +dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/rw-ntru-bliss/test.conf b/testing/tests/ikev2/rw-ntru-bliss/test.conf new file mode 100644 index 000000000..164b07ff9 --- /dev/null +++ b/testing/tests/ikev2/rw-ntru-bliss/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon alice" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave"