testing: Add scenarios that use a CA with two intermediate CA certificates

Mainly to test TKM's ability for handling multiple CAs and that the received intermediate CA certificates are passed in the right order. But also added a regular scenario where two intermediate CA certificates are sent by one of the clients.
2021-01-11 15:28:10 +01:00
parent 16fcdb460a
commit 5ef10ec326
23 changed files with 489 additions and 2 deletions
@@ -1,2 +1,3 @@
 *.der
+*.pem
 strongswan.conf
@@ -0,0 +1,6 @@
+Two transport connections to gateway <b>moon</b> are set up, one from client
+<b>carol</b> and the other from client <b>dave</b>. The gateway <b>moon</b> uses
+the Trusted Key Manager (TKM) and is the responder for both connections. The
+authentication is based on X.509 certificates, where <b>carol</b> uses a
+certificate issued by a multi-level CA. In order to test the connections,
+both <b>carol</b> and <b>dave</b> ping gateway <b>moon</b>.
@@ -0,0 +1,19 @@
+moon::  swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.100/32]::YES
+moon::  swanctl --list-sas --raw 2> /dev/null::conn2.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn2.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.200/32]::YES
+carol::swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.100/32] remote-ts=\[192.168.0.1/32]::YES
+dave:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.200/32] remote-ts=\[192.168.0.1/32]::YES
+carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_.eq=1::YES
+dave::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_.eq=1::YES
+carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+dave::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+dave::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
+moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.100 \]::YES
+moon::cat /tmp/tkm.log::Adding policy \[ 2, 192.168.0.1 <-> 192.168.0.200 \]::YES
+moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 2::YES
+moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
+moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::2
+moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
+moon::cat /tmp/tkm.log::Authentication of ISA context 2 successful::YES
+moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.100, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
@@ -0,0 +1,25 @@
+connections {
+
+  host-host {
+    local_addrs  = PH_IP_CAROL
+    remote_addrs = PH_IP_MOON
+
+    proposals = aes256-sha512-modp4096
+
+    local {
+      auth = pubkey
+      certs = carolCert.pem
+      id = [email protected]
+    }
+    remote {
+      auth = pubkey
+      id = moon.strongswan.org
+    }
+    children {
+      host-host {
+        mode = transport
+        esp_proposals = aes256-sha512-modp4096
+      }
+    }
+  }
+}
@@ -0,0 +1,25 @@
+connections {
+
+  host-host {
+    local_addrs  = PH_IP_DAVE
+    remote_addrs = PH_IP_MOON
+
+    proposals = aes256-sha512-modp4096
+
+    local {
+      auth = pubkey
+      certs = daveCert.pem
+      id = [email protected]
+    }
+    remote {
+      auth = pubkey
+      id = moon.strongswan.org
+    }
+    children {
+      host-host {
+        mode = transport
+        esp_proposals = aes256-sha512-modp4096
+      }
+    }
+  }
+}
@@ -0,0 +1,21 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon-tkm {
+  dh_mapping {
+    15 = 1
+    16 = 2
+  }
+  ca_mapping {
+    strongswan_ca {
+      id = 1
+      fingerprint = CA_SPK_HEX
+    }
+    levels_ca {
+      id = 2
+      fingerprint = LEVELS_SPK_HEX
+    }
+  }
+  start-scripts {
+    swanctl = /usr/local/sbin/swanctl --load-all --noprompt
+  }
+}
@@ -0,0 +1,36 @@
+<tkmconfig>
+    <local_identity id="1">
+        <identity>moon.strongswan.org</identity>
+        <certificate>moonCert.pem</certificate>
+    </local_identity>
+    <policy id="1">
+        <mode>transport</mode>
+        <local>
+            <identity_id>1</identity_id>
+            <ip>192.168.0.1</ip>
+        </local>
+        <remote>
+            <identity>[email protected]</identity>
+            <ip>192.168.0.100</ip>
+        </remote>
+        <lifetime>
+            <soft>30</soft>
+            <hard>60</hard>
+        </lifetime>
+    </policy>
+    <policy id="2">
+        <mode>transport</mode>
+        <local>
+            <identity_id>1</identity_id>
+            <ip>192.168.0.1</ip>
+        </local>
+        <remote>
+            <identity>[email protected]</identity>
+            <ip>192.168.0.200</ip>
+        </remote>
+        <lifetime>
+            <soft>30</soft>
+            <hard>60</hard>
+        </lifetime>
+    </policy>
+</tkmconfig>
@@ -0,0 +1,7 @@
+moon::service charon-tkm stop
+moon::killall tkm_keymanager
+moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
+carol::systemctl stop strongswan
+dave::systemctl stop strongswan
+moon::rm /etc/swanctl/x509ca/*
+carol::rm /etc/swanctl/x509ca/*
@@ -0,0 +1,14 @@
+moon::rm /etc/swanctl/rsa/*
+moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/swanctl/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
+moon::cat /etc/swanctl/swanctl.conf
+moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1,/etc/tkm/levelsCert.der:2 >/tmp/tkm.log 2>&1 &
+moon::expect-file /tmp/tkm.rpc.ike
+moon::service charon-tkm start
+carol::systemctl start strongswan
+carol::expect-connection host-host
+dave::systemctl start strongswan
+dave::expect-connection host-host
+moon::expect-connection conn1
+moon::expect-connection conn2
+carol::swanctl --initiate --child host-host 2> /dev/null
+dave::swanctl --initiate --child host-host 2> /dev/null
@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="carol dave moon winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="carol dave"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="carol dave moon"
+
+# charon controlled by swanctl
+#
+SWANCTL=1