testing: Added RFC4806 tests
This commit is contained in:
Andreas Steffen
committed by
Tobias Brunner
Tobias Brunner
parent
15612b3a42
commit
6f8275abab
@@ -675,7 +675,7 @@ cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem
|
||||
|
||||
# Put a copy into the following ikev2 scenarios
|
||||
for t in ocsp-timeouts-good ocsp-disabled ocsp-no-signer-cert ocsp-root-cert \
|
||||
ocsp-untrusted-cert
|
||||
ocsp-untrusted-cert ocsp-rfc4806-signer ocsp-rfc4806-both
|
||||
do
|
||||
TEST="${TEST_DIR}/ikev2/${t}"
|
||||
mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa
|
||||
@@ -707,12 +707,15 @@ pki --self --type rsa --in ${TEST_KEY} --flag ocspSigning \
|
||||
--dn "C=CH, O=${PROJECT}, OU=${OU}, CN=${CN}" \
|
||||
--outform pem > ${TEST_CERT}
|
||||
|
||||
# Copy self-signed OCSP Signing certificate to ikev2/ocsp-local-cert scenario
|
||||
TEST="${TEST_DIR}/ikev2/ocsp-local-cert"
|
||||
mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ocsp
|
||||
mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ocsp
|
||||
cp ${TEST_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ocsp
|
||||
cp ${TEST_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ocsp
|
||||
# Put a copy into the following ikev2 scenarios
|
||||
for t in ocsp-local-cert ocsp-rfc4806-local
|
||||
do
|
||||
TEST="${TEST_DIR}/ikev2/${t}"
|
||||
mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ocsp
|
||||
mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ocsp
|
||||
cp ${TEST_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ocsp
|
||||
cp ${TEST_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ocsp
|
||||
done
|
||||
|
||||
# Generate mars virtual server certificate
|
||||
TEST="${TEST_DIR}/ha/both-active"
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
By setting <b>revocation = strict</b> in swanctl.conf, a <b>strict</b> CRL policy
|
||||
is enforced on both roadwarrior <b>carol</b> and gateway <b>moon</b>.
|
||||
<p/>
|
||||
Based on RFC 4806, both <b>carol</b> and <b>moon</b> send an OCSP request via an
|
||||
IKEv2 CERTREQ payload to their peer which in turn requests online status information
|
||||
on its own certificate from the OCSP server <b>winnetou</b> on behalf of the other
|
||||
peer. The OCSP server <b>winnetou</b> possesses an OCSP signer certificate containing
|
||||
an <b>OCSPSigning</b> Extended Key Usage (EKU) flag issued by the strongSwan CA.
|
||||
<p/>
|
||||
<b>carol</b>'s certificate includes an <b>OCSP URI</b> in an authority information
|
||||
access extension pointing to <b>winnetou</b>. Therefore no special authorities
|
||||
section information is needed in carol's swanctl.conf.
|
||||
<p/>
|
||||
<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since
|
||||
the status of both certificates is <b>good</b>.
|
||||
@@ -0,0 +1,17 @@
|
||||
moon::swanctl --list-authorities 2> /dev/null::ocsp_uris: http://ocsp.strongswan.org:8880::YES
|
||||
moon:: cat /var/log/daemon.log::received empty OCSP cert request::YES
|
||||
moon:: cat /var/log/daemon.log::received OCSP response issued by::YES
|
||||
moon:: cat /var/log/daemon.log::requesting ocsp status::YES
|
||||
moon:: cat /var/log/daemon.log::ocsp response correctly signed by::YES
|
||||
moon:: cat /var/log/daemon.log::ocsp response is valid::2
|
||||
moon:: cat /var/log/daemon.log::certificate status is good::YES
|
||||
moon:: cat /var/log/daemon.log::sending OCSP status for certificate::YES
|
||||
carol::swanctl --list-authorities 2> /dev/null::ocsp_uris: http://ocsp.strongswan.org:8880::NO
|
||||
carol::cat /var/log/daemon.log::received empty OCSP cert request::YES
|
||||
carol::cat /var/log/daemon.log::requesting ocsp status::YES
|
||||
carol::cat /var/log/daemon.log::sending OCSP status for certificate::YES
|
||||
carol::cat /var/log/daemon.log::received OCSP response issued by::YES
|
||||
carol::cat /var/log/daemon.log::ocsp response is valid::2
|
||||
carol::cat /var/log/daemon.log::certificate status is good::YES
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
revocation = strict
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
ocsp = both
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
revocation = strict
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
ocsp = both
|
||||
}
|
||||
}
|
||||
|
||||
authorities {
|
||||
|
||||
strongswan {
|
||||
cacert = strongswanCert.pem
|
||||
ocsp_uris = http://ocsp.strongswan.org:8880
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
carol::swanctl --terminate --ike home
|
||||
carol::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
@@ -0,0 +1,5 @@
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home
|
||||
@@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="moon carol winnetou"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="m-c-w.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS=""
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
@@ -0,0 +1,15 @@
|
||||
By setting <b>revocation = strict</b> in swanctl.conf, a <b>strict</b> CRL policy
|
||||
is enforced on both roadwarrior <b>carol</b> and gateway <b>moon</b>.
|
||||
<p/>
|
||||
Based on RFC 4806, <b>carol</b> sends an OCSP request via an IKEv2 CERTREQ payload to
|
||||
gateway <b>moon</b> which in turn requests online status information on its own
|
||||
certificate from the OCSP server <b>winnetou</b> on behalf of <b>carol</b>.
|
||||
The OCSP server <b>winnetou</b> possesses a <b>self-signed</b> OCSP signer certificate
|
||||
that must be imported locally by the peers into the <b>/etc/swanctl/x509ocsp/</b>
|
||||
directory.
|
||||
<p/>
|
||||
An <b>authorities</b> section in <b>moon</b>'s swanctl.conf defines an <b>OCSP URI</b>
|
||||
pointing to the OCSP server <b>winnetou</b>.
|
||||
<p/>
|
||||
<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since
|
||||
the status of both certificates is <b>good</b>.
|
||||
@@ -0,0 +1,14 @@
|
||||
moon::swanctl --list-authorities 2> /dev/null::ocsp_uris: http://ocsp.strongswan.org:8880::YES
|
||||
moon:: cat /var/log/daemon.log::received OCSP cert request claiming trust for::YES
|
||||
moon:: cat /var/log/daemon.log::requesting ocsp status from::2
|
||||
moon:: cat /var/log/daemon.log::ocsp response correctly signed by.*OCSP Self-Signed Authority::2
|
||||
moon:: cat /var/log/daemon.log::ocsp response is valid::2
|
||||
moon:: cat /var/log/daemon.log::certificate status is good::YES
|
||||
moon:: cat /var/log/daemon.log::sending OCSP status for certificate::YES
|
||||
carol::swanctl --list-authorities 2> /dev/null::ocsp_uris: http://ocsp.strongswan.org:8880::NO
|
||||
carol::cat /var/log/daemon.log::sending OCSP cert request with self-signed OCSP-signer::YES
|
||||
carol::cat /var/log/daemon.log::received OCSP response issued by::YES
|
||||
carol::cat /var/log/daemon.log::ocsp response is valid::YES
|
||||
carol::cat /var/log/daemon.log::certificate status is good::YES
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
revocation = strict
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
ocsp = request
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
revocation = strict
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
ocsp = reply
|
||||
}
|
||||
}
|
||||
|
||||
authorities {
|
||||
|
||||
strongswan {
|
||||
cacert = strongswanCert.pem
|
||||
ocsp_uris = http://ocsp.strongswan.org:8880
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
#!/bin/bash
|
||||
|
||||
cd /etc/ca
|
||||
|
||||
echo "Content-type: application/ocsp-response"
|
||||
echo ""
|
||||
|
||||
cat | pki --ocsp --respond --cacert strongswanCert.pem --index index.txt \
|
||||
--cert ocspCert-self.pem --key ocspKey-self.pem --lifetime 5 --debug 0
|
||||
@@ -0,0 +1,4 @@
|
||||
carol::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
carol::rm /etc/swanctl/x509ocsp/*
|
||||
moon::rm /etc/swanctl/x509ocsp/*
|
||||
@@ -0,0 +1,5 @@
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home
|
||||
@@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="moon carol winnetou"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="m-c-w.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS=""
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
@@ -0,0 +1,16 @@
|
||||
By setting <b>revocation = strict</b> in swanctl.conf, a <b>strict</b> CRL policy
|
||||
is enforced on both roadwarrior <b>carol</b> and gateway <b>moon</b>.
|
||||
<p/>
|
||||
Based on RFC 4806, <b>carol</b> sends an OCSP request via an IKEv2 CERTREQ payload to
|
||||
gateway <b>moon</b> which in turn requests online status information on its own
|
||||
certificate from the OCSP server <b>winnetou</b> on behalf of <b>carol</b>.
|
||||
The OCSP server <b>winnetou</b> possesses an OCSP signer certificate containing an
|
||||
<b>OCSPSigning</b> Extended Key Usage (EKU) flag issued by the strongSwan CA.
|
||||
<p/>
|
||||
Even though <b>carol</b>'s certificate includes an <b>OCSP URI</b> in an authority
|
||||
information access extension pointing to <b>winnetou</b>, gateway <b>moon</b> still
|
||||
needs a special authorities section in swanctl.conf in order to be able to request
|
||||
an OCSP response for its own certificate since that is lacking an <b>OCSP URI</b>.
|
||||
<p/>
|
||||
<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since
|
||||
the status of both certificates is <b>good</b>.
|
||||
@@ -0,0 +1,13 @@
|
||||
moon::swanctl --list-authorities 2> /dev/null::ocsp_uris: http://ocsp.strongswan.org:8880::YES
|
||||
moon:: cat /var/log/daemon.log::received empty OCSP cert request::YES
|
||||
moon:: cat /var/log/daemon.log::requesting ocsp status::2
|
||||
moon:: cat /var/log/daemon.log::ocsp response correctly signed by::2
|
||||
moon:: cat /var/log/daemon.log::ocsp response is valid::2
|
||||
moon:: cat /var/log/daemon.log::certificate status is good::YES
|
||||
moon:: cat /var/log/daemon.log::sending OCSP status for certificate::YES
|
||||
carol::swanctl --list-authorities 2> /dev/null::ocsp_uris: http://ocsp.strongswan.org:8880::NO
|
||||
carol::cat /var/log/daemon.log::received OCSP response issued by::YES
|
||||
carol::cat /var/log/daemon.log::ocsp response is valid::YES
|
||||
carol::cat /var/log/daemon.log::certificate status is good::YES
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
revocation = strict
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
ocsp = request
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
|
||||
}
|
||||
+34
@@ -0,0 +1,34 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
revocation = strict
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
ocsp = reply
|
||||
}
|
||||
}
|
||||
|
||||
authorities {
|
||||
|
||||
strongswan {
|
||||
cacert = strongswanCert.pem
|
||||
ocsp_uris = http://ocsp.strongswan.org:8880
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
carol::swanctl --terminate --ike home
|
||||
carol::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
@@ -0,0 +1,5 @@
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home
|
||||
@@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="moon carol winnetou"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="m-c-w.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS=""
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
Reference in New Issue
Block a user