denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adapted scenarios to new crypto proposal output

Browse Source
This commit is contained in:
Andreas Steffen
2009-05-20 07:51:25 +02:00
parent 80cbbfed36
commit 706fd144fe
41 changed files with 97 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev1/esp-alg-strict/description.txt
+4 -4
View File
@@ -1,7 +1,7 @@
Roadwarrior <b>carol</b> proposes <b>3DES</b> encryption (together with
SHA-1 authentication) in the first place and <b>AES-128</b> encryption in
Roadwarrior <b>carol</b> proposes <b>3DES_CBC</b> encryption (together with
HMAC_SHA1 authentication) in the first place and <b>AES_CBC_128</b> encryption in
second place for both the ISAKMP and IPsec SAs. Gateway <b>moon</b> defines
<b>ike=aes-128-sha</b> but will accept any other supported algorithm proposed
<b>ike=aes128-sha1</b> but will accept any other supported algorithm proposed
by the peer during Phase 1. But for ESP encryption <b>moon</b> enforces
<b>esp=aes-128-sha1!</b> by applying the strict flag '!'.
<b>esp=aes128-sha1!</b> by applying the strict flag '!'.
testing/tests/ikev1/esp-alg-strict/evaltest.dat
+5 -5
View File
@@ -1,7 +1,7 @@
carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES
moon::cat /var/log/auth.log::IPSec Transform.*ESP_3DES (192), AUTH_ALGORITHM_HMAC_SHA1.*refused due to strict flag::YES
moon::ipsec statusall::IKE algorithm newest: 3DES_CBC_192-SHA::YES
moon::ipsec statusall::ESP algorithm newest: AES_128-HMAC_SHA1::YES
carol::ipsec statusall::IKE algorithm newest: 3DES_CBC_192-SHA::YES
carol::ipsec statusall::ESP algorithm newest: AES_128-HMAC_SHA1::YES
moon::cat /var/log/auth.log::IPSec Transform.*3DES_CBC (192), HMAC_SHA1.*refused due to strict flag::YES
moon::ipsec statusall::IKE proposal: 3DES_CBC/HMAC_SHA1::YES
moon::ipsec statusall::ESP proposal: AES_CBC_128/HMAC_SHA1::YES
carol::ipsec statusall::IKE proposal: 3DES_CBC/HMAC_SHA1::YES
carol::ipsec statusall::ESP proposal: AES_CBC_128/HMAC_SHA1::YES
testing/tests/ikev1/esp-alg-strict/hosts/carol/etc/ipsec.conf
+2 -2
View File
@@ -11,8 +11,8 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
ike=3des-sha,aes-128-sha
esp=3des-sha1,aes-128-sha1
ike=3des-sha,aes128-sha1
esp=3des-sha1,aes128-sha1
conn home
left=PH_IP_CAROL
testing/tests/ikev1/esp-alg-strict/hosts/moon/etc/ipsec.conf
+1 -1
View File
@@ -11,7 +11,7 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
ike=aes128-sha
ike=aes128-sha1
esp=aes128-sha1!
conn rw