denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Changed gcrypt-ikev1 scenarios to swanctl

Browse Source
This commit is contained in:
Andreas Steffen
2016-05-15 19:02:57 +02:00
parent 141ac4df8f
commit 78adb5a7b1
20 changed files with 148 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat
+2 -8
View File
@@ -1,12 +1,6 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: SERPENT_CBC_256/HMAC_SHA2_512_256::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: SERPENT_CBC_256/HMAC_SHA2_512_256::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ipsec statusall 2> /dev/null::SERPENT_CBC_256/HMAC_SHA2_512_256,::YES carol::swanctl --list-sas --raw 2> /dev/null::home.*version=1 state=ESTABLISHED local-host=192.168.0.100 local-port=500 [email protected] remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=SERPENT_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=SERPENT_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
moon:: ipsec statusall 2> /dev/null::SERPENT_CBC_256/HMAC_SHA2_512_256,::YES moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=1 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=500 [email protected].*encr-alg=SERPENT_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=SERPENT_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
carol::ip xfrm state::enc cbc(serpent)::YES carol::ip xfrm state::enc cbc(serpent)::YES
moon:: ip xfrm state::enc cbc(serpent)::YES moon:: ip xfrm state::enc cbc(serpent)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES
testing/tests/gcrypt-ikev1/alg-serpent/hosts/carol/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
ike=serpent256-sha512-modp4096!
esp=serpent256-sha512!
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
[email protected]
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/tests/gcrypt-ikev1/alg-serpent/hosts/carol/etc/strongswan.conf
+6 -3
View File
@@ -1,8 +1,11 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = curl pem pkcs1 gcrypt nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown load = nonce pem pkcs1 gcrypt hmac x509 revocation curl vici kernel-netlink socket-default
send_vendor_id = yes
dh_exponent_ansi_x9_42 = no start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
send_vendor_id = yes
} }
testing/tests/gcrypt-ikev1/alg-serpent/hosts/carol/etc/swanctl/swanctl.conf
Executable
+26
View File
@@ -0,0 +1,26 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
esp_proposals = serpent256-sha512
}
}
version = 1
proposals = serpent256-sha512-modp4096
}
}
testing/tests/gcrypt-ikev1/alg-serpent/hosts/moon/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
ike=serpent256-sha512-modp4096!
esp=serpent256-sha512!
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
[email protected]
leftsubnet=10.1.0.0/16
right=%any
[email protected]
auto=add
testing/tests/gcrypt-ikev1/alg-serpent/hosts/moon/etc/strongswan.conf
+6 -3
View File
@@ -1,8 +1,11 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = curl pem pkcs1 gcrypt nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown load = nonce pem pkcs1 gcrypt hmac x509 revocation vici kernel-netlink socket-default
send_vendor_id = yes
dh_exponent_ansi_x9_42 = no start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
send_vendor_id = yes
} }
testing/tests/gcrypt-ikev1/alg-serpent/hosts/moon/etc/swanctl/swanctl.conf
Executable
+24
View File
@@ -0,0 +1,24 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
esp_proposals = serpent256-sha512
}
}
version = 1
proposals = serpent256-sha512-modp4096
}
}
testing/tests/gcrypt-ikev1/alg-serpent/posttest.dat
+2 -2
View File
@@ -1,2 +1,2 @@
moon::ipsec stop moon::service charon stop
carol::ipsec stop carol::service charon stop
testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat
+5 -5
View File
@@ -1,5 +1,5 @@
moon::ipsec start moon::service charon start 2> /dev/null
carol::ipsec start carol::service charon start 2> /dev/null
moon::expect-connection rw moon::expect-connection rw
carol::expect-connection home carol::expect-connection home
carol::ipsec up home carol::swanctl --initiate --child home 2> /dev/null
testing/tests/gcrypt-ikev1/alg-serpent/test.conf
+3
View File
@@ -20,3 +20,6 @@ TCPDUMPHOSTS="moon"
# #
IPSECHOSTS="moon carol" IPSECHOSTS="moon carol"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat
+2 -8
View File
@@ -1,12 +1,6 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES carol::swanctl --list-sas --raw 2> /dev/null::home.*version=1 state=ESTABLISHED local-host=192.168.0.100 local-port=500 [email protected] remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=TWOFISH_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=TWOFISH_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
moon:: ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=1 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=500 [email protected].*encr-alg=TWOFISH_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=TWOFISH_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
carol::ip xfrm state::enc cbc(twofish)::YES carol::ip xfrm state::enc cbc(twofish)::YES
moon:: ip xfrm state::enc cbc(twofish)::YES moon:: ip xfrm state::enc cbc(twofish)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES
testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
ike=twofish256-sha512-modp4096!
esp=twofish256-sha512!
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
[email protected]
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/strongswan.conf
+6 -3
View File
@@ -1,8 +1,11 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = curl pem pkcs1 gcrypt nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown load = nonce pem pkcs1 gcrypt hmac x509 revocation curl vici kernel-netlink socket-default
send_vendor_id = yes
dh_exponent_ansi_x9_42 = no start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
send_vendor_id = yes
} }
testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/swanctl/swanctl.conf
Executable
+26
View File
@@ -0,0 +1,26 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
esp_proposals = twofish256-sha512
}
}
version = 1
proposals = twofish256-sha512-modp4096
}
}
testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
ike=twofish256-sha512-modp4096!
esp=twofish256-sha512!
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
[email protected]
leftsubnet=10.1.0.0/16
right=%any
[email protected]
auto=add
testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/strongswan.conf
+6 -3
View File
@@ -1,8 +1,11 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = curl pem pkcs1 gcrypt nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown load = nonce pem pkcs1 gcrypt hmac x509 revocation vici kernel-netlink socket-default
send_vendor_id = yes
dh_exponent_ansi_x9_42 = no start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
send_vendor_id = yes
} }
testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/swanctl/swanctl.conf
Executable
+24
View File
@@ -0,0 +1,24 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
esp_proposals = twofish256-sha512
}
}
version = 1
proposals = twofish256-sha512-modp4096
}
}
testing/tests/gcrypt-ikev1/alg-twofish/posttest.dat
+2 -2
View File
@@ -1,2 +1,2 @@
moon::ipsec stop moon::service charon stop
carol::ipsec stop carol::service charon stop
testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat
+5 -5
View File
@@ -1,5 +1,5 @@
moon::ipsec start moon::service charon start 2> /dev/null
carol::ipsec start carol::service charon start 2> /dev/null
moon::expect-connection rw moon::expect-connection rw
carol::expect-connection home carol::expect-connection home
carol::ipsec up home carol::swanctl --initiate --child home 2> /dev/null
testing/tests/gcrypt-ikev1/alg-twofish/test.conf
+3
View File
@@ -20,3 +20,6 @@ TCPDUMPHOSTS="moon"
# #
IPSECHOSTS="moon carol" IPSECHOSTS="moon carol"
# charon controlled by swanctl
#
SWANCTL=1