denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Reorganizing IKEv1 and IKEv2 examples

Browse Source 
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen
2021-05-21 09:42:50 +02:00
parent db93938297
commit 7c5a2974b9
4054 changed files with 16375 additions and 15209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/ocsp-root-cert/description.txt
+3 -4
View File
@@ -1,8 +1,7 @@
By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on
By setting <b>revocation = strict</b>, a <b>strict</b> CRL policy is enforced on
both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status
is checked via the OCSP server <b>winnetou</b> which uses the <b>strongSwan CA</b>'s
private key to sign OCSP responses. A <b>strongswan ca</b> section in ipsec.conf
defines an <b>OCSP URI</b> pointing to <b>winnetou</b>.
<p>
private key to sign OCSP responses.
<p/>
<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since
the status of both certificates is <b>good</b>.
testing/tests/ikev2/ocsp-root-cert/evaltest.dat
+2 -2
View File
@@ -1,3 +1,5 @@
moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
moon:: cat /var/log/daemon.log::requesting ocsp status::YES
moon:: cat /var/log/daemon.log::ocsp response correctly signed by::YES
moon:: cat /var/log/daemon.log::ocsp response is valid::YES
@@ -6,5 +8,3 @@ carol::cat /var/log/daemon.log::requesting ocsp status::YES
carol::cat /var/log/daemon.log::ocsp response correctly signed by::YES
carol::cat /var/log/daemon.log::ocsp response is valid::YES
carol::cat /var/log/daemon.log::certificate status is good::YES
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf
-25
View File
@@ -1,25 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
strictcrlpolicy=yes
ca strongswan
cacert=strongswanCert.pem
ocspuri=http://ocsp.strongswan.org:8880
auto=add
conn %default
keyexchange=ikev2
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
[email protected]
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 gmp curve25519 x509 curl revocation hmac kernel-netlink socket-default vici
}
testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/swanctl/swanctl.conf
Executable
+35
View File
@@ -0,0 +1,35 @@
authorities {
strongswan {
cacert = strongswanCert.pem
ocsp_uris = http://ocsp.strongswan.org:8880
}
}
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
revocation = strict
}
children {
home {
remote_ts = 10.1.0.0/16
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf
-24
View File
@@ -1,24 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
strictcrlpolicy=yes
ca strongswan-ca
cacert=strongswanCert.pem
ocspuri=http://ocsp.strongswan.org:8880
auto=add
conn %default
keyexchange=ikev2
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
[email protected]
leftsubnet=10.1.0.0/16
right=%any
auto=add
testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 gmp curve25519 x509 curl revocation hmac kernel-netlink socket-default vici
}
testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/swanctl/swanctl.conf
Executable
+25
View File
@@ -0,0 +1,25 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
revocation = strict
}
children {
net {
local_ts = 10.1.0.0/16
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi → testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+1 -1
View File
@@ -1,6 +1,6 @@
#!/bin/bash
cd /etc/openssl
cd /etc/ca
echo "Content-type: application/ocsp-response"
echo ""
testing/tests/ikev2/ocsp-root-cert/posttest.dat
+3 -2
View File
@@ -1,2 +1,3 @@
moon::ipsec stop
carol::ipsec stop
carol::systemctl stop strongswan
moon::systemctl stop strongswan
moon::iptables -F
testing/tests/ikev2/ocsp-root-cert/pretest.dat
+4 -3
View File
@@ -1,5 +1,6 @@
moon::ipsec start
carol::ipsec start
moon::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j REJECT --reject-with tcp-reset
moon::systemctl start strongswan
carol::systemctl start strongswan
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/ocsp-root-cert/test.conf
+3
View File
@@ -19,3 +19,6 @@ TCPDUMPHOSTS=""
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
# charon controlled by swanctl
SWANCTL=1