denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Reorganizing IKEv1 and IKEv2 examples

Browse Source 
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen
2021-05-21 09:42:50 +02:00
parent db93938297
commit 7c5a2974b9
4054 changed files with 16375 additions and 15209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat
+4 -6
View File
@@ -1,12 +1,10 @@
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
carol::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
moon:: cat /var/log/daemon.log::EAP method EAP_MD5 succeeded, no MSK established
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-eap.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
testing/tests/ikev2/rw-eap-md5-rsa/hosts/carol/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=PH_IP_CAROL
[email protected]
leftauth=eap
leftfirewall=yes
right=PH_IP_MOON
[email protected]
rightsubnet=10.1.0.0/16
rightauth=pubkey
auto=add
testing/tests/ikev2/rw-eap-md5-rsa/hosts/carol/etc/ipsec.secrets
-3
View File
@@ -1,3 +0,0 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
[email protected] : EAP "Ar3etTnp"
testing/tests/ikev2/rw-eap-md5-rsa/hosts/carol/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-md5 updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default eap-md5 updown
}
testing/tests/ikev2/rw-eap-md5-rsa/hosts/carol/etc/swanctl/swanctl.conf
Executable
+34
View File
@@ -0,0 +1,34 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = eap
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
secrets {
eap-carol {
id = [email protected]
secret = Ar3etTnp
}
}
testing/tests/ikev2/rw-eap-md5-rsa/hosts/moon/etc/ipsec.conf
-23
View File
@@ -1,23 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn rw-eap
left=PH_IP_MOON
leftsubnet=10.1.0.0/16
[email protected]
leftcert=moonCert.pem
leftauth=pubkey
leftfirewall=yes
rightid=*@strongswan.org
rightauth=eap-md5
rightsendcert=never
right=%any
auto=add
testing/tests/ikev2/rw-eap-md5-rsa/hosts/moon/etc/ipsec.secrets
-5
View File
@@ -1,5 +0,0 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
: RSA moonKey.pem
[email protected] : EAP "Ar3etTnp"
testing/tests/ikev2/rw-eap-md5-rsa/hosts/moon/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-md5 updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default eap-md5 updown
}
testing/tests/ikev2/rw-eap-md5-rsa/hosts/moon/etc/swanctl/swanctl.conf
Executable
+39
View File
@@ -0,0 +1,39 @@
connections {
rw-eap {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = eap-md5
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-x25519
}
}
secrets {
eap-carol {
id = [email protected]
secret = Ar3etTnp
}
eap-dave {
id = [email protected]
secret = W7R0g3do
}
}
testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat
+3 -2
View File
@@ -1,4 +1,5 @@
moon::ipsec stop
carol::ipsec stop
carol::swanctl --terminate --ike home
carol::systemctl stop strongswan
moon::systemctl stop strongswan
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat
+4 -3
View File
@@ -1,7 +1,8 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::cd /etc/swanctl; rm rsa/* x509/*
moon::systemctl start strongswan
carol::systemctl start strongswan
moon::expect-connection rw-eap
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/rw-eap-md5-rsa/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
# charon controlled by swanctl
#
SWANCTL=1