denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Reorganizing IKEv1 and IKEv2 examples

Browse Source 
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen
2021-05-21 09:42:50 +02:00
parent db93938297
commit 7c5a2974b9
4054 changed files with 16375 additions and 15209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/rw-eap-tls-radius/description.txt
+5 -3
View File
@@ -1,5 +1,7 @@
The roadwarrior <b>carol</b> sets up a connection to gateway <b>moon</b>.
At the outset the gateway authenticates itself to the client by sending
an IKEv2 <b>RSA signature</b> accompanied by a certificate.
<b>carol</b> then uses a mutual <b>EAP-TLS</b> authentication based
on X.509 certificates with the remote AAA RADIUS server <b>alice</b>.
an IKEv2 <b>digital signature</b> accompanied by an X.509 certificate.
<p/>
Next <b>carol</b> uses a mutual <b>EAP-TLS</b> authentication based
on X.509 certificates. The gateway forwards all EAP messages to the
AAA RADIUS server <b>alice</b>.
testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat
+2 -2
View File
@@ -2,8 +2,8 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, C
carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, OU=Research, [email protected]' with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=C=CH, O=strongSwan Project, OU=Research, [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=C=CH, O=strongSwan Project, CN=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-eap.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=C=CH, O=strongSwan Project, CN=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=C=CH, O=strongSwan Project, OU=Research, [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
testing/tests/ikev2/rw-eap-tls-radius/hosts/carol/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
leftauth=eap
leftfirewall=yes
right=PH_IP_MOON
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
rightsubnet=10.1.0.0/16
rightauth=pubkey
aaa_identity="C=CH, O=strongSwan Project, CN=aaa.strongswan.org"
auto=add
testing/tests/ikev2/rw-eap-tls-radius/hosts/carol/etc/strongswan.conf
+8 -3
View File
@@ -1,8 +1,13 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 mfg1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-tls updown
multiple_authentication=no
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 mgf1 gmp x509 curl revocation hmac vici kernel-netlink socket-default eap-tls updown
multiple_authentication = no
syslog {
daemon {
tls = 2
testing/tests/ikev2/rw-eap-tls-radius/hosts/carol/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = eap
certs = carolCert.pem
aaa_id = "C=CH, O=strongSwan Project, CN=aaa.strongswan.org"
}
remote {
auth = pubkey
id = "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn rw-eap
left=PH_IP_MOON
leftsubnet=10.1.0.0/16
leftcert=moonCert.pem
leftauth=pubkey
leftfirewall=yes
rightid="C=CH, O=strongSwan Project, OU=Research, [email protected]"
rightauth=eap-radius
rightsendcert=never
right=%any
auto=add
testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/ipsec.secrets
-3
View File
@@ -1,3 +0,0 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
: RSA moonKey.pem
testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/strongswan.conf
+7 -4
View File
@@ -1,12 +1,15 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-radius updown
multiple_authentication=no
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 mgf1 gmp x509 curl revocation hmac vici kernel-netlink socket-default eap-radius updown
plugins {
eap-radius {
secret = gv6URkSs
secret = gv6URkSs
server = PH_IP_ALICE
}
}
testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/swanctl/swanctl.conf
Executable
+26
View File
@@ -0,0 +1,26 @@
connections {
rw-eap {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
}
remote {
auth = eap-radius
id = "C=CH, O=strongSwan Project, OU=Research, [email protected]"
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
send_certreq = no
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/rw-eap-tls-radius/posttest.dat
+2 -2
View File
@@ -1,5 +1,5 @@
moon::ipsec stop
carol::ipsec stop
carol::systemctl stop strongswan
moon::systemctl stop strongswan
alice::killall freeradius
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/rw-eap-tls-radius/pretest.dat
+3 -3
View File
@@ -1,8 +1,8 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
alice::freeradius
moon::ipsec start
carol::ipsec start
moon::systemctl start strongswan
carol::systemctl start strongswan
moon::expect-connection rw-eap
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/rw-eap-tls-radius/test.conf
+3
View File
@@ -24,3 +24,6 @@ IPSECHOSTS="moon carol"
#
RADIUSHOSTS="alice"
# charon controlled by swanctl
#
SWANCTL=1