gcrypt: Remove limited crypto plugin
This has not seen any significant changes for years. So it lacks support for modern algorithms and would require quite some work for an overhaul. Given that we support several other crypto backends, let's just remove this to reduce the maintenance burden. The test scenarios and other references are also removed.
This commit is contained in:
Tobias Brunner
@@ -19,13 +19,4 @@ charon {
|
||||
}
|
||||
}
|
||||
|
||||
swanctl {
|
||||
plugins {
|
||||
# disabled because of entropy issues
|
||||
gcrypt {
|
||||
load = no
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
include strongswan.conf
|
||||
|
||||
@@ -48,7 +48,7 @@ esac
|
||||
SERVICES="apache2 dbus isc-dhcp-server slapd bind9 freeradius"
|
||||
INC=$INC,${SERVICES// /,}
|
||||
# packages to install via APT, for SWIMA tests
|
||||
APT1="libgcrypt20-dev traceroute iptables"
|
||||
APT1="traceroute iptables"
|
||||
APT="tmux"
|
||||
# additional services to disable
|
||||
case "$BASEIMGSUITE" in
|
||||
|
||||
@@ -68,7 +68,6 @@ CONFIG_OPTS = \
|
||||
--enable-leak-detective \
|
||||
--enable-load-tester \
|
||||
--enable-test-vectors \
|
||||
--enable-gcrypt \
|
||||
--enable-socket-default \
|
||||
--enable-socket-dynamic \
|
||||
--enable-dhcp \
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the strong cipher suite
|
||||
<b>serpent256-sha512-modp4096</b> for the IKE protocol and <b>serpent256-sha512</b>
|
||||
for ESP packets. A ping from <b>carol</b> to <b>alice</b> successfully checks the
|
||||
established tunnel.
|
||||
@@ -1,7 +0,0 @@
|
||||
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=1 state=ESTABLISHED local-host=192.168.0.100 local-port=500 [email protected] remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=SERPENT_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=SERPENT_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=1 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=500 [email protected].*encr-alg=SERPENT_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=SERPENT_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
carol::ip xfrm state::enc cbc(serpent)::YES
|
||||
moon:: ip xfrm state::enc cbc(serpent)::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES
|
||||
@@ -1,10 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = nonce pem pkcs1 gcrypt hmac kdf x509 revocation curl vici kernel-netlink socket-default
|
||||
send_vendor_id = yes
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = serpent256-sha512
|
||||
}
|
||||
}
|
||||
version = 1
|
||||
proposals = serpent256-sha512-modp4096
|
||||
}
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = nonce pem pkcs1 gcrypt hmac kdf x509 revocation vici kernel-netlink socket-default
|
||||
send_vendor_id = yes
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = serpent256-sha512
|
||||
}
|
||||
}
|
||||
version = 1
|
||||
proposals = serpent256-sha512-modp4096
|
||||
}
|
||||
}
|
||||
@@ -1,2 +0,0 @@
|
||||
carol::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
@@ -1,5 +0,0 @@
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
@@ -1,25 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
@@ -1,4 +0,0 @@
|
||||
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the strong cipher suite
|
||||
<b>twofish256-sha512-modp4096</b> for the IKE protocol and <b>twofish256-sha512</b>
|
||||
for ESP packets. A ping from <b>carol</b> to <b>alice</b> successfully checks the
|
||||
established tunnel.
|
||||
@@ -1,7 +0,0 @@
|
||||
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=1 state=ESTABLISHED local-host=192.168.0.100 local-port=500 [email protected] remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=TWOFISH_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=TWOFISH_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=1 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=500 [email protected].*encr-alg=TWOFISH_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=TWOFISH_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
carol::ip xfrm state::enc cbc(twofish)::YES
|
||||
moon:: ip xfrm state::enc cbc(twofish)::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES
|
||||
@@ -1,10 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = nonce pem pkcs1 gcrypt hmac kdf x509 revocation curl vici kernel-netlink socket-default
|
||||
send_vendor_id = yes
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = twofish256-sha512
|
||||
}
|
||||
}
|
||||
version = 1
|
||||
proposals = twofish256-sha512-modp4096
|
||||
}
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = nonce pem pkcs1 gcrypt hmac kdf x509 revocation vici kernel-netlink socket-default
|
||||
send_vendor_id = yes
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
esp_proposals = twofish256-sha512
|
||||
}
|
||||
}
|
||||
version = 1
|
||||
proposals = twofish256-sha512-modp4096
|
||||
}
|
||||
}
|
||||
@@ -1,2 +0,0 @@
|
||||
carol::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
@@ -1,5 +0,0 @@
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
@@ -1,25 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
@@ -1,3 +0,0 @@
|
||||
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the IKE cipher suite
|
||||
<b>camellia256-sha512-modp3072</b> as well as the ESP cipher suite <b>camellia192-sha384</b>.
|
||||
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
|
||||
@@ -1,7 +0,0 @@
|
||||
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon:: swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
moon:: ip xfrm state::enc cbc(camellia)::YES
|
||||
carol::ip xfrm state::enc cbc(camellia)::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES
|
||||
@@ -1,9 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce pem pkcs1 gcrypt hmac kdf x509 revocation kernel-netlink curl socket-default updown vici
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = camellia192-sha384
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = camellia256-sha512-modp3072
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce pem pkcs1 gcrypt hmac kdf x509 revocation kernel-netlink curl socket-default updown vici
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = camellia192-sha384
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = camellia256-sha512-modp3072
|
||||
}
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
carol::swanctl --terminate --ike home
|
||||
carol::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
@@ -1,7 +0,0 @@
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
moon::expect-connection net
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
@@ -1,25 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
@@ -1,11 +0,0 @@
|
||||
The roadwarrior <b>carol</b> and the gateway <b>moon</b> use the <b>gcrypt</b>
|
||||
plugin based on the <b>GNU Libgcrypt</b> library for all cryptographical functions
|
||||
whereas roadwarrior <b>dave</b> uses <b>openssl</b> as the default <b>strongSwan</b>
|
||||
cryptographical plugin.
|
||||
<p>
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
|
||||
to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
|
||||
Upon the successful establishment of the IPsec tunnels, the <b>updown</b> directive
|
||||
in swanctl.conf automatically inserts iptables-based firewall rules that let pass the
|
||||
tunneled traffic. In order to test both tunnel and firewall, both <b>carol</b> and
|
||||
<b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>.
|
||||
@@ -1,10 +0,0 @@
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
|
||||
@@ -1,13 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = curl test-vectors pem pkcs1 gcrypt nonce x509 revocation hmac kdf xcbc ctr ccm gcm vici kernel-netlink socket-default updown
|
||||
integrity_test = yes
|
||||
crypto_test {
|
||||
on_add = yes
|
||||
}
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = 3des-sha1-modp1536
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = 3des-sha1-modp1536
|
||||
}
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = test-vectors pem pkcs1 random nonce openssl curl revocation xcbc vici stroke kernel-netlink socket-default updown
|
||||
integrity_test = yes
|
||||
crypto_test {
|
||||
required = yes
|
||||
on_add = yes
|
||||
}
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.200
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = daveCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = curl test-vectors pem pkcs1 gcrypt nonce x509 revocation hmac kdf xcbc ctr ccm gcm vici kernel-netlink socket-default updown
|
||||
integrity_test = yes
|
||||
crypto_test {
|
||||
on_add = yes
|
||||
}
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128-sha256-modp3072,3des-sha1-modp1536
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-modp3072,3des-sha1-modp1536
|
||||
}
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
carol::swanctl --terminate --ike home
|
||||
dave::swanctl --terminate --ike home
|
||||
carol::systemctl stop strongswan
|
||||
dave::systemctl stop strongswan
|
||||
moon::systemctl stop strongswan
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
@@ -1,11 +0,0 @@
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
dave::systemctl start strongswan
|
||||
moon::expect-connection net
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
dave::expect-connection home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
@@ -1,25 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou dave"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w-d.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol dave"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
Reference in New Issue
Block a user