From 8484f2bc5c89ee909e999bd5363229cd23b75eb6 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Mon, 28 Jan 2013 11:58:03 +0100 Subject: [PATCH] Implement multiple-clients integration test Two transport connections to gateway sun are set up, one from client carol and the other from client dave. The gateway sun uses the Trusted Key Manager (TKM) and is the responder for both connections. The authentication is based on X.509 certificates. In order to test the connections, both carol and dave ping gateway sun. --- .../tkm/multiple-clients/description.txt | 5 +++ .../tests/tkm/multiple-clients/evaltest.dat | 23 +++++++++++ .../hosts/carol/etc/ipsec.conf | 22 +++++++++++ .../hosts/carol/etc/strongswan.conf | 5 +++ .../hosts/dave/etc/ipsec.conf | 22 +++++++++++ .../hosts/dave/etc/strongswan.conf | 5 +++ .../hosts/sun/etc/tkm/strongswanCert.der | Bin 0 -> 956 bytes .../hosts/sun/etc/tkm/sunKey.der | Bin 0 -> 1192 bytes .../hosts/sun/etc/tkm/tkm.conf | 36 ++++++++++++++++++ .../tests/tkm/multiple-clients/posttest.dat | 5 +++ .../tests/tkm/multiple-clients/pretest.dat | 14 +++++++ testing/tests/tkm/multiple-clients/test.conf | 21 ++++++++++ 12 files changed, 158 insertions(+) create mode 100644 testing/tests/tkm/multiple-clients/description.txt create mode 100644 testing/tests/tkm/multiple-clients/evaltest.dat create mode 100644 testing/tests/tkm/multiple-clients/hosts/carol/etc/ipsec.conf create mode 100644 testing/tests/tkm/multiple-clients/hosts/carol/etc/strongswan.conf create mode 100644 testing/tests/tkm/multiple-clients/hosts/dave/etc/ipsec.conf create mode 100644 testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf create mode 100644 testing/tests/tkm/multiple-clients/hosts/sun/etc/tkm/strongswanCert.der create mode 100644 testing/tests/tkm/multiple-clients/hosts/sun/etc/tkm/sunKey.der create mode 100644 testing/tests/tkm/multiple-clients/hosts/sun/etc/tkm/tkm.conf create mode 100644 testing/tests/tkm/multiple-clients/posttest.dat create mode 100644 testing/tests/tkm/multiple-clients/pretest.dat create mode 100644 testing/tests/tkm/multiple-clients/test.conf diff --git a/testing/tests/tkm/multiple-clients/description.txt b/testing/tests/tkm/multiple-clients/description.txt new file mode 100644 index 000000000..c8e72d51d --- /dev/null +++ b/testing/tests/tkm/multiple-clients/description.txt @@ -0,0 +1,5 @@ +Two transport connections to gateway sun are set up, one from client +carol and the other from client dave. The gateway sun uses +the Trusted Key Manager (TKM) and is the responder for both connections. The +authentication is based on X.509 certificates. In order to test the connections, +both carol and dave ping gateway sun. diff --git a/testing/tests/tkm/multiple-clients/evaltest.dat b/testing/tests/tkm/multiple-clients/evaltest.dat new file mode 100644 index 000000000..8e0042102 --- /dev/null +++ b/testing/tests/tkm/multiple-clients/evaltest.dat @@ -0,0 +1,23 @@ +sun::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*sun.strongswan.org.*carol.strongswan.org::YES +sun::ipsec stroke status 2> /dev/null::conn2.*ESTABLISHED.*sun.strongswan.org.*dave.strongswan.org::YES +carol::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*carol.strongswan.org.*sun.strongswan.org::YES +dave::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*dave.strongswan.org.*sun.strongswan.org::YES +sun::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES +sun::ipsec stroke status 2> /dev/null::conn2.*INSTALLED, TRANSPORT::YES +carol::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES +dave::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES +carol::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES +dave::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES +carol::tcpdump::IP carol.strongswan.org > sun.strongswan.org: ESP::YES +carol::tcpdump::IP sun.strongswan.org > carol.strongswan.org: ESP::YES +dave::tcpdump::IP dave.strongswan.org > sun.strongswan.org: ESP::YES +dave::tcpdump::IP sun.strongswan.org > dave.strongswan.org: ESP::YES +sun::cat /tmp/tkm.log::RSA private key '/etc/tkm/sunKey.der' loaded::YES +sun::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.2 <-> 192.168.0.100 \]::YES +sun::cat /tmp/tkm.log::Adding policy \[ 2, 192.168.0.2 <-> 192.168.0.200 \]::YES +sun::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES +sun::cat /tmp/tkm.log::Checked CA certificate of CC context 2::YES +sun::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES +sun::cat /tmp/tkm.log::Authentication of ISA context 2 successful::YES +sun::cat /tmp/tkm.log::Adding SA \[ 1, 192.168.0.2 <-> 192.168.0.100, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES +sun::cat /tmp/tkm.log::Adding SA \[ 2, 192.168.0.2 <-> 192.168.0.200, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES diff --git a/testing/tests/tkm/multiple-clients/hosts/carol/etc/ipsec.conf b/testing/tests/tkm/multiple-clients/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..10ee3e89d --- /dev/null +++ b/testing/tests/tkm/multiple-clients/hosts/carol/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + mobike=no + +conn host-host + left=PH_IP_CAROL + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_SUN + rightid=sun.strongswan.org + ike=aes256-sha512-modp4096! + esp=aes256-sha512-modp4096! + type=transport + auto=add diff --git a/testing/tests/tkm/multiple-clients/hosts/carol/etc/strongswan.conf b/testing/tests/tkm/multiple-clients/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..ca23c6971 --- /dev/null +++ b/testing/tests/tkm/multiple-clients/hosts/carol/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown +} diff --git a/testing/tests/tkm/multiple-clients/hosts/dave/etc/ipsec.conf b/testing/tests/tkm/multiple-clients/hosts/dave/etc/ipsec.conf new file mode 100644 index 000000000..6ba0a97ce --- /dev/null +++ b/testing/tests/tkm/multiple-clients/hosts/dave/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + mobike=no + +conn host-host + left=PH_IP_DAVE + leftcert=daveCert.pem + leftid=dave@strongswan.org + right=PH_IP_SUN + rightid=sun.strongswan.org + ike=aes256-sha512-modp4096! + esp=aes256-sha512-modp4096! + type=transport + auto=add diff --git a/testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf b/testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf new file mode 100644 index 000000000..ca23c6971 --- /dev/null +++ b/testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown +} diff --git a/testing/tests/tkm/multiple-clients/hosts/sun/etc/tkm/strongswanCert.der b/testing/tests/tkm/multiple-clients/hosts/sun/etc/tkm/strongswanCert.der new file mode 100644 index 0000000000000000000000000000000000000000..a5a631f4b5f8b29a990ab4b075e44e0d961c6286 GIT binary patch literal 956 zcmXqLV%}lU#I#@mGZP~d6C;BGFB_*;n@8JsUPeZ4Rt5uCLv903Hs(+kHen`b4?{@< zaS(?~SimPUue3s;xTGjQFFm+CG0#xiKoTUyEG&c&R0zt?FHvxIG>{YLH83%-G&C?Y zFfcTDv^20ZFo$xfWla;K60!#vSs9p{82K3tni#p5niv@w_J4{`dSx4y7qR(7 zmFKC?YZA||OfE0>ZPDHQ<8R&qVr3m&D^Z!e>5hr^J|7ip;*q&X7;J9nJMy%`F{u86ZU_r zKi%fNl%kd_PMW94}Puv*8AYCiO2emHylag=VxMO zWMEv}xXGY#y@3!gwq%7F8UM3z7_b2;CPqdBZjcy13kxtYuo=jLID9N(EF!VX?-sBH z8r41Dmb-cD(+3H!^nBkN;%VE(+*PTKbXwG3(qzs@zZJ zGO5X|urkr(i+z5@#=OMO{@h~8a)ncZEmz)8dA9F0uZpn zO<5(yvOZRAu^X3LC!@PVa?^LSM*f5(vbm~p5 zWc{Ll0keeWtb7-8Uz_hvj;%$Qzkq7qpBwv{HoZxiUT2jb_hH7X-cgKSDpyrPU4_8&;z1F`NCRR+Rq*;w6RFPqY?O->fH_wYHIDX;#T z*pI3-$*eJ;_~;JLSckCtDgTA>`5==^EtGOuU#^Mm(`yxW;MWjkci}1I>h=|}8TAE} zr4$po7il)%`1OmiL!U!>W<4Pm@UpUk9DODlvTP07o^M8}`@}CvapMZzU$4^*DQ18a z1PdtwID1E0)_YF~L<@LNH{at;L>LCS`7|n_lilDKs=QkC0SHi;)o}N*LE4luHx#9D zTk&IaMPPgq2zLZBx)#9#0|5X50)hbmG5OXQ&D%LW9atqoXA=Qz+)^jGaI+z-|BUu) zLh$Y5a4awtj*h|k+c8fAA1wwlq2T6Fd~e@WQB&|7urrK2KM^S$>X;d`fdqtf9gSdk-91Uyb9a$@R-_Y~5 zBBGTE_QliLj9JW2PwB4tcr*|EW`216Csq!waz)bCZ=nj+Uh*e?yzFJs);z|x47*Kx zr*T46O^6rm7f;nW`hj5lU<5x!^z;qYn45)%N(7tt^H%auSs!e&-WWcV*eHE*FHP`d zJCrh8eM=&}EeT$;gpwR%(=lkJ0)c@5_Q@@2ci}v@v=AuWc>xZqkqWpv!oDPm2@9mB7=EoazOzvz+g4ev=y-4L6V$n~V+mQpQ_{VGHy(9w42u-XGXaeH_Du%SsY z!r?mz#}j`IzfKws_K}_}MUFtb?D7Bv7zYL66>G8A-U*YMiqMwjG;c}e11e-U0)c@5 z=k8$!0n{)|{D0uvFSIcm}bi95F&3<|eI^oYERiZC6 zN;{viJtIfAUZ$r#72z^)QLO*B^yO?=`I*(S9>IyYh12!jk?9>#Hb&Ez|}a*<|4(aW3~%A>RDv0fC5x4Vdm_z)a2x~4|QLdqs9NDB}ki^vyg^$2?*q#&786a=MLgL5zJ=We}BlXRj6w0vSWd|B=sYz+PhjMbVdX}JKk z^zGix1XE`=RSd#Rj8Z7=GW_NGm GRnCdiB|$d; literal 0 HcmV?d00001 diff --git a/testing/tests/tkm/multiple-clients/hosts/sun/etc/tkm/tkm.conf b/testing/tests/tkm/multiple-clients/hosts/sun/etc/tkm/tkm.conf new file mode 100644 index 000000000..216625e4c --- /dev/null +++ b/testing/tests/tkm/multiple-clients/hosts/sun/etc/tkm/tkm.conf @@ -0,0 +1,36 @@ + + + sun.strongswan.org + sunCert.pem + + + transport + + 1 + 192.168.0.2 + + + carol@strongswan.org + 192.168.0.100 + + + 30 + 60 + + + + transport + + 1 + 192.168.0.2 + + + dave@strongswan.org + 192.168.0.200 + + + 30 + 60 + + + diff --git a/testing/tests/tkm/multiple-clients/posttest.dat b/testing/tests/tkm/multiple-clients/posttest.dat new file mode 100644 index 000000000..9a4a9bc9d --- /dev/null +++ b/testing/tests/tkm/multiple-clients/posttest.dat @@ -0,0 +1,5 @@ +sun::DAEMON_NAME=charon-tkm ipsec stop +sun::killall tkm_keymanager +sun::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log +carol::ipsec stop +dave::ipsec stop diff --git a/testing/tests/tkm/multiple-clients/pretest.dat b/testing/tests/tkm/multiple-clients/pretest.dat new file mode 100644 index 000000000..ec83662f5 --- /dev/null +++ b/testing/tests/tkm/multiple-clients/pretest.dat @@ -0,0 +1,14 @@ +sun::rm /etc/ipsec.secrets +sun::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd +sun::cat /etc/ipsec.conf +sun::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/sunKey.der -r /etc/tkm/strongswanCert.der >/tmp/tkm.log 2>&1 & +sun::expect-file /tmp/tkm.rpc.ike +sun::DAEMON_NAME=charon-tkm ipsec start +carol::ipsec start +carol::expect-connection host-host +dave::ipsec start +dave::expect-connection host-host +sun::DAEMON_NAME=charon-tkm expect-connection conn1 +sun::DAEMON_NAME=charon-tkm expect-connection conn2 +carol::ipsec up host-host +dave::ipsec up host-host diff --git a/testing/tests/tkm/multiple-clients/test.conf b/testing/tests/tkm/multiple-clients/test.conf new file mode 100644 index 000000000..1dd36309d --- /dev/null +++ b/testing/tests/tkm/multiple-clients/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="carol dave sun winnetou" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d-s.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="carol dave" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="carol dave sun"