denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adapted ikev2 alg and esp scenarios

Browse Source
This commit is contained in:
Andreas Steffen
2009-12-09 15:19:10 +01:00
parent 344061ebce
commit 99133d3086
30 changed files with 243 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/alg-3des-md5/evaltest.dat
+2 -2
View File
@@ -5,9 +5,9 @@ carol::ipsec statusall::home.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MO
carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
moon::ipsec statusall::rw.*3DES_CBC/HMAC_MD5_96,::YES
carol::ipsec statusall::home.*3DES_CBC/HMAC_MD5_96,::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length ::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length ::YES
moon::ip xfrm state::enc cbc(des3_ede)::YES
carol::ip xfrm state::enc cbc(des3_ede)::YES
moon::ip xfrm state::auth hmac(md5)::YES
carol::ip xfrm state::auth hmac(md5)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES
testing/tests/ikev2/alg-aes-xcbc/evaltest.dat
+3 -2
View File
@@ -5,7 +5,8 @@ carol::ipsec statusall::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_X
carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
moon::ipsec statusall::rw.*AES_CBC_128/AES_XCBC_96,::YES
carol::ipsec statusall::home.*AES_CBC_128/AES_XCBC_96,::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
moon::ip xfrm state::auth xcbc(aes)::YES
carol::ip xfrm state::auth xcbc(aes)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
testing/tests/ikev2/alg-blowfish/evaltest.dat
+10 -10
View File
@@ -1,16 +1,16 @@
moon::ipsec statusall::rw.*ESTABLISHED::YES
carol::ipsec statusall::home.*ESTABLISHED::YES
carol::ipsec statusall::IKE proposal: BLOWFISH_CBC_256::YES
carol::ipsec statusall::BLOWFISH_CBC_192.*,::YES
carol::ipsec statusall::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
carol::ipsec statusall::BLOWFISH_CBC_192/HMAC_SHA2_256_128,::YES
carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES
dave::ipsec statusall::home.*ESTABLISHED::YES
dave::ipsec statusall::IKE proposal: BLOWFISH_CBC_128::YES
dave::ipsec statusall::BLOWFISH_CBC_128.*,::YES
dave::ipsec statusall::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES
dave::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
dave::ipsec statusall::BLOWFISH_CBC_128/HMAC_SHA1_96,::YES
dave::ip -s xfrm state::enc cbc(blowfish).*(128 bits)::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 184::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 184::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP.*length 180::YES
testing/tests/ikev2/alg-sha256-96/description.txt
+5
View File
@@ -0,0 +1,5 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the ESP cipher suite
<b>AES_CBC_128 / HMAC_SHA2_256_96</b> which uses 96 bit instead of the
standard 128 bit truncation, allowing compatibility with Linux kernels older than 2.6.33
by defining <b>esp=aes128-sha256_96-modp2048!</b> in ipsec.conf.
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
testing/tests/ikev2/alg-sha256-96/evaltest.dat
+11
View File
@@ -0,0 +1,11 @@
moon::ipsec statusall::rw.*INSTALLED::YES
carol::ipsec statusall::home.*INSTALLED::YES
moon::ipsec statusall::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
carol::ipsec statusall::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
moon::ipsec statusall::rw.*AES_CBC_128/HMAC_SHA2_256_96,::YES
carol::ipsec statusall::home.*AES_CBC_128/HMAC_SHA2_256_96,::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
moon::ip xfrm state::auth hmac(sha256)::YES
carol::ip xfrm state::auth hmac(sha256)::YES
testing/tests/ikev2/alg-sha256-96/hosts/carol/etc/ipsec.conf
Executable
+25
View File
@@ -0,0 +1,25 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=yes
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-sha256-modp2048!
esp=aes128-sha256_96-modp2048!
conn home
left=PH_IP_CAROL
leftfirewall=yes
leftcert=carolCert.pem
[email protected]
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/tests/ikev2/alg-sha256-96/hosts/carol/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
}
testing/tests/ikev2/alg-sha256-96/hosts/moon/etc/ipsec.conf
Executable
+24
View File
@@ -0,0 +1,24 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=yes
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-sha256-modp2048!
esp=aes128-sha256_96-modp2048!
conn rw
left=PH_IP_MOON
leftfirewall=yes
leftcert=moonCert.pem
[email protected]
leftsubnet=10.1.0.0/16
right=%any
auto=add
testing/tests/ikev2/alg-sha256-96/hosts/moon/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
}
testing/tests/ikev2/alg-sha256-96/posttest.dat
+4
View File
@@ -0,0 +1,4 @@
moon::ipsec stop
carol::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
testing/tests/ikev2/alg-sha256-96/pretest.dat
+6
View File
@@ -0,0 +1,6 @@
moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
moon::ipsec start
carol::ipsec start
carol::sleep 1
carol::ipsec up home
testing/tests/ikev2/alg-sha256-96/test.conf
+21
View File
@@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# UML instances used for this test
# All UML instances that are required for this test
#
UMLHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
testing/tests/ikev2/esp-alg-aes-ccm/evaltest.dat
+3 -1
View File
@@ -1,5 +1,7 @@
moon::ipsec statusall::rw.*INSTALLED::YES
carol::ipsec statusall::home.*INSTALLED::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
moon::ipsec statusall::AES_CCM_12_128::YES
carol::ipsec statusall::AES_CCM_12_128::YES
carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES
testing/tests/ikev2/esp-alg-aes-ccm/test.conf
+1 -1
View File
@@ -13,7 +13,7 @@ DIAGRAM="m-c-w.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
TCPDUMPHOSTS="moon"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
testing/tests/ikev2/esp-alg-aes-ctr/evaltest.dat
+4 -1
View File
@@ -1,7 +1,10 @@
moon::ipsec statusall::rw.*INSTALLED::YES
carol::ipsec statusall::home.*INSTALLED::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
moon::ipsec statusall::AES_CTR_128/AES_XCBC_96::YES
carol::ipsec statusall::AES_CTR_128/AES_XCBC_96::YES
moon::ip xfrm state::rfc3686(ctr(aes))::YES
carol::ip xfrm state::rfc3686(ctr(aes))::YES
carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES
testing/tests/ikev2/esp-alg-aes-ctr/test.conf
+1 -1
View File
@@ -13,7 +13,7 @@ DIAGRAM="m-c-w.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
TCPDUMPHOSTS="moon"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
testing/tests/ikev2/esp-alg-aes-gcm/evaltest.dat
+3 -1
View File
@@ -1,5 +1,7 @@
moon::ipsec statusall::rw.*INSTALLED::YES
carol::ipsec statusall::home.*INSTALLED::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
moon::ipsec statusall::AES_GCM_16_256::YES
carol::ipsec statusall::AES_GCM_16_256::YES
carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 184::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 184::YES
testing/tests/ikev2/esp-alg-aes-gcm/test.conf
+1 -1
View File
@@ -13,7 +13,7 @@ DIAGRAM="m-c-w.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
TCPDUMPHOSTS="moon"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
testing/tests/ikev2/esp-alg-camellia/description.txt
+3
View File
@@ -0,0 +1,3 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the ESP cipher suite
<b>CAMELLIA_CBC_192 / HMAC_SHA1_96</b> by defining <b>esp=camellia192-sha1</b> in ipsec.conf.
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
testing/tests/ikev2/esp-alg-camellia/evaltest.dat
+10
View File
@@ -0,0 +1,10 @@
moon::ipsec statusall::rw.*INSTALLED::YES
carol::ipsec statusall::home.*INSTALLED::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
moon::ipsec statusall::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
carol::ipsec statusall::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
moon::ip xfrm state::enc cbc(camellia)::YES
carol::ip xfrm state::enc cbc(camellia)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
testing/tests/ikev2/esp-alg-camellia/hosts/carol/etc/ipsec.conf
Executable
+25
View File
@@ -0,0 +1,25 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=yes
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes192-sha1-modp2048!
esp=camellia192-sha1!
conn home
left=PH_IP_CAROL
leftfirewall=yes
leftcert=carolCert.pem
[email protected]
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/tests/ikev2/esp-alg-camellia/hosts/carol/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
}
testing/tests/ikev2/esp-alg-camellia/hosts/moon/etc/ipsec.conf
Executable
+24
View File
@@ -0,0 +1,24 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=yes
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes192-sha1-modp2048!
esp=camellia192-sha1!
conn rw
left=PH_IP_MOON
leftfirewall=yes
leftcert=moonCert.pem
[email protected]
leftsubnet=10.1.0.0/16
right=%any
auto=add
testing/tests/ikev2/esp-alg-camellia/hosts/moon/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
}
testing/tests/ikev2/esp-alg-camellia/posttest.dat
+4
View File
@@ -0,0 +1,4 @@
moon::ipsec stop
carol::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
testing/tests/ikev2/esp-alg-camellia/pretest.dat
+7
View File
@@ -0,0 +1,7 @@
moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
moon::ipsec start
carol::ipsec start
carol::sleep 1
carol::ipsec up home
carol::sleep 1
testing/tests/ikev2/esp-alg-camellia/test.conf
+21
View File
@@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# UML instances used for this test
# All UML instances that are required for this test
#
UMLHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
testing/tests/ikev2/esp-alg-null/evaltest.dat
+3 -1
View File
@@ -1,7 +1,9 @@
moon::ipsec statusall::rw.*INSTALLED::YES
carol::ipsec statusall::home.*INSTALLED::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
moon::ipsec statusall::NULL/HMAC_SHA1_96::YES
carol::ipsec statusall::NULL/HMAC_SHA1_96::YES
moon::ip xfrm state::enc ecb(cipher_null)::YES
carol::ip xfrm state::enc ecb(cipher_null)::YES
carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 172::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 172::YES
testing/tests/ikev2/esp-alg-null/pretest.dat
+1
View File
@@ -4,3 +4,4 @@ moon::ipsec start
carol::ipsec start
carol::sleep 1
carol::ipsec up home
carol::sleep 1
testing/tests/ikev2/esp-alg-null/test.conf
+1 -1
View File
@@ -13,7 +13,7 @@ DIAGRAM="m-c-w.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
TCPDUMPHOSTS="moon"
# UML instances on which IPsec is started
# Used for IPsec logging purposes