denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: make curve25519 the default DH group

Browse Source
This commit is contained in:
Andreas Steffen
2016-11-14 16:20:51 +01:00
parent 549b325d9d
commit 99c03e9a11
820 changed files with 1050 additions and 1072 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/net2net-esn/description.txt
+2 -2
View File
@@ -1,7 +1,7 @@
A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
With <b>esp=aes128-sha1-esn-noesn!</b> gateway <b>moon</b> proposes the use of
With <b>esp=aes128-sha256-esn-noesn!</b> gateway <b>moon</b> proposes the use of
<b>Extended Sequence Numbers</b> but can also live without them. Gateway <b>sun</b>
defines <b>esp=aes128-sha1-esn!</b> and thus decides on the use of ESN.
defines <b>esp=aes128-sha256-esn!</b> and thus decides on the use of ESN.
<p/>
Upon the successful establishment of the CHILD SA with ESN, client <b>alice</b> behind
gateway <b>moon</b> pings client <b>bob</b> located behind gateway <b>sun</b> 10 times.
testing/tests/ikev2/net2net-esn/evaltest.dat
+4 -4
View File
@@ -1,5 +1,5 @@
sun:: cat /var/log/daemon.log::received proposals: ESP:AES_CBC_128/HMAC_SHA1_96/EXT_SEQ/NO_EXT_SEQ::YES
sun:: cat /var/log/daemon.log::selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/EXT_SEQ::YES
sun:: cat /var/log/daemon.log::received proposals: ESP:AES_CBC_128/HMAC_SHA2_256_128/EXT_SEQ/NO_EXT_SEQ::YES
sun:: cat /var/log/daemon.log::selected proposal: ESP:AES_CBC_128/HMAC_SHA2_256_128/EXT_SEQ::YES
sun:: cat /var/log/daemon.log::using extended sequence numbers (ESN)::YES
moon:: cat /var/log/daemon.log::using extended sequence numbers (ESN)::YES
moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
@@ -11,6 +11,6 @@ moon:: ip -s xfrm state::flag af-unspec.*(0x10100000)::YES
alice::ping -c 10 -i 0 -f PH_IP_BOB::10 packets transmitted, 10 received, 0% packet loss::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
moon::ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA1_96/ESN::YES
sun:: ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA1_96/ESN::YES
moon::ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA2_256_128/ESN::YES
sun:: ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA2_256_128/ESN::YES
testing/tests/ikev2/net2net-esn/hosts/moon/etc/ipsec.conf
+2 -2
View File
@@ -9,8 +9,8 @@ conn %default
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-sha1-modp1536!
esp=aes128-sha1-esn-noesn!
ike=aes128-sha256-modp3072!
esp=aes128-sha256-esn-noesn!
mobike=no
conn net-net
testing/tests/ikev2/net2net-esn/hosts/moon/etc/strongswan.conf
+1 -1
View File
@@ -1,6 +1,6 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no
}
testing/tests/ikev2/net2net-esn/hosts/sun/etc/ipsec.conf
+2 -2
View File
@@ -9,8 +9,8 @@ conn %default
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-sha1-modp1536!
esp=aes128-sha1-esn!
ike=aes128-sha256-modp3072!
esp=aes128-sha256-esn!
mobike=no
conn net-net
testing/tests/ikev2/net2net-esn/hosts/sun/etc/strongswan.conf
+1 -1
View File
@@ -1,6 +1,6 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no
}