denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

charon-tkm: Reverse cert chain processing order

Browse Source 
Verify certificate chains starting from the root CA certificate and
moving towards the leaf/user certificate.

Also update TKM-RPC and TKM in testing scripts to version supporting the
reworked CC handling.
This commit is contained in:
Adrian-Ken Rueegsegger
2021-01-08 17:22:36 +01:00
committed by Tobias Brunner
parent 532023dcf1
commit a0a0571bd1
11 changed files with 108 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/tkm/host2host-xfrmproxy/evaltest.dat
+2 -1
View File
@@ -8,7 +8,8 @@ sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES
moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES