denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'tkm-reqid-alloc'

Browse Source 
Fixes expires raised by charon-tkm to actually use a proto/dst/SPI tuple to
identify CHILD_SAs.
This commit is contained in:
Martin Willi
2015-02-20 13:34:54 +01:00
parent 94eb09ac35 65566c37ca
commit a75980c4aa
22 changed files with 266 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon-tkm/src/ees/ees_callbacks.c
+14 -4
View File
@@ -19,11 +19,12 @@
#include <tkm/constants.h>
#include <tkm/types.h>
#include "tkm.h"
#include "ees_callbacks.h"
void charon_esa_acquire(result_type *res, const sp_id_type sp_id)
{
DBG1(DBG_KNL, "ees: acquire received for reqid {%d}", sp_id);
DBG1(DBG_KNL, "ees: acquire received for reqid %u", sp_id);
hydra->kernel_interface->acquire(hydra->kernel_interface, sp_id, NULL,
NULL);
*res = TKM_OK;
@@ -33,10 +34,19 @@ void charon_esa_expire(result_type *res, const sp_id_type sp_id,
const esp_spi_type spi_rem, const protocol_type protocol,
const expiry_flag_type hard)
{
host_t *dst = NULL;
host_t *dst;
DBG1(DBG_KNL, "ees: expire received for reqid {%d}", sp_id);
dst = tkm->sad->get_dst_host(tkm->sad, sp_id, spi_rem, protocol);
*res = TKM_OK;
if (dst == NULL)
{
DBG3(DBG_KNL, "ees: destination host not found for reqid %u, spi %x, "
"proto %u", sp_id, ntohl(spi_rem), protocol);
return;
}
DBG1(DBG_KNL, "ees: expire received for reqid %u, spi %x, dst %H", sp_id,
ntohl(spi_rem), dst);
hydra->kernel_interface->expire(hydra->kernel_interface, protocol,
spi_rem, dst, hard != 0);
*res = TKM_OK;
}
src/charon-tkm/src/tkm/tkm.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012 Reto Buerki
* Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -95,6 +95,7 @@ bool tkm_init()
.public = {
.idmgr = tkm_id_manager_create(limits),
.chunk_map = tkm_chunk_map_create(),
.sad = tkm_kernel_sad_create(),
},
);
tkm = &this->public;
@@ -114,6 +115,7 @@ void tkm_deinit()
private_tkm_t *this = (private_tkm_t*)tkm;
this->public.idmgr->destroy(this->public.idmgr);
this->public.chunk_map->destroy(this->public.chunk_map);
this->public.sad->destroy(this->public.sad);
ees_server_finalize();
src/charon-tkm/src/tkm/tkm.h
+7 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012 Reto Buerki
* Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -72,6 +72,7 @@
#include "tkm_id_manager.h"
#include "tkm_chunk_map.h"
#include "tkm_kernel_sad.h"
typedef struct tkm_t tkm_t;
@@ -90,6 +91,11 @@ struct tkm_t {
*/
tkm_chunk_map_t *chunk_map;
/**
* CHILD/ESP SA database.
*/
tkm_kernel_sad_t *sad;
};
/**
src/charon-tkm/src/tkm/tkm_kernel_ipsec.c
+6 -20
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012 Reto Buerki
* Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -26,7 +26,6 @@
#include "tkm_utils.h"
#include "tkm_types.h"
#include "tkm_keymat.h"
#include "tkm_kernel_sad.h"
#include "tkm_kernel_ipsec.h"
/** From linux/in.h */
@@ -51,11 +50,6 @@ struct private_tkm_kernel_ipsec_t {
*/
rng_t *rng;
/**
* CHILD/ESP SA database.
*/
tkm_kernel_sad_t *sad;
};
METHOD(kernel_ipsec_t, get_spi, status_t,
@@ -142,7 +136,8 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
}
esa_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_ESA);
if (!this->sad->insert(this->sad, esa_id, peer, local, spi_loc, protocol))
if (!tkm->sad->insert(tkm->sad, reqid, esa_id, local, peer, spi_rem,
protocol))
{
DBG1(DBG_KNL, "unable to add entry (%llu) to SAD", esa_id);
goto sad_failure;
@@ -206,7 +201,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
return SUCCESS;
failure:
this->sad->remove(this->sad, esa_id);
tkm->sad->remove(tkm->sad, esa_id);
sad_failure:
tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_ESA, esa_id);
chunk_free(&esa.nonce_i);
@@ -228,7 +223,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
{
esa_id_type esa_id;
esa_id = this->sad->get_esa_id(this->sad, src, dst, spi, protocol);
esa_id = tkm->sad->get_esa_id(tkm->sad, src, dst, spi, protocol);
if (esa_id)
{
DBG1(DBG_KNL, "deleting child SA (esa: %llu, spi: %x)", esa_id,
@@ -238,7 +233,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
DBG1(DBG_KNL, "child SA (%llu) deletion failed", esa_id);
return FAILED;
}
this->sad->remove(this->sad, esa_id);
tkm->sad->remove(tkm->sad, esa_id);
tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_ESA, esa_id);
}
return SUCCESS;
@@ -349,7 +344,6 @@ METHOD(kernel_ipsec_t, destroy, void,
private_tkm_kernel_ipsec_t *this)
{
DESTROY_IF(this->rng);
DESTROY_IF(this->sad);
free(this);
}
@@ -379,15 +373,7 @@ tkm_kernel_ipsec_t *tkm_kernel_ipsec_create()
.destroy = _destroy,
},
},
.sad = tkm_kernel_sad_create(),
);
if (!this->sad)
{
DBG1(DBG_KNL, "unable to create SAD");
destroy(this);
return NULL;
}
return &this->public;
}
src/charon-tkm/src/tkm/tkm_kernel_sad.c
+57 -9
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012 Reto Buerki
* Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -56,6 +56,11 @@ struct sad_entry_t {
*/
esa_id_type esa_id;
/**
* Reqid.
*/
u_int32_t reqid;
/**
* Source address of CHILD SA.
*/
@@ -108,6 +113,19 @@ static bool sad_entry_match(sad_entry_t * const entry, const host_t * const src,
entry->spi == *spi && entry->proto == *proto;
}
/**
* Find a list entry with given reqid, spi and proto values.
*/
static bool sad_entry_match_dst(sad_entry_t * const entry,
const u_int32_t * const reqid,
const u_int32_t * const spi,
const u_int8_t * const proto)
{
return entry->reqid == *reqid &&
entry->spi == *spi &&
entry->proto == *proto;
}
/**
* Compare two SAD entries for equality.
*/
@@ -119,6 +137,7 @@ static bool sad_entry_equal(sad_entry_t * const left, sad_entry_t * const right)
return FALSE;
}
return left->esa_id == right->esa_id &&
left->reqid == right->reqid &&
left->src->ip_equals(left->src, right->src) &&
left->dst->ip_equals(left->dst, right->dst) &&
left->spi == right->spi && left->proto == right->proto;
@@ -126,14 +145,15 @@ static bool sad_entry_equal(sad_entry_t * const left, sad_entry_t * const right)
METHOD(tkm_kernel_sad_t, insert, bool,
private_tkm_kernel_sad_t * const this, const esa_id_type esa_id,
const host_t * const src, const host_t * const dst, const u_int32_t spi,
const u_int8_t proto)
const u_int32_t reqid, const host_t * const src, const host_t * const dst,
const u_int32_t spi, const u_int8_t proto)
{
status_t result;
sad_entry_t *new_entry;
INIT(new_entry,
.esa_id = esa_id,
.reqid = reqid,
.src = (host_t *)src,
.dst = (host_t *)dst,
.spi = spi,
@@ -146,8 +166,9 @@ METHOD(tkm_kernel_sad_t, insert, bool,
new_entry);
if (result == NOT_FOUND)
{
DBG3(DBG_KNL, "inserting SAD entry (esa: %llu, src: %H, dst: %H, "
"spi: %x, proto: %u)", esa_id, src, dst, ntohl(spi), proto);
DBG3(DBG_KNL, "inserting SAD entry (esa: %llu, reqid: %u, src: %H, "
"dst: %H, spi: %x, proto: %u)", esa_id, reqid, src, dst,
ntohl(spi), proto);
new_entry->src = src->clone((host_t *)src);
new_entry->dst = dst->clone((host_t *)dst);
this->data->insert_last(this->data, new_entry);
@@ -176,18 +197,44 @@ METHOD(tkm_kernel_sad_t, get_esa_id, esa_id_type,
if (res == SUCCESS && entry)
{
id = entry->esa_id;
DBG3(DBG_KNL, "getting ESA id of SAD entry (esa: %llu, src: %H, "
"dst: %H, spi: %x, proto: %u)", id, src, dst, ntohl(spi),
proto);
DBG3(DBG_KNL, "returning ESA id %llu of SAD entry (src: %H, dst: %H, "
"spi: %x, proto: %u)", id, src, dst, ntohl(spi), proto);
}
else
{
DBG3(DBG_KNL, "no SAD entry found");
DBG3(DBG_KNL, "no SAD entry found for src %H, dst %H, spi %x, proto %u",
src, dst, ntohl(spi), proto);
}
this->mutex->unlock(this->mutex);
return id;
}
METHOD(tkm_kernel_sad_t, get_dst_host, host_t *,
private_tkm_kernel_sad_t * const this, const u_int32_t reqid,
const u_int32_t spi, const u_int8_t proto)
{
host_t *dst = NULL;
sad_entry_t *entry = NULL;
this->mutex->lock(this->mutex);
const status_t res = this->data->find_first(this->data,
(linked_list_match_t)sad_entry_match_dst,
(void**)&entry, &reqid, &spi, &proto);
if (res == SUCCESS && entry)
{
dst = entry->dst;
DBG3(DBG_KNL, "returning destination host %H of SAD entry (reqid: %u,"
" spi: %x, proto: %u)", dst, reqid, ntohl(spi), proto);
}
else
{
DBG3(DBG_KNL, "no SAD entry found for reqid %u, spi %x, proto: %u",
reqid, ntohl(spi), proto);
}
this->mutex->unlock(this->mutex);
return dst;
}
METHOD(tkm_kernel_sad_t, _remove, bool,
private_tkm_kernel_sad_t * const this, const esa_id_type esa_id)
{
@@ -242,6 +289,7 @@ tkm_kernel_sad_t *tkm_kernel_sad_create()
.public = {
.insert = _insert,
.get_esa_id = _get_esa_id,
.get_dst_host = _get_dst_host,
.remove = __remove,
.destroy = _destroy,
},
src/charon-tkm/src/tkm/tkm_kernel_sad.h
+16 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012 Reto Buerki
* Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -37,6 +37,7 @@ struct tkm_kernel_sad_t {
* Insert new SAD entry with specified parameters.
*
* @param esa_id ESP SA context identifier
* @param reqid reqid of the SA
* @param src source address of CHILD SA
* @param dst destination address of CHILD SA
* @param spi SPI of CHILD SA
@@ -44,8 +45,9 @@ struct tkm_kernel_sad_t {
* @return TRUE if entry was inserted, FALSE otherwise
*/
bool (*insert)(tkm_kernel_sad_t * const this, const esa_id_type esa_id,
const host_t * const src, const host_t * const dst,
const u_int32_t spi, const u_int8_t proto);
const u_int32_t reqid, const host_t * const src,
const host_t * const dst, const u_int32_t spi,
const u_int8_t proto);
/**
* Get ESA id for entry with given parameters.
@@ -60,6 +62,17 @@ struct tkm_kernel_sad_t {
const host_t * const src, const host_t * const dst,
const u_int32_t spi, const u_int8_t proto);
/**
* Get destination host for entry with given parameters.
*
* @param reqid reqid of CHILD SA
* @param spi SPI of CHILD SA
* @param proto protocol of CHILD SA (ESP/AH)
* @return destination host of entry if found, NULL otherwise
*/
host_t * (*get_dst_host)(tkm_kernel_sad_t * const this,
const u_int32_t reqid, const u_int32_t spi, const u_int8_t proto);
/**
* Remove entry with given ESA id from SAD.
*
src/charon-tkm/tests/kernel_sad_tests.c
+34 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012 Reto Buerki
* Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -34,7 +34,7 @@ START_TEST(test_insert)
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
fail_unless(sad->insert(sad, 1, addr, addr, 42, 50),
fail_unless(sad->insert(sad, 1, 2, addr, addr, 42, 50),
"Error inserting SAD entry");
sad->destroy(sad);
@@ -47,9 +47,9 @@ START_TEST(test_insert_duplicate)
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
fail_unless(sad->insert(sad, 1, addr, addr, 42, 50),
fail_unless(sad->insert(sad, 1, 2, addr, addr, 42, 50),
"Error inserting SAD entry");
fail_if(sad->insert(sad, 1, addr, addr, 42, 50),
fail_if(sad->insert(sad, 1, 2, addr, addr, 42, 50),
"Expected error inserting duplicate entry");
sad->destroy(sad);
@@ -61,7 +61,7 @@ START_TEST(test_get_esa_id)
{
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
fail_unless(sad->insert(sad, 23, addr, addr, 42, 50),
fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50),
"Error inserting SAD entry");
fail_unless(sad->get_esa_id(sad, addr, addr, 42, 50) == 23,
"Error getting esa id");
@@ -81,11 +81,34 @@ START_TEST(test_get_esa_id_nonexistent)
}
END_TEST
START_TEST(test_get_dst_host)
{
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50),
"Error inserting SAD entry");
host_t *dst = sad->get_dst_host(sad, 54, 42, 50);
fail_unless(addr->equals(addr, dst), "Error getting dst host");
sad->destroy(sad);
addr->destroy(addr);
}
END_TEST
START_TEST(test_get_dst_host_nonexistent)
{
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
fail_unless(sad->get_dst_host(sad, 1, 12, 50) == NULL,
"Got dst for nonexistent SAD entry");
sad->destroy(sad);
}
END_TEST
START_TEST(test_remove)
{
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
fail_unless(sad->insert(sad, 23, addr, addr, 42, 50),
fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50),
"Error inserting SAD entry");
fail_unless(sad->get_esa_id(sad, addr, addr, 42, 50) == 23,
"Error getting esa id");
@@ -128,6 +151,11 @@ Suite *make_kernel_sad_tests()
tcase_add_test(tc, test_get_esa_id_nonexistent);
suite_add_tcase(s, tc);
tc = tcase_create("get_dst_host");
tcase_add_test(tc, test_get_dst_host);
tcase_add_test(tc, test_get_dst_host_nonexistent);
suite_add_tcase(s, tc);
tc = tcase_create("remove");
tcase_add_test(tc, test_remove);
tcase_add_test(tc, test_remove_nonexistent);
src/charon-tkm/tests/tests.c
+2 -2
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2013 Tobias Brunner
* Copyright (C) 2012 Reto Buerki
* Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -53,7 +53,7 @@ static bool test_runner_init(bool init)
libhydra_init();
libcharon_init();
lib->settings->set_int(lib->settings,
"test_runner.filelog.stdout.default", 0);
"test-runner.filelog.stdout.default", 0);
charon->load_loggers(charon, NULL, FALSE);
/* Register TKM specific plugins */
testing/tests/tkm/host2host-initiator/evaltest.dat
+4
View File
@@ -10,3 +10,7 @@ moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
moon::cat /tmp/tkm.log::Adding SA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
moon::DAEMON_NAME=charon-tkm ipsec down conn1 && sleep 1::no output expected::NO
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
moon::cat /tmp/tkm.log::Deleting SA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
testing/tests/tkm/host2host-xfrmproxy/evaltest.dat
+1
View File
@@ -5,6 +5,7 @@ sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES
testing/tests/tkm/net2net-xfrmproxy/evaltest.dat
+1
View File
@@ -5,6 +5,7 @@ sun::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
moon::cat /tmp/tkm.log::Adding policy \[ 1, 10.1.0.0/16 > 192.168.0.1 <=> 192.168.0.2 < 10.2.0.0/16 \]::YES
moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES
testing/tests/tkm/xfrmproxy-expire/description.txt
+6
View File
@@ -0,0 +1,6 @@
A transport connection between the hosts <b>moon</b> and <b>sun</b> is set up.
The host <b>moon</b> starts the Trusted Key Manager (TKM) and the Ada XFRM
proxy, which relays XFRM kernel messages to charon. The authentication is based
on X.509 certificates. The connection is initiated by a ping from <b>moon</b>
to <b>sun</b>. The test asserts that XFRM expire messages from the kernel are
handled correctly.
testing/tests/tkm/xfrmproxy-expire/evaltest.dat
+22
View File
@@ -0,0 +1,22 @@
moon::ipsec stroke status 2> /dev/null::conn1.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
sun::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec stroke status 2> /dev/null::conn1.*INSTALLED, TRANSPORT::YES
sun::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES
moon::cat /var/log/daemon.log::ees: expire received for reqid 1, spi.*, dst 192.168.0.2::YES
moon::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
moon::cat /tmp/tkm.log::Checked CA certificate of CC context 1::YES
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
moon::cat /tmp/tkm.log::Creating first new ESA context with ID 1 (Isa 1, Sp 1, Ea 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 1, Sp 1, Ea 1, Dh_Id 1, Nc_Loc_Id 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES
moon::cat /tmp/tkm.log | grep 'Adding SA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 2, hard 60 \]' | wc -l::2::YES
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
moon::cat /tmp/tkm.log::Deleting SA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES
moon::cat /tmp/xfrm_proxy.log::Initiating ESA expire (reqid 1, proto 50, SPI.*, hard FALSE)::YES
testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/strongswan.conf
+8
View File
@@ -0,0 +1,8 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-tkm {
dh_mapping {
15 = 1
16 = 2
}
}
testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/moonKey.der
BIN
View File
Binary file not shown.
testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/strongswanCert.der
BIN
View File
Binary file not shown.
testing/tests/tkm/xfrmproxy-expire/hosts/moon/etc/tkm/tkm.conf
+21
View File
@@ -0,0 +1,21 @@
<tkmconfig>
<local_identity id="1">
<identity>moon.strongswan.org</identity>
<certificate>moonCert.pem</certificate>
</local_identity>
<policy id="1">
<mode>transport</mode>
<local>
<identity_id>1</identity_id>
<ip>192.168.0.1</ip>
</local>
<remote>
<identity>sun.strongswan.org</identity>
<ip>192.168.0.2</ip>
</remote>
<lifetime>
<soft>2</soft>
<hard>60</hard>
</lifetime>
</policy>
</tkmconfig>
testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/ipsec.conf
+21
View File
@@ -0,0 +1,21 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn host-host
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=sun.strongswan.org
right=PH_IP_MOON
rightid=moon.strongswan.org
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
type=transport
auto=add
testing/tests/tkm/xfrmproxy-expire/hosts/sun/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc stroke kernel-netlink socket-default updown
}
testing/tests/tkm/xfrmproxy-expire/posttest.dat
+5
View File
@@ -0,0 +1,5 @@
moon::DAEMON_NAME=charon-tkm ipsec stop
moon::killall xfrm_proxy
moon::killall tkm_keymanager
moon::rm -f /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log /tmp/xfrm_proxy.log
sun::ipsec stop
testing/tests/tkm/xfrmproxy-expire/pretest.dat
+12
View File
@@ -0,0 +1,12 @@
sun::ipsec start
moon::rm /etc/ipsec.secrets
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /etc/ipsec.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
moon::cat /etc/ipsec.conf
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der >/tmp/tkm.log 2>&1 &
moon::expect-file /tmp/tkm.rpc.ike
moon::DAEMON_NAME=charon-tkm ipsec start
moon::expect-file /tmp/tkm.rpc.ees
moon::xfrm_proxy >/tmp/xfrm_proxy.log 2>&1 &
moon::DAEMON_NAME=charon-tkm expect-connection conn1
sun::expect-connection host-host
moon::ping -c 3 192.168.0.2
testing/tests/tkm/xfrmproxy-expire/test.conf
+21
View File
@@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"