From ae06cfad36d56d4529e3a395662cfc5d9eead438 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 31 Oct 2019 09:27:49 +0100 Subject: [PATCH 1/5] ike-cert-post: Generate URL for hash-and-URL here This avoids having to register certificates with authority/ca backends beforehand, which is tricky for intermediate CA certificates loaded themselves via authority/ca sections. On the other hand, the form of these URLs can't be determined by config backends anymore (not an issue for the two current implementations, no idea if custom implementations ever made use of that possibility). If that became necessary, we could perhaps pass the certificate to the CDP enumerator or add a new method to the credential_set_t interface. --- src/libcharon/plugins/stroke/stroke_ca.c | 24 ++---- src/libcharon/plugins/vici/vici_authority.c | 24 ++---- src/libcharon/sa/ikev2/tasks/ike_cert_post.c | 87 +++++++++++--------- 3 files changed, 60 insertions(+), 75 deletions(-) diff --git a/src/libcharon/plugins/stroke/stroke_ca.c b/src/libcharon/plugins/stroke/stroke_ca.c index 2c0df8fb2..f728284d9 100644 --- a/src/libcharon/plugins/stroke/stroke_ca.c +++ b/src/libcharon/plugins/stroke/stroke_ca.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008-2015 Tobias Brunner + * Copyright (C) 2008-2019 Tobias Brunner * Copyright (C) 2008 Martin Willi * HSR Hochschule fuer Technik Rapperswil * @@ -308,32 +308,18 @@ static enumerator_t *create_inner_cdp(ca_section_t *section, cdp_data_t *data) */ static enumerator_t *create_inner_cdp_hashandurl(ca_section_t *section, cdp_data_t *data) { - enumerator_t *enumerator = NULL, *hash_enum; - identification_t *current; + enumerator_t *enumerator = NULL; if (!data->id || !section->certuribase) { return NULL; } - hash_enum = section->hashes->create_enumerator(section->hashes); - while (hash_enum->enumerate(hash_enum, ¤t)) + if (section->cert->has_subject(section->cert, data->id) != ID_MATCH_NONE) { - if (current->matches(current, data->id)) - { - char *url, *hash; - - url = malloc(strlen(section->certuribase) + 40 + 1); - strcpy(url, section->certuribase); - hash = chunk_to_hex(current->get_encoding(current), NULL, FALSE).ptr; - strncat(url, hash, 40); - free(hash); - - enumerator = enumerator_create_single(url, free); - break; - } + enumerator = enumerator_create_single(strdup(section->certuribase), + free); } - hash_enum->destroy(hash_enum); return enumerator; } diff --git a/src/libcharon/plugins/vici/vici_authority.c b/src/libcharon/plugins/vici/vici_authority.c index 0fa158b32..bac3eb388 100644 --- a/src/libcharon/plugins/vici/vici_authority.c +++ b/src/libcharon/plugins/vici/vici_authority.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2016 Tobias Brunner + * Copyright (C) 2016-2019 Tobias Brunner * Copyright (C) 2015 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * @@ -694,32 +694,18 @@ static enumerator_t *create_inner_cdp(authority_t *authority, cdp_data_t *data) static enumerator_t *create_inner_cdp_hashandurl(authority_t *authority, cdp_data_t *data) { - enumerator_t *enumerator = NULL, *hash_enum; - identification_t *current; + enumerator_t *enumerator = NULL; if (!data->id || !authority->cert_uri_base) { return NULL; } - hash_enum = authority->hashes->create_enumerator(authority->hashes); - while (hash_enum->enumerate(hash_enum, ¤t)) + if (authority->cert->has_subject(authority->cert, data->id) != ID_MATCH_NONE) { - if (current->matches(current, data->id)) - { - char *url, *hash; - - url = malloc(strlen(authority->cert_uri_base) + 40 + 1); - strcpy(url, authority->cert_uri_base); - hash = chunk_to_hex(current->get_encoding(current), NULL, FALSE).ptr; - strncat(url, hash, 40); - free(hash); - - enumerator = enumerator_create_single(url, free); - break; - } + enumerator = enumerator_create_single(strdup(authority->cert_uri_base), + free); } - hash_enum->destroy(hash_enum); return enumerator; } diff --git a/src/libcharon/sa/ikev2/tasks/ike_cert_post.c b/src/libcharon/sa/ikev2/tasks/ike_cert_post.c index 68af6e35b..265500333 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_cert_post.c +++ b/src/libcharon/sa/ikev2/tasks/ike_cert_post.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008 Tobias Brunner + * Copyright (C) 2008-2019 Tobias Brunner * Copyright (C) 2006-2009 Martin Willi * HSR Hochschule fuer Technik Rapperswil * @@ -48,17 +48,58 @@ struct private_ike_cert_post_t { bool initiator; }; +/** + * Generate the payload for a hash-and-URL encoded certificate + */ +static bool build_hash_url_payload(char *base, certificate_t *cert, + cert_payload_t **payload) +{ + hasher_t *hasher; + chunk_t hash, encoded; + char *url, *hex_hash; + + hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1); + if (!hasher) + { + DBG1(DBG_IKE, "unable to use hash-and-url: SHA-1 not supported"); + return FALSE; + } + + if (!cert->get_encoding(cert, CERT_ASN1_DER, &encoded)) + { + hasher->destroy(hasher); + return FALSE; + } + if (!hasher->allocate_hash(hasher, encoded, &hash)) + { + hasher->destroy(hasher); + chunk_free(&encoded); + return FALSE; + } + chunk_free(&encoded); + hasher->destroy(hasher); + + url = malloc(strlen(base) + 40 + 1); + strcpy(url, base); + hex_hash = chunk_to_hex(hash, NULL, FALSE).ptr; + strncat(url, hex_hash, 40); + free(hex_hash); + + DBG1(DBG_IKE, "sending hash-and-url \"%s\"", url); + *payload = cert_payload_create_from_hash_and_url(hash, url); + chunk_free(&hash); + free(url); + return TRUE; +} + /** * Generates the cert payload, if possible with "Hash and URL" */ static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this, certificate_t *cert) { - hasher_t *hasher; - identification_t *id; - chunk_t hash, encoded ; enumerator_t *enumerator; - char *url; + char *base; cert_payload_t *payload = NULL; if (!this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL)) @@ -66,42 +107,14 @@ static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this, return cert_payload_create_from_cert(PLV2_CERTIFICATE, cert); } - hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1); - if (!hasher) - { - DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported"); - return cert_payload_create_from_cert(PLV2_CERTIFICATE, cert); - } - - if (!cert->get_encoding(cert, CERT_ASN1_DER, &encoded)) - { - DBG1(DBG_IKE, "encoding certificate for cert payload failed"); - hasher->destroy(hasher); - return NULL; - } - if (!hasher->allocate_hash(hasher, encoded, &hash)) - { - hasher->destroy(hasher); - chunk_free(&encoded); - return cert_payload_create_from_cert(PLV2_CERTIFICATE, cert); - } - chunk_free(&encoded); - hasher->destroy(hasher); - id = identification_create_from_encoding(ID_KEY_ID, hash); - - enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr, CERT_X509, id); - if (enumerator->enumerate(enumerator, &url)) - { - payload = cert_payload_create_from_hash_and_url(hash, url); - DBG1(DBG_IKE, "sending hash-and-url \"%s\"", url); - } - else + enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr, CERT_X509, + cert->get_issuer(cert)); + if (!enumerator->enumerate(enumerator, &base) || + !build_hash_url_payload(base, cert, &payload)) { payload = cert_payload_create_from_cert(PLV2_CERTIFICATE, cert); } enumerator->destroy(enumerator); - chunk_free(&hash); - id->destroy(id); return payload; } From d384f40f20eccf741d23f67bdc9b593add9d2b55 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 31 Oct 2019 09:51:42 +0100 Subject: [PATCH 2/5] ike-cert-post: Encode intermediate CA certificates as hash-and-URL if possible --- src/libcharon/sa/ikev2/tasks/ike_cert_post.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libcharon/sa/ikev2/tasks/ike_cert_post.c b/src/libcharon/sa/ikev2/tasks/ike_cert_post.c index 265500333..c5164476a 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_cert_post.c +++ b/src/libcharon/sa/ikev2/tasks/ike_cert_post.c @@ -158,7 +158,7 @@ static void add_im_certs(private_ike_cert_post_t *this, auth_cfg_t *auth, { if (type == AUTH_RULE_IM_CERT) { - payload = cert_payload_create_from_cert(PLV2_CERTIFICATE, cert); + payload = build_cert_payload(this, cert); if (payload) { DBG1(DBG_IKE, "sending issuer cert \"%Y\"", From ad14f3a60dc7496d061e30920bba3b72dfc6269c Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 31 Oct 2019 09:49:21 +0100 Subject: [PATCH 3/5] vici: Remove obsolete certificate registration for hash-and-URL --- src/libcharon/plugins/vici/vici_authority.c | 50 --------------------- src/libcharon/plugins/vici/vici_authority.h | 7 --- src/libcharon/plugins/vici/vici_config.c | 6 --- 3 files changed, 63 deletions(-) diff --git a/src/libcharon/plugins/vici/vici_authority.c b/src/libcharon/plugins/vici/vici_authority.c index bac3eb388..a91ece090 100644 --- a/src/libcharon/plugins/vici/vici_authority.c +++ b/src/libcharon/plugins/vici/vici_authority.c @@ -87,11 +87,6 @@ struct authority_t { */ linked_list_t *ocsp_uris; - /** - * Hashes of certificates issued by this CA - */ - linked_list_t *hashes; - /** * Base URI used for certificates from this CA */ @@ -109,7 +104,6 @@ static authority_t *authority_create(char *name) .name = strdup(name), .crl_uris = linked_list_create(), .ocsp_uris = linked_list_create(), - .hashes = linked_list_create(), ); return authority; @@ -122,7 +116,6 @@ static void authority_destroy(authority_t *this) { this->crl_uris->destroy_function(this->crl_uris, free); this->ocsp_uris->destroy_function(this->ocsp_uris, free); - this->hashes->destroy_offset(this->hashes, offsetof(identification_t, destroy)); DESTROY_IF(this->cert); free(this->cert_uri_base); free(this->name); @@ -738,48 +731,6 @@ METHOD(credential_set_t, create_cdp_enumerator, enumerator_t*, (void*)create_inner_cdp, data, (void*)cdp_data_destroy); } -METHOD(vici_authority_t, check_for_hash_and_url, void, - private_vici_authority_t *this, certificate_t* cert) -{ - authority_t *authority; - enumerator_t *enumerator; - hasher_t *hasher; - - hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1); - if (hasher == NULL) - { - DBG1(DBG_CFG, "unable to use hash-and-url: sha1 not supported"); - return; - } - - this->lock->write_lock(this->lock); - enumerator = this->authorities->create_enumerator(this->authorities); - while (enumerator->enumerate(enumerator, &authority)) - { - if (authority->cert_uri_base && - cert->issued_by(cert, authority->cert, NULL)) - { - chunk_t hash, encoded; - - if (cert->get_encoding(cert, CERT_ASN1_DER, &encoded)) - { - if (hasher->allocate_hash(hasher, encoded, &hash)) - { - authority->hashes->insert_last(authority->hashes, - identification_create_from_encoding(ID_KEY_ID, hash)); - chunk_free(&hash); - } - chunk_free(&encoded); - } - break; - } - } - enumerator->destroy(enumerator); - this->lock->unlock(this->lock); - - hasher->destroy(hasher); -} - METHOD(vici_authority_t, destroy, void, private_vici_authority_t *this) { @@ -808,7 +759,6 @@ vici_authority_t *vici_authority_create(vici_dispatcher_t *dispatcher, .create_cdp_enumerator = _create_cdp_enumerator, .cache_cert = (void*)nop, }, - .check_for_hash_and_url = _check_for_hash_and_url, .destroy = _destroy, }, .dispatcher = dispatcher, diff --git a/src/libcharon/plugins/vici/vici_authority.h b/src/libcharon/plugins/vici/vici_authority.h index dbeabae62..58f542cdd 100644 --- a/src/libcharon/plugins/vici/vici_authority.h +++ b/src/libcharon/plugins/vici/vici_authority.h @@ -36,13 +36,6 @@ struct vici_authority_t { */ credential_set_t set; - /** - * Check if a certificate can be made available through hash and URL. - * - * @param cert end entity certificate - */ - void (*check_for_hash_and_url)(vici_authority_t *this, certificate_t* cert); - /** * Destroy a vici_authority_t. */ diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c index 1ff0754f4..49ebea44b 100644 --- a/src/libcharon/plugins/vici/vici_config.c +++ b/src/libcharon/plugins/vici/vici_config.c @@ -1417,14 +1417,8 @@ CALLBACK(parse_cert_policy, bool, */ static bool add_cert(auth_data_t *auth, auth_rule_t rule, certificate_t *cert) { - vici_authority_t *authority; vici_cred_t *cred; - if (rule == AUTH_RULE_SUBJECT_CERT) - { - authority = auth->request->this->authority; - authority->check_for_hash_and_url(authority, cert); - } cred = auth->request->this->cred; cert = cred->add_cert(cred, cert); auth->cfg->add(auth->cfg, rule, cert); From d592ff72bc19a348c8546e682130906b4bcfb734 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 31 Oct 2019 09:51:07 +0100 Subject: [PATCH 4/5] stroke: Remove obsolete certificate registration for hash-and-URL --- src/libcharon/plugins/stroke/stroke_ca.c | 48 -------------------- src/libcharon/plugins/stroke/stroke_ca.h | 7 --- src/libcharon/plugins/stroke/stroke_config.c | 4 -- 3 files changed, 59 deletions(-) diff --git a/src/libcharon/plugins/stroke/stroke_ca.c b/src/libcharon/plugins/stroke/stroke_ca.c index f728284d9..bfaa9a9d9 100644 --- a/src/libcharon/plugins/stroke/stroke_ca.c +++ b/src/libcharon/plugins/stroke/stroke_ca.c @@ -89,11 +89,6 @@ struct ca_section_t { */ linked_list_t *ocsp; - /** - * Hashes of certificates issued by this CA - */ - linked_list_t *hashes; - /** * Base URI used for certificates from this CA */ @@ -132,7 +127,6 @@ static ca_section_t *ca_section_create(char *name, char *path) ca->path = strdup(path); ca->crl = linked_list_create(); ca->ocsp = linked_list_create(); - ca->hashes = linked_list_create(); ca->certuribase = NULL; return ca; } @@ -144,7 +138,6 @@ static void ca_section_destroy(ca_section_t *this) { this->crl->destroy_function(this->crl, free); this->ocsp->destroy_function(this->ocsp, free); - this->hashes->destroy_offset(this->hashes, offsetof(identification_t, destroy)); this->cert->destroy(this->cert); free(this->certuribase); free(this->path); @@ -607,46 +600,6 @@ static void list_uris(linked_list_t *list, char *label, FILE *out) enumerator->destroy(enumerator); } -METHOD(stroke_ca_t, check_for_hash_and_url, void, - private_stroke_ca_t *this, certificate_t* cert) -{ - ca_section_t *section; - enumerator_t *enumerator; - - hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1); - if (hasher == NULL) - { - DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported"); - return; - } - - this->lock->write_lock(this->lock); - enumerator = this->sections->create_enumerator(this->sections); - while (enumerator->enumerate(enumerator, (void**)§ion)) - { - if (section->certuribase && cert->issued_by(cert, section->cert, NULL)) - { - chunk_t hash, encoded; - - if (cert->get_encoding(cert, CERT_ASN1_DER, &encoded)) - { - if (hasher->allocate_hash(hasher, encoded, &hash)) - { - section->hashes->insert_last(section->hashes, - identification_create_from_encoding(ID_KEY_ID, hash)); - chunk_free(&hash); - } - chunk_free(&encoded); - } - break; - } - } - enumerator->destroy(enumerator); - this->lock->unlock(this->lock); - - hasher->destroy(hasher); -} - METHOD(stroke_ca_t, list, void, private_stroke_ca_t *this, stroke_msg_t *msg, FILE *out) { @@ -726,7 +679,6 @@ stroke_ca_t *stroke_ca_create() .get_cert_ref = _get_cert_ref, .reload_certs = _reload_certs, .replace_certs = _replace_certs, - .check_for_hash_and_url = _check_for_hash_and_url, .destroy = _destroy, }, .sections = linked_list_create(), diff --git a/src/libcharon/plugins/stroke/stroke_ca.h b/src/libcharon/plugins/stroke/stroke_ca.h index 064a7edec..97b77dbb9 100644 --- a/src/libcharon/plugins/stroke/stroke_ca.h +++ b/src/libcharon/plugins/stroke/stroke_ca.h @@ -58,13 +58,6 @@ struct stroke_ca_t { */ void (*list)(stroke_ca_t *this, stroke_msg_t *msg, FILE *out); - /** - * Check if a certificate can be made available through hash and URL. - * - * @param cert peer certificate - */ - void (*check_for_hash_and_url)(stroke_ca_t *this, certificate_t* cert); - /** * Get a reference to a CA certificate if it is already stored, * otherwise returns the same certificate. diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c index 1514b74dd..fe5c1a542 100644 --- a/src/libcharon/plugins/stroke/stroke_config.c +++ b/src/libcharon/plugins/stroke/stroke_config.c @@ -425,10 +425,6 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this, certificate = this->cred->load_peer(this->cred, cert); if (certificate) { - if (local) - { - this->ca->check_for_hash_and_url(this->ca, certificate); - } cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate); if (!first) { From 91dabace1137c28c4848de367fc9ab665b8f8d28 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 31 Oct 2019 15:18:17 +0100 Subject: [PATCH 5/5] testing: Add scenario with hash-and-URL encoding for intermediate CA certificates --- testing/scripts/build-certs-chroot | 18 ++++++- .../description.txt | 12 +++++ .../rw-hash-and-url-multi-level/evaltest.dat | 22 ++++++++ .../hosts/carol/etc/strongswan.conf | 11 ++++ .../hosts/carol/etc/swanctl/swanctl.conf | 41 ++++++++++++++ .../hosts/dave/etc/strongswan.conf | 11 ++++ .../hosts/dave/etc/swanctl/swanctl.conf | 41 ++++++++++++++ .../hosts/moon/etc/strongswan.conf | 11 ++++ .../hosts/moon/etc/swanctl/swanctl.conf | 54 +++++++++++++++++++ .../rw-hash-and-url-multi-level/posttest.dat | 8 +++ .../rw-hash-and-url-multi-level/pretest.dat | 10 ++++ .../rw-hash-and-url-multi-level/test.conf | 25 +++++++++ 12 files changed, 262 insertions(+), 2 deletions(-) create mode 100644 testing/tests/swanctl/rw-hash-and-url-multi-level/description.txt create mode 100644 testing/tests/swanctl/rw-hash-and-url-multi-level/evaltest.dat create mode 100644 testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/carol/etc/strongswan.conf create mode 100755 testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/carol/etc/swanctl/swanctl.conf create mode 100644 testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/dave/etc/strongswan.conf create mode 100755 testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/dave/etc/swanctl/swanctl.conf create mode 100644 testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/strongswan.conf create mode 100755 testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf create mode 100644 testing/tests/swanctl/rw-hash-and-url-multi-level/posttest.dat create mode 100644 testing/tests/swanctl/rw-hash-and-url-multi-level/pretest.dat create mode 100644 testing/tests/swanctl/rw-hash-and-url-multi-level/test.conf diff --git a/testing/scripts/build-certs-chroot b/testing/scripts/build-certs-chroot index acc742e37..f49a163bb 100755 --- a/testing/scripts/build-certs-chroot +++ b/testing/scripts/build-certs-chroot @@ -513,6 +513,13 @@ do cp ${RESEARCH_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca done +for t in rw-hash-and-url-multi-level +do + TEST="${TEST_DIR}/swanctl/${t}" + mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ca + cp ${RESEARCH_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ca +done + # Convert Research CA certificate into DER format openssl x509 -in ${RESEARCH_CERT} -outform der -out ${RESEARCH_CERT_DER} @@ -562,6 +569,13 @@ do cp ${SALES_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca done +for t in rw-hash-and-url-multi-level +do + TEST="${TEST_DIR}/swanctl/${t}" + mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509ca + cp ${SALES_CERT} ${TEST}/hosts/dave/${SWANCTL_DIR}/x509ca +done + # Convert Sales CA certificate into DER format openssl x509 -in ${SALES_CERT} -outform der -out ${SALES_CERT_DER} @@ -936,7 +950,7 @@ do cp ${TEST_CERT} ${TEST}/hosts/carol/${IPSEC_DIR}/certs done -for t in multi-level-ca ocsp-multi-level +for t in multi-level-ca rw-hash-and-url-multi-level ocsp-multi-level do TEST="${TEST_DIR}/swanctl/${t}" mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa @@ -1051,7 +1065,7 @@ do cp ${TEST_CERT} ${TEST}/hosts/dave/${IPSEC_DIR}/certs done -for t in multi-level-ca ocsp-multi-level +for t in multi-level-ca rw-hash-and-url-multi-level ocsp-multi-level do TEST="${TEST_DIR}/swanctl/${t}" mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/rsa diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/description.txt b/testing/tests/swanctl/rw-hash-and-url-multi-level/description.txt new file mode 100644 index 000000000..062c4f0e9 --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/description.txt @@ -0,0 +1,12 @@ +The VPN gateway moon controls the access to the hosts alice and +venus by means of two different Intermediate CAs. Access to +alice is granted to users presenting a certificate issued by the Research CA +whereas venus can only be reached with a certificate issued by the +Sales CA. The roadwarriors carol and dave have certificates from +the Research CA and Sales CA, respectively. Therefore carol can access +alice and dave can reach venus. +

+The gateway moon doesn't have the intermediate CA certificate installed +and instead of sending the actual certificates, the two clients send "Hash and URL" +certificate payloads. The gateway fetches the certificates via HTTP from server +winnetou. diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/evaltest.dat b/testing/tests/swanctl/rw-hash-and-url-multi-level/evaltest.dat new file mode 100644 index 000000000..5e16338c0 --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/evaltest.dat @@ -0,0 +1,22 @@ +carol::cat /var/log/daemon.log::fetched certificate.*moon.strongswan.org::YES +dave:: cat /var/log/daemon.log::fetched certificate.*moon.strongswan.org::YES +moon:: cat /var/log/daemon.log::fetched certificate.*carol@strongswan.org::YES +moon:: cat /var/log/daemon.log::fetched certificate.*CN=Research CA::YES +moon:: cat /var/log/daemon.log::fetched certificate.*dave@strongswan.org::YES +moon:: cat /var/log/daemon.log::fetched certificate.*CN=Sales CA::YES +moon:: cat /var/log/daemon.log::fetching crl from.*http.*research.crl::YES +moon:: cat /var/log/daemon.log::crl correctly signed by.*Research CA::YES +moon:: cat /var/log/daemon.log::fetching crl from.*http.*sales.crl::YES +moon:: cat /var/log/daemon.log::crl correctly signed by.*Sales CA::YES +moon:: cat /var/log/daemon.log::fetching crl from.*http.*strongswan.crl::YES +moon:: cat /var/log/daemon.log::crl correctly signed by.*strongSwan Root CA::YES +carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*alice.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.10/32]::YES +moon:: swanctl --list-sas --raw 2> /dev/null::research.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*alice.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.10/32] remote-ts=\[192.168.0.100/32]::YES +carol::cat /var/log/daemon.log::received TS_UNACCEPTABLE notify, no CHILD_SA built::YES +carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED.*child-sas.*venus.*state=INSTALLED::NO +moon:: swanctl --list-sas --raw 2> /dev/null::sales.*version=2 state=ESTABLISHED.*remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*child-sas.*venus.*state=INSTALLED::NO +dave:: cat /var/log/daemon.log::received TS_UNACCEPTABLE notify, no CHILD_SA built::YES +dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED.*child-sas.*alice.*state=INSTALLED::NO +moon:: swanctl --list-sas --raw 2> /dev/null::research.*version=2 state=ESTABLISHED.*remote-host=192.168.0.100 remote-port=4500 remote-id=dave@strongswan.org.*child-sas.*alice.*state=INSTALLED::NO +dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=C=CH, O=strongSwan Project, OU=Sales, CN=dave@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*venus.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.20/32]::YES +moon:: swanctl --list-sas --raw 2> /dev/null::sales.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=C=CH, O=strongSwan Project, OU=Sales, CN=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*venus.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.20/32] remote-ts=\[192.168.0.200/32]::YES diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/carol/etc/strongswan.conf b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..178fa2e7c --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/carol/etc/strongswan.conf @@ -0,0 +1,11 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 x509 revocation constraints pubkey openssl random +} + +charon-systemd { + load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default vici + + hash_and_url = yes +} diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/carol/etc/swanctl/swanctl.conf b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/carol/etc/swanctl/swanctl.conf new file mode 100755 index 000000000..fdf6ca55f --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/carol/etc/swanctl/swanctl.conf @@ -0,0 +1,41 @@ +connections { + + home { + remote_addrs = 192.168.0.1 + + local { + auth = pubkey + certs = carolCert.pem + } + remote { + auth = pubkey + id = moon.strongswan.org + revocation = strict + } + children { + alice { + remote_ts = 10.1.0.10/32 + esp_proposals = aes128-sha256-ecp256 + } + venus { + remote_ts = 10.1.0.20/32 + esp_proposals = aes128-sha256-ecp256 + } + } + version = 2 + proposals = aes128-sha256-ecp256 + } +} + +authorities { + + strongswan { + cacert = strongswanCert.pem + cert_uri_base = http://winnetou.strongswan.org/certs/ + } + + research { + cacert = researchCert.pem + cert_uri_base = http://winnetou.strongswan.org/certs/research/ + } +} diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/dave/etc/strongswan.conf b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/dave/etc/strongswan.conf new file mode 100644 index 000000000..178fa2e7c --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/dave/etc/strongswan.conf @@ -0,0 +1,11 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 x509 revocation constraints pubkey openssl random +} + +charon-systemd { + load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default vici + + hash_and_url = yes +} diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/dave/etc/swanctl/swanctl.conf b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/dave/etc/swanctl/swanctl.conf new file mode 100755 index 000000000..b1158690b --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/dave/etc/swanctl/swanctl.conf @@ -0,0 +1,41 @@ +connections { + + home { + remote_addrs = 192.168.0.1 + + local { + auth = pubkey + certs = daveCert.pem + } + remote { + auth = pubkey + id = moon.strongswan.org + revocation = strict + } + children { + alice { + remote_ts = 10.1.0.10/32 + esp_proposals = aes128-sha256-ecp256 + } + venus { + remote_ts = 10.1.0.20/32 + esp_proposals = aes128-sha256-ecp256 + } + } + version = 2 + proposals = aes128-sha256-ecp256 + } +} + +authorities { + + strongswan { + cacert = strongswanCert.pem + cert_uri_base = http://winnetou.strongswan.org/certs/ + } + + sales { + cacert = salesCert.pem + cert_uri_base = http://winnetou.strongswan.org/certs/sales/ + } +} diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/strongswan.conf b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..178fa2e7c --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/strongswan.conf @@ -0,0 +1,11 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 x509 revocation constraints pubkey openssl random +} + +charon-systemd { + load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default vici + + hash_and_url = yes +} diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf new file mode 100755 index 000000000..334ecb62f --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf @@ -0,0 +1,54 @@ +connections { + + research { + local_addrs = 192.168.0.1 + + local { + auth = pubkey + certs = moonCert.pem + id = moon.strongswan.org + } + remote { + auth = pubkey + id = "C=CH, O=strongSwan Project, OU=Research, CN=*" + } + children { + alice { + local_ts = 10.1.0.10/32 + esp_proposals = aes128-sha256-ecp256 + } + } + version = 2 + proposals = aes128-sha256-ecp256 + } + + sales { + local_addrs = 192.168.0.1 + + local { + auth = pubkey + certs = moonCert.pem + id = moon.strongswan.org + } + remote { + auth = pubkey + id = "C=CH, O=strongSwan Project, OU=Sales, CN=*" + } + children { + venus { + local_ts = 10.1.0.20/32 + esp_proposals = aes128-sha256-ecp256 + } + } + version = 2 + proposals = aes128-sha256-ecp256 + } +} + +authorities { + + strongswan { + cacert = strongswanCert.pem + cert_uri_base = http://winnetou.strongswan.org/certs/ + } +} diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/posttest.dat b/testing/tests/swanctl/rw-hash-and-url-multi-level/posttest.dat new file mode 100644 index 000000000..18e43bf30 --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/posttest.dat @@ -0,0 +1,8 @@ +carol::swanctl --terminate --ike home 2> /dev/null +dave::swanctl --terminate --ike home 2> /dev/null +carol::systemctl stop strongswan +dave::systemctl stop strongswan +moon::systemctl stop strongswan +carol::cd /etc/swanctl; rm -r rsa/* x509/* x509ca/* +dave::cd /etc/swanctl; rm -r rsa/* x509/* x509ca/* +moon::cd /etc/swanctl; rm -r rsa/* x509/* x509ca/* \ No newline at end of file diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/pretest.dat b/testing/tests/swanctl/rw-hash-and-url-multi-level/pretest.dat new file mode 100644 index 000000000..456938cc4 --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/pretest.dat @@ -0,0 +1,10 @@ +moon::systemctl start strongswan +carol::systemctl start strongswan +dave::systemctl start strongswan +moon::expect-connection research +carol::expect-connection alice +carol::swanctl --initiate --child alice 2> /dev/null +carol::swanctl --initiate --child venus 2> /dev/null +dave::expect-connection alice +dave::swanctl --initiate --child alice 2> /dev/null +dave::swanctl --initiate --child venus 2> /dev/null diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/test.conf b/testing/tests/swanctl/rw-hash-and-url-multi-level/test.conf new file mode 100644 index 000000000..b8048b4a0 --- /dev/null +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/test.conf @@ -0,0 +1,25 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice venus moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" + +# charon controlled by swanctl +# +SWANCTL=1