From b5747192bd88b11a482aa95c39d8e6c2c21606c4 Mon Sep 17 00:00:00 2001 From: Andreas Steffen Date: Mon, 12 Nov 2018 13:51:01 +0100 Subject: [PATCH] testing: Added botan/net2net-pkcs12 scenario --- .../botan/net2net-pkcs12/description.txt | 8 ++++ .../tests/botan/net2net-pkcs12/evaltest.dat | 5 +++ .../hosts/moon/etc/strongswan.conf | 6 +++ .../moon/etc/swanctl/pkcs12/moonCert.p12 | Bin 0 -> 3661 bytes .../hosts/moon/etc/swanctl/swanctl.conf | 36 ++++++++++++++++++ .../hosts/sun/etc/strongswan.conf | 6 +++ .../hosts/sun/etc/swanctl/pkcs12/sunCert.p12 | Bin 0 -> 3661 bytes .../hosts/sun/etc/swanctl/swanctl.conf | 36 ++++++++++++++++++ .../tests/botan/net2net-pkcs12/posttest.dat | 6 +++ .../tests/botan/net2net-pkcs12/pretest.dat | 9 +++++ testing/tests/botan/net2net-pkcs12/test.conf | 25 ++++++++++++ 11 files changed, 137 insertions(+) create mode 100644 testing/tests/botan/net2net-pkcs12/description.txt create mode 100644 testing/tests/botan/net2net-pkcs12/evaltest.dat create mode 100644 testing/tests/botan/net2net-pkcs12/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/botan/net2net-pkcs12/hosts/moon/etc/swanctl/pkcs12/moonCert.p12 create mode 100755 testing/tests/botan/net2net-pkcs12/hosts/moon/etc/swanctl/swanctl.conf create mode 100644 testing/tests/botan/net2net-pkcs12/hosts/sun/etc/strongswan.conf create mode 100644 testing/tests/botan/net2net-pkcs12/hosts/sun/etc/swanctl/pkcs12/sunCert.p12 create mode 100755 testing/tests/botan/net2net-pkcs12/hosts/sun/etc/swanctl/swanctl.conf create mode 100644 testing/tests/botan/net2net-pkcs12/posttest.dat create mode 100644 testing/tests/botan/net2net-pkcs12/pretest.dat create mode 100644 testing/tests/botan/net2net-pkcs12/test.conf diff --git a/testing/tests/botan/net2net-pkcs12/description.txt b/testing/tests/botan/net2net-pkcs12/description.txt new file mode 100644 index 000000000..1d40e30f0 --- /dev/null +++ b/testing/tests/botan/net2net-pkcs12/description.txt @@ -0,0 +1,8 @@ +A connection between the subnets behind the gateways moon and sun is set up. +The authentication is based on X.509 certificates and an RSA private key stored in +PKCS12 format. +

+Upon the successful establishment of the IPsec tunnels, leftfirewall=yes +automatically inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, client alice behind gateway moon +pings client bob located behind gateway sun. diff --git a/testing/tests/botan/net2net-pkcs12/evaltest.dat b/testing/tests/botan/net2net-pkcs12/evaltest.dat new file mode 100644 index 000000000..bfc7e76f1 --- /dev/null +++ b/testing/tests/botan/net2net-pkcs12/evaltest.dat @@ -0,0 +1,5 @@ +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES +moon::swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES +sun:: swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/botan/net2net-pkcs12/hosts/moon/etc/strongswan.conf b/testing/tests/botan/net2net-pkcs12/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..1d9a7c08b --- /dev/null +++ b/testing/tests/botan/net2net-pkcs12/hosts/moon/etc/strongswan.conf @@ -0,0 +1,6 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = pem nonce revocation botan x509 curl vici kernel-netlink socket-default updown + multiple_authentication = no +} diff --git a/testing/tests/botan/net2net-pkcs12/hosts/moon/etc/swanctl/pkcs12/moonCert.p12 b/testing/tests/botan/net2net-pkcs12/hosts/moon/etc/swanctl/pkcs12/moonCert.p12 new file mode 100644 index 0000000000000000000000000000000000000000..365da741f555c7c8a71e6691ae20e32d976d9bab GIT binary patch literal 3661 zcmV-T4zlquf(}Un0Ru3C4i5$iDuzgg_YDCD0ic2o00e>!{4jzI_%MP9uLcP!hDe6@ z4FLxRpn?dXFoFo20s#Opf(Vrc2`Yw2hW8Bt2LUh~1_~;MNQUL0TQ|)0%G7sUrdF!Ia)~77*N82 zXQC|utgJ`f7!Cvl>KP66?DOmO&+(%#LIuo;UyxnKv%K(ew3F*R{?@KW9I?lFIT@G< zoHl4Vt$rF`6Fv^ZSmAZc9!av&@~D`NrYi~ zxtv&^oOmWoFLOqGJhk3F`H z)~^*-ZX0o``yK^Ls?)LV|7ChQ7CQRNrXdWvSacYCR{xP~ANbvUNXF@b^%#`5#bgd2 z`ZjU4;b)&q>O@t(Wca8cM0Kf3a6G1(U1$al0$IH8{?81JqyzP!lN--voO^wnBo#p+ z^Vc&lR&)kRQp;&~==Et^i-?D}q1xTyUHxD|)^Ta7zb<4R^-=K2TMqfAx}uvGGzJsV zX+=fuo-4tSjdR|@2ZV*U}qCC?x}`?TXpM7sI?~_+@gT1*`zU6WGLc1*RtBypVsDf0HyG&QG&8;0dx( zzt2p8PALJ1f$VRRpc#?$6+9_^RLGb3U6p1Wy|qIMbDQew2-(h3u^*6~9P0(25R94@ zTSL9J^Rj|hT$0OIo?T1I={;eF>&MRVJ_3(ajS3vGHt^_U6}N+8djvsZTFeRZCB?kz za%fT*(e>k6()ZphY2aC#kCA*nYQK8`hS}fBqRVCDbR7V>qBLl#DKig+;RN`|g4j1z zLH!2ZOFTGu@0feAUik#I15=YkZ712)@_zvrT&87j^-$3Zi&qCSM8MLX;0(?3ce&WM zkDP?8y`RfB*~NPN{Hw5pY@Z@+VxeEl|5aUl3S%@22d?n_c*^d`a&ONz#Mg`$psE)P z?)^R|mq+JEO0g<|cISF7YnueLuuZbSRDYIRTl9lnG`2hX| z$Mau4Y($g{jX-UiiS=UX zMphF>hF-2P0W3D~=h%PZz=k=>u8!zcoSs*AY%YPzv`8(9ho*P34wcg*Ola@4>hVkqX317#8S7QA@3P%tb*Lp1K!L*_`8?*m9zQE^_eoQCPsuBQ^|GLjz zeq9dNO(j*|8{mGlDUymcm2c3_5ufZx=P*ZnUyG^>lGXZ$)*%jk1Q4m2u(TvAWZz{+ zQa|_d!|idOwAJ47O;K_$G#u=A#poLS9=}OGPN5;UZVG{&Ee8J<3)n2a`SsZN?E+q( zmF!W)XxG?&Vf`S)H1oZYJb2Ux7;;{1p=IyY+SkptKWZN<#oox+zU7=fbZFd=_?9G12Lq2G@{ZJ3a2dWU;ANo!b{KXjh+g5zW4q`-u>WJj%mtaSZK zA=bnlwE@((>>e4OtxZk~%P>hVI9vHSjJxw`Wo6H8;9ig{|C7+jl4dClht(NEyzY%r z)xk2;eWWB)9Ba_HD;bkctLTLxSTBPVtZx&XFh-ti1tj>L#%b^d>w3NNnG-^q*YLnq zS!W4!z53TPfY)lvA~U>-R`k z8AyekCSA>wMB|KTase}%pH2O&6u=*gFuJ)-_T^7AIXyf+VY-eC>;oI08hP9w?98N& zas z-cduJz+`n)GEp#g8a*cT z`Cg)v@nJzH_nl#OwRD>g$8ePIK5W{^Vgs?I%4{(~;66$(E_c1K!ZMDy2S%%Wb8AF` zm0R>OGk`_JfTUk1pac)W3tUZ6bh7RcvCN1Q0OBF|4&WGTf|jZ_tfquUsQ_FY_7E~` zKDz)e@GzKLUZe{^~B#FRov1A;emuv+DOU|&MIIX*5qsS^eCR<4{f2ZQQY z8jX5vZ62*FZE&LNQUOfv7Zr zgm!Y>PJiJhP3`NW>0@kEz%_cJez%MLNGYfiR{A^W)%JGeZz?|`I7^3zz*G07bIdQT zsVG1cXST2Xyz7jwPA!62LrFDNi@ie4|A5D*aYdlV!C+bykQm?nSWNz6aWcCD_N&;s zUy}`;FR2gqm&Yjbe0nark3B4;fY4a}6I-?>M^!^>x+7r=6;fVeMM(vpUU}&U)Q%SI zrB6<(w#XPevQ~AMG{)?6|D2{I5}iLK>^h}?kJ(sdQ#`mam0~#BXvCeP86^Fe^zrVX zQkyCwUdn3)Md!>Z8HX(*T_Kivh#^+|{r0WyrVWBuaIo+|cm8(v?MazJRxpNC0n4A9 z2+7*d0o2@`z^nb9hi9ktWo7rV`(604^E{r)=Eq1n2z_qK(l_excWEtQ zweaX0c^HlO1HUe^BCHVF_gCt@1o47DyE<~A32D%`@jCr&FZC>Xz1Pu9o^w22QQyk! zGK!k{X^7ucs6QyIKVA~1{Z4~=o{40oJ3#++xAsa8j6hSPJ1?e}D5swE5LS?!J~%Fu z#BMl0aEWWgfN&pK%f@Q?gS2zz?1soI%~|;e-h%%gzEC*FA@PCWRQv?T>^KQl(7m3O zG4i9eM9VqyhUn(XRq=XvM`kQH0Z(BQZfR^vB-^^tvv!y!5qLVcb}I>4Y{YJi5syqz z9fkf9-y(N|ZtYEIIYu%HPoZd4yjDEot=b?tU^gE3hr9I*A|E(lB%97zij9h0iGzpO z<7nn+jk+et`J9Py(XwTtSBfTQc1Zyflc>cgi$V15g*nrM zlj4TBHdcMO zHl36z8*njpt5v)14xnsehH5C7Y50ip{naHmLV<~kxly}5j@}txZ;2d(f1}@G* zB&k z>Iq(RN=Pp`dq*xpO-K{R#TvkQ1TV^tb7q9XM0dI zuif`6?wHiaEd7@)j)@|&qT--%DGk*fru`Gp)VmjG+aS;RDJ06B*`vDP$XQm9)z-k_ z9eIG%Oii{6y*ZUjmvHZIu#0#FH!0x3BvmmbFe3&DDuzgg z_YDCF6)_eB6lqThP?f8aXmx}XR&!!w{y=GIFfcJNAutIB1uG5%0vZJX1Qc`&n{B>C f_(2!{4jzI_%MP9uLcP!hDe6@ z4FLxRpn?dXFoFo20s#Opf(Vrc2`Yw2hW8Bt2LUh~1_~;MNQU_Jy}sJ9caQb?jI`x=bQHmzTE5-uP&)eIDR@_= zIy-lbI0vjdZq>{T2d2n7B4L9?ToaHq@B>-maCF$eh~sV3IwAWKF;{uy3z^kNOlg$- zk^wW*K6Cp&6fomCZ}#@S9;74Voc(H?SM$;bki%6ql<` z-CTgSEqD<9Hub{3OPnI)rqrCxmp1Is^+%EXu6E+&ylB2hbSi&d`8@kJz{qqLUX~3y z4s1?RR>?;CO9|28xqjUudn81$S$K^iGl}GEIX#D5#sQ#8`1l@sMNWqCqap*mH>P)6sO5@jMe0AsL#j|-_119EnSN$|b@7+-` zKtB(A3FH`H7*pD1^6t~SrWv2lgqx*J(58y1{_-cPb$ams8A-)z$rAu`3|m+-o^i&y z8-k0sZQ9X1c&u8W#|4k4@jdM7Y{xU_hEMr)VvL&+IiOpaLW(Lqd(4hRJl(v4%6o_~ zah9=M561E{M=RIc;W2%%oG zYh)e_=%hF@jtRgEa@SgNLggA*#NEanYi;L@@PQLGltJg^uEK|C;~%*~KcgYr>1rh= z_>*?}Lp}f{P!9b~*xB+stWpyqw^cTk#gbXzYV0_eHtc2Y5+^8Z5=t4z$FVoT<;d!u z%--_emFD=ew))DHJ@j2g*&9VdSQKLi{$T9L#2>QOLXw>DSR0g}teNOzjIG#w#?lo7cD&s3ff5(X7DhQ0JnT1) zIqUKBgl$toaP+Syt^!}}6EeG5Ore?|_7zEohlf+{DxN?ebS`RZ?ry2xXBcAJiMO(T z<#t)Mc?A#1Y~x&#*_d*d?!MN*1Z0k>K5O076p{c@`~1u8QtYr-Ks`1)ZrdUNJ`^EP zH7@V3$Sn`hsLTvd2Mb`xk-CsCs$VuBLdxyFm=S^ZMeECu$3dMEE0d{fHMuJM`c8cx zx(`(Q6gV@*qIo7%r`y#m@k4)N`%{sR@rRSRD=#B>Up!`t)x@keL2@IMMb z;&*q#r!tVBB6lDBHpzr;*tP%Nnu@6Oy`Yfer6)TP%NQUn=yiCSe@NTohD=N-?o}tR zD=mIqnjw(Dt1=?X?WJo8hc)}`bY9TtQuYypXsH2O8BoR}h%PBx{-mY-`z%LP42zq* zYjL(SUylbWa^HfQLefmm=U{MRRWXzvJjM!mNB|F!q*jK! z7!=!!TArQTG6Ng9bytsQPo2|fP_MOH#*9>$r)sL1|1|emU^n>|XHCTY-_;;oL(Np@xH?ro1Em7tWcg-`u%d0i)g}75eXVL)zta2rcOnhwn3KnVqJz=F2PYI z$wocJWh{#TO$`oHjlxT%-xr|gzku6rFmILWYk1Lv)Sa$jb^E7q69{|wC6c07OfZQ~ zkQ*#C0E_5_qRp)pGt-gb!(<(!5}3(TcSw)&n}yx&l3)MVE*!8E(uD0sFW|5@AokxE#+cpaAY$$tzYOC25f%AP9#_xSXQb+;B zwmsaPGq46XSZdQ(s$5i*5EFxVU@y`SEA6#8kJ86*{BrJfI;YO;eTX&3AwZ!;MymFe zUabl_PE^zE!D_7Y7KJ)~8orS= zJ08^culbp|wk9S$o#BW)$TiRaJ_!Nq$|E+N>9fk>hQ}p#w%>l(4p+cl^|9&V-rAQW zD$B4`*V50^voY=%liU?T1k#hk@abW8lo%+CWBAt$ZNXv-o+z6HQ4YRYsxUaVzM+I3 z>q!0{PD^JY^Yd;X*4x2lpO5fJaSTQz6l9%ZxcTtEr~ng#Qs5UdLthmQ+=<}>mZ@hW zJ`C)4EH9})yICe-mD$&0%~9zxX>myb{I~t2 z`Wob{L?2fFKc)^m4!dzU3dpkxLK}9-h7)X;&`$c7PdcUPX%~)770w=UgZeqmjIOUQN1##~zuH-dfifF3Y(LM%igqKz9bRH|((OXv6DTs(#j}PP_N= z%Re-TC)MzM=Hz(~w6w9Uvnn<_7RQWgKY$JVO2ELD)(A_A8DPtaND@VV9m^ym8@t3^ z3+rDh0ezU*I9?}ZLBr9isAhDoA0qB8yrMEy3lCt}FoFd^1_>&LNQUcsM4VbMl64w_ zFKhLtZQNlW^4Kx!*ivj`<@*$-d7>mZie+NT}=v8&P z_-{mhp_oH5mh5rLx^z^}lLnq7$=9|;4e4g~r<|P$u74H0_K8C$(Zeuf8R;!tPY-kQ6-He{$2)Y^AGy`%k)>wwQw? zW`b%lG<2)o&Vm}Y@hsuQI^^6R&JJcoLG&k|tTKh!2a06UzP^ zFVRuUWXpf$<_j19F=PIAewQP2msg3>S*l2vG3aU-z3=iYEKu(e9s)`%B-oj|w@kde z`J)BNjdrA)hUstgUZ^pl+q+>S52twEf-2Zz`K1dWB&KT+e4jq(me*=i=A0HMr0N82 zZMkBFhfPr7G*KdG0PP^%;pAcn5`(K#l%hgew$#d!QmcHTtD!~aP6sToQ{;0E4H(8m z(LKUHd9wujV^_VT{+4!&v}iTF+zbJjnC}_ztBp!`EP~#4%Su3W?kY<-% zLUqMH&qs;xq{TwiOqm{hP*e~-k3JB7i8mz9`Fz+?18TrCcclH3?(@P%cEy#^g=im(P!)3UsvP63XkJ=Rc8O~9 zgtiKqLGw^$Y`7ocda+h+rN$oh3L@O5?wF%^?ic*eZU>2Sx}HJZOLicB%j1JQOr*ku z$CgQv&O|xSUQYVJ?+=?pNnw^XX@PfcD|V6}scFtpLWjQ#(hm*S8ch8a|J-SiU7A_Yw1 z*%Lih78?wUZ*#V5c}QU|-jcE-S|Uejhe55T#$j)T)cHqdfCkwJ1+$Zp#lLbJ^YWM% zof2i<-|<3Vf``LhAO8broT92!z0+-5p<9pYv`V@8*x&^ zy5I;TjYtJ9Q>YaMc2Vxa;4jdTim}xrHOcmagq^xud%t)n3r@F>BfgxVepelFwixJ{ z)KRX?{!Pv6o)^d>1KjJUC#2caUU4;BbtQ_iZ6eHQg)Lr?BrdLG^nGS<8c!@K(l2a6 zy%UPepk!{Q^T3;l8@Qz{Y8hUw8b|DWeOe@W(8a%yG}#hm7s>z}r3o=5Fe3&DDuzgg z_YDCF6)_eB6gxPc*JlrgnDc&$khJ-eiPOmAz%Vf|AutIB1uG5%0vZJX1QY;}Y_ktf fTC)@Hh$p-Q;7T~RLz)B#m(K%kx?(9M0s;sC /dev/null diff --git a/testing/tests/botan/net2net-pkcs12/test.conf b/testing/tests/botan/net2net-pkcs12/test.conf new file mode 100644 index 000000000..87abc763b --- /dev/null +++ b/testing/tests/botan/net2net-pkcs12/test.conf @@ -0,0 +1,25 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" + +# charon controlled by swanctl +# +SWANCTL=1