testing: Add a failing client to the ikev2/rw-eap-tls-only scenario

testing/tests/ikev2/rw-eap-tls-only/description.txt

@@ -2,3 +2,6 @@ The roadwarrior <b>carol</b> sets up a connection to gateway <b>moon</b>.
 The strong mutual authentication of both peers is based on <b>EAP-TLS</b> only
 (without a separate IKEv2 authentication), using TLS client and server certificates,
 respectively.
+<br>
+The roadwarrior <b>dave</b> doesn't have the appropriate CA certificate installed
+and, therefore, doesn't trust gateway <b>moon</b>'s certificate and rejects it.

testing/tests/ikev2/rw-eap-tls-only/evaltest.dat

@@ -2,7 +2,11 @@ carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
 carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
 carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::YES
 carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
+dave::cat /var/log/daemon.log::no issuer certificate found for \"C=CH, O=strongSwan Project, CN=moon.strongswan.org\"::YES
+dave::cat /var/log/daemon.log::no TLS public key found for server 'C=CH, O=strongSwan Project, CN=moon.strongswan.org'::YES
+dave::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::NO
 moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, OU=Research, [email protected]' with EAP successful::YES
+moon:: cat /var/log/daemon.log::EAP method EAP_TLS failed for peer C=CH, O=strongSwan Project, OU=Accounting, [email protected]::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
 carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=C=CH, O=strongSwan Project, OU=Research, [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=C=CH, O=strongSwan Project, CN=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
 moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-eap.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=C=CH, O=strongSwan Project, CN=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=C=CH, O=strongSwan Project, OU=Research, [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES

testing/tests/ikev2/rw-eap-tls-only/hosts/dave/etc/strongswan.conf

@@ -0,0 +1,16 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 mgf1 gmp x509 curl revocation hmac kdf gcm vici kernel-netlink socket-default eap-tls updown
+
+  multiple_authentication=no
+  syslog {
+    daemon {
+      tls = 2
+    }
+  }
+}

testing/tests/ikev2/rw-eap-tls-only/hosts/dave/etc/swanctl/swanctl.conf

@@ -0,0 +1,27 @@
+connections {
+
+   home {
+      local_addrs  = 192.168.0.200
+      remote_addrs = 192.168.0.1
+
+      local {
+         auth = eap-tls
+         certs = daveCert.pem
+      }
+      remote {
+         auth = eap-tls
+         id = "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
+      }
+      children {
+         home {
+            remote_ts = 10.1.0.0/16
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      send_certreq = no
+      proposals = aes128-sha256-x25519
+   }
+}

testing/tests/ikev2/rw-eap-tls-only/posttest.dat

@@ -1,5 +1,7 @@
+dave::systemctl stop strongswan
 carol::swanctl --terminate --ike home
 carol::systemctl stop strongswan
 moon::systemctl stop strongswan
-moon::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
+moon::iptables-restore < /etc/iptables.flush

testing/tests/ikev2/rw-eap-tls-only/pretest.dat

@@ -1,7 +1,12 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+dave::rm /etc/swanctl/x509ca/*
 moon::systemctl start strongswan
 carol::systemctl start strongswan
+dave::systemctl start strongswan
 moon::expect-connection rw-eap
 carol::expect-connection home
+dave::expect-connection home
 carol::swanctl --initiate --child home 2> /dev/null
+dave::swanctl --initiate --child home 2> /dev/null

testing/tests/ikev2/rw-eap-tls-only/test.conf

@@ -5,11 +5,11 @@
 
 # All guest instances that are required for this test
 #
-VIRTHOSTS="alice carol moon"
+VIRTHOSTS="alice carol dave moon"
 
 # Corresponding block diagram
 #
-DIAGRAM="a-m-c.png"
+DIAGRAM="a-m-c-w-d.png"
 
 # Guest instances on which tcpdump is to be started
 #
@@ -18,7 +18,7 @@ TCPDUMPHOSTS="moon"
 # Guest instances on which IPsec is started
 # Used for IPsec logging purposes
 #
-IPSECHOSTS="moon carol"
+IPSECHOSTS="moon carol dave"
 
 # charon controlled by swanctl
 #