denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Migrate ikev2-stroke-bye scenarios to vici

Browse Source
This commit is contained in:
Andreas Steffen
2021-06-22 10:23:06 +02:00
parent 706c58b291
commit eba2622587
931 changed files with 5934 additions and 5925 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/reauth-mbb-revoked/description.txt
+12
View File
@@ -0,0 +1,12 @@
This scenario tests <b>make-before-break reauthentication</b> using overlapping
IKE_SAs by setting the <i>make_before_break</i> strongswan.conf option. The
initiator <b>carol</b> reauthenticates the IKE_SA with host <b>moon</b>, but does
not close the old IKE_SA before the replacement CHILD_SA is in place.
<p/>
Because the responder is always able to install CHILD_SAs before the initiator
is, some traffic sent by the responder over such a CHILD_SA might get dropped by
the initiator (until it also installed the CHILD_SA). This is particularly
problematic if OCSP/CRL checks are delayed or if they can also be done via the
IPsec tunnel once it's established. Therefore, online OCSP/CRL checks are
suspended during the reauthentication and done afterwards. This is verified here
by revoking the responder's certificate after the SA got initially established.