denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Use identity based CA restrictions in rw-hash-and-url-multi-level

Browse Source 
This is a prominent example where the identity based CA constraint is
benefical. While the description of the test claims a strict binding
of the client to the intermediate CA, this is not fully true if CA operators
are not fully trusted: A rogue OU=Sales intermediate may issue certificates
containing a OU=Research.

By binding the connection to the CA, we can avoid this, and using the identity
based constraint still allows moon to receive the intermediate over IKE
or hash-and-url.
This commit is contained in:
Martin Willi
2019-12-06 10:07:47 +01:00
committed by Tobias Brunner
parent 026024bc02
commit f95d512251
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf
+2 -2
View File
@@ -10,7 +10,7 @@ connections {
} }
remote { remote {
auth = pubkey auth = pubkey
id = "C=CH, O=strongSwan Project, OU=Research, CN=*" ca_id = "C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
} }
children { children {
alice { alice {
@@ -32,7 +32,7 @@ connections {
} }
remote { remote {
auth = pubkey auth = pubkey
id = "C=CH, O=strongSwan Project, OU=Sales, CN=*" ca_id = "C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
} }
children { children {
venus { venus {