Josh Soref
b3ab7a48cc
Spelling fixes
...
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior
Closes strongswan/strongswan#164 .
2020-02-11 18:23:07 +01:00
[email protected]
a5b3c62091
testing: Remove unused connection definition in ikev2/force-udp-encaps
2019-11-07 11:35:43 +01:00
[email protected]
9d8d85f23c
testing: Fix SHA description in ikev*/esp-alg-null scenarios
2019-11-07 11:33:09 +01:00
Andreas Steffen
f05e9eebb0
testing: Added drbg plugin where required
2019-10-18 16:24:39 +02:00
Andreas Steffen
6d8e6ec61b
testing: Load PEM keys in ikev2/net2-net-rsa scenario
2019-05-10 12:54:28 +02:00
Tobias Brunner
21280da9f5
testing: Fix ikev2/net2net-rsa scenario
2019-05-08 14:56:48 +02:00
Andreas Steffen
b213204b3b
testing: Updated build-certs script
2019-05-08 14:56:48 +02:00
Andreas Steffen
cfeae14b06
testing: Deleting dynamic test keys and certificates
2019-05-08 14:56:48 +02:00
Tobias Brunner
1e059c837b
testing: Rename public keys in DNSSEC scenarios
...
We will generate PEM-encoded public keys with the script.
2019-05-08 14:56:48 +02:00
Andreas Steffen
8db01c6a3f
testing: Script building fresh certificates
2019-05-08 14:56:48 +02:00
Tobias Brunner
bc0a01ff2e
testing: Update documentation in headers of all updown scripts
2019-04-29 17:43:04 +02:00
Andreas Steffen
195ee25dba
testing: Updated expired certificates
2019-03-30 17:10:51 +01:00
Andreas Steffen
fa1f4d199e
testing: Prolonged Duck end entity certificate
2019-03-13 19:02:42 +01:00
Andreas Steffen
030de21b7b
testing: Migrated ikev2 scenarios to swanctl
2018-12-09 13:16:41 +01:00
Tobias Brunner
231828f810
testing: Config changes for FreeRADIUS 3.0
...
Also includes some changes for jessie's version of FreeRADIUS 2 (was
previously a custom version).
Besides the move to a subdir the config files were adapted for 3.0.
The rlm_sim_files module was removed with FreeRADIUS 3 and Debian's
package of FreeRADIUS 2 does not ship it, so we now replicate it using
the files module (via users file, which is actually a symlink to
mods-config/files/authorize in the default installation of FreeRADIUS 3).
Another approach was tried using rlm_passwd, however, that module does
not read binary/hex data, only printable strings, which would require
changing the triplets.
For 2.x a hack in the site config is necessary to make the attributes
available to the EAP-SIM module.
2018-11-21 14:32:25 +01:00
Tobias Brunner
a8112cc174
testing: Use freeradius instead of the removed radiusd to start FreeRADIUS
2018-11-21 14:32:25 +01:00
Tobias Brunner
c2742f9bf5
testing: Remove unused dhcpd config on moon
2018-11-21 14:32:25 +01:00
Tobias Brunner
9083ccd05c
testing: Accept ping6 output with IP address after hostname
...
Newer versions of ping6 add the IP address after the FQDN in the output.
2018-11-21 14:32:25 +01:00
Tobias Brunner
47ec761674
testing: Fix checks after changing fragmentation log messages
2018-07-09 17:15:07 +02:00
Tobias Brunner
df411bfa30
testing: The dhcp plugin uses the DHCP client port again by default
...
This reverts parts of commit becf027cd9707b70725a
2018-07-05 18:14:54 +02:00
Tobias Brunner
2ad1df9571
Replace 'inacceptable' with the more common 'unacceptable'
2018-06-28 18:46:42 +02:00
Tobias Brunner
9746c308ff
testing: Add ikev2/multi-level-ca-skipped scenario
2018-05-22 09:50:47 +02:00
Tobias Brunner
7b660944b6
dhcp: Only send client identifier if identity_lease is enabled
...
The client identifier serves as unique identifier just like a unique MAC
address would, so even with identity_leases disabled some DHCP servers
might assign unique leases per identity.
2018-05-18 18:04:01 +02:00
Tobias Brunner
becf027cd9
dhcp: Bind server port when a specific server address is specified
...
DHCP servers will respond to port 67 if giaddr is non-zero, which we set
if we are not broadcasting. While such messages are received fine via
RAW socket the kernel will respond with an ICMP port unreachable if no
socket is bound to that port. Instead of opening a dummy socket on port
67 just to avoid the ICMPs we can also just operate with a single
socket, bind it to port 67 and send our requests from that port.
Since SO_REUSEADDR behaves on Linux like SO_REUSEPORT does on other
systems we can bind that port even if a DHCP server is running on the
same host as the daemon (this might have to be adapted to make this work
on other systems, but due to the raw socket the plugin is not that portable
anyway).
2018-05-18 18:04:01 +02:00
Andreas Steffen
51d5b35f51
testing: Fixed ikev2/alg-chacha20poly1305 scenario
2018-04-19 16:33:04 +02:00
Tobias Brunner
2db6d5b8b3
Fixed some typos, courtesy of codespell
2018-02-13 12:19:54 +01:00
Tobias Brunner
ad14f2084e
testing: Add ikev2/mobike-virtual-ip-nat scenario
...
This tests moving from a public IP behind a NAT and back (with proper
changes of the UDP encapsulation).
2018-02-09 11:21:02 +01:00
Tobias Brunner
ce4aebe00a
testing: Configure logging via syslog in strongswan.conf
...
Globally configure logging in strongswan.conf.testing and replace all
charondebug statements with strongswan.conf settings.
2017-11-15 17:24:04 +01:00
Tobias Brunner
37a91758c9
testing: Add ikev2/net2net-rekey scenario
2017-08-07 10:44:05 +02:00
Tobias Brunner
0da10b73ad
testing: Fix ikev2/two-certs scenario
...
Since 6a8a44be88
2017-05-26 13:55:32 +02:00
Andreas Steffen
64f9fa9e9f
testing: Created ikev2/rw-eap-aka-sql-rsa scenario
...
This test scenario tests the eap-simaka-sql plugin.
2017-04-26 20:38:23 +02:00
Andreas Steffen
1732ca7b5b
testing: Updated OCSP certificate for carol
2017-03-21 09:09:06 +01:00
Andreas Steffen
efc1b98461
Allow x25519 as an alias of the curve25519 KE algorithm
2017-03-20 21:18:00 +01:00
Andreas Steffen
3c1e5ad6ce
testing: Added ikev2/net2net-ed25519 scenario
2016-12-17 18:07:29 +01:00
Andreas Steffen
99c03e9a11
testing: make curve25519 the default DH group
2016-11-14 16:20:51 +01:00
Andreas Steffen
ba6c7a52c0
testing: Renewed expired certificates
2016-10-18 18:13:58 +02:00
Andreas Steffen
2a2669ee3e
vici: strongswan.conf cache_crls = yes saves fetched CRLs to disk
2016-10-11 17:18:22 +02:00
Tobias Brunner
597e057b9e
testing: Remove ikev2/default-keys scenario
...
No default keys are generated anymore.
2016-10-05 12:25:29 +02:00
Andreas Steffen
d7e0ce2878
testing: Added ikev2/net2net-multicast scenario
2016-09-27 18:36:28 +02:00
Andreas Steffen
40f2589abf
gmp: Support of SHA-3 RSA signatures
2016-09-22 17:34:31 +02:00
Andreas Steffen
188b190a70
mgf1: Refactored MGF1 as an XOF
2016-09-21 06:40:52 +02:00
Andreas Steffen
1e0dc2c329
testing: Add chapoly, ntru and newhope plugins to crypto and integrity tests
2016-08-10 14:34:27 +02:00
Andreas Steffen
277ef8c2fa
testing: Added ikev2/rw-newhope-bliss scenario
2016-08-10 14:22:00 +02:00
Tobias Brunner
44e83f76f3
testing: Use TLS 1.2 in RADIUS test cases
...
This took a while as in the OpenSSL package shipped with Debian and on which
our FIPS-enabled package is based, the function SSL_export_keying_material(),
which is used by FreeRADIUS to derive the MSK, did not use the correct digest
to calculate the result when TLS 1.2 was used. This caused IKE to fail with
"verification of AUTH payload with EAP MSK failed". The fix was only
backported to jessie recently.
2016-06-17 15:53:12 +02:00
Tobias Brunner
aacf84d837
testing: Add expect-connection calls for all tests and hosts
...
There are some exceptions (e.g. those that use auto=start or p2pnat).
2016-06-16 14:35:18 +02:00
Tobias Brunner
8f56bbc82b
testing: Update test scenarios for Debian jessie
...
The main difference is that ping now reports icmp_seq instead of
icmp_req, so we match for icmp_.eq, which works with both releases.
tcpdump now also reports port 4500 as ipsec-nat-t.
2016-06-16 14:04:11 +02:00
Tobias Brunner
b71104a3df
testing: Fix posttest.dat for ikev2/rw-dnssec scenario
2016-06-16 14:01:47 +02:00
Tobias Brunner
796c36ade1
testing: Fix scenarios that check /etc/resolv.conf
2016-06-13 16:18:38 +02:00
Andreas Steffen
141ac4df8f
testing: wait until connections are loaded
2016-05-15 19:02:57 +02:00
Tobias Brunner
ea3a4d3f72
testing: List conntrack table on sun in ikev2/host2host-transport-connmark scenario
2016-04-06 14:01:18 +02:00
Josh Soref