denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Reorganizing IKEv1 and IKEv2 examples

Browse Source 
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen committed 2021-05-21 09:42:50 +02:00
1 parent db93938297
commit 7c5a2974b9
4054 files changed
+16375 -15209
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

testing/tests/ikev2/acert-cached/description.txt
Regular → Executable
+7 -7
View File
@@ -1,11 +1,11 @@
<p>The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
To authorize clients, <b>moon</b> uses locally cached attribute certificates.
While for <b>carol</b> a valid attribute certificate for the group <i>sales</i>
is available, <b>dave</b>'s attribute certificates are either expired or
do not grant permissions for the <i>sales</i> group.</p>
<p>Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> try
to ping the client <b>alice</b> behind the gateway <b>moon</b>, but dave fails
to do so.</p>
do not grant permissions for the <i>sales</i> group.
<p/>
The updown script automatically inserts iptables-based firewall rules that let pass
the tunneled traffic. In order to test both tunnel and firewall, both <b>carol</b>
and <b>dave</b> try to ping the client <b>alice</b> behind the gateway <b>moon</b>,
but dave fails to do so.
testing/tests/ikev2/acert-cached/evaltest.dat
Regular → Executable
+4 -4
View File
@@ -1,7 +1,7 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::NO
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED.*child-sas.*home.*state=INSTALLED.*::NO
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=dave@strongswan.org.*child-sas.*net.*state=INSTALLED::NO
moon::cat /var/log/daemon.log::constraint check failed: group membership to 'sales' required::YES
dave::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
testing/tests/ikev2/acert-cached/hosts/carol/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add
testing/tests/ikev2/acert-cached/hosts/carol/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
}
testing/tests/ikev2/acert-cached/hosts/carol/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = carol@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/acert-cached/hosts/dave/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn home
left=PH_IP_DAVE
leftcert=daveCert.pem
leftid=dave@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add
testing/tests/ikev2/acert-cached/hosts/dave/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
}
testing/tests/ikev2/acert-cached/hosts/dave/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = daveCert.pem
id = dave@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/acert-cached/hosts/moon/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any
rightgroups=sales
keyexchange=ikev2
auto=add
testing/tests/ikev2/acert-cached/hosts/moon/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation acert hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 acert revocation curve25519 gmp curl kernel-netlink socket-default updown vici
}
testing/tests/ikev2/acert-cached/hosts/moon/etc/swanctl/swanctl.conf
Executable
+26
View File
@@ -0,0 +1,26 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
groups = sales
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/acert-cached/posttest.dat
Regular → Executable
+4 -8
View File
@@ -1,11 +1,7 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
carol::systemctl stop strongswan
dave::systemctl stop strongswan
moon::systemctl stop strongswan
moon::cd /etc/swanctl; rm rsa/* x509aa/* x509ac/*
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/acerts/carol-sales-finance.pem
moon::rm /etc/ipsec.d/acerts/dave-sales-expired.pem
moon::rm /etc/ipsec.d/acerts/dave-marketing.pem
moon::rm /etc/ipsec.d/private/aaKey.pem
moon::rm /etc/ipsec.d/aacerts/aaCert.pem
testing/tests/ikev2/acert-cached/pretest.dat
Regular → Executable
+5 -5
View File
@@ -1,11 +1,11 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
moon::systemctl start strongswan
carol::systemctl start strongswan
dave::systemctl start strongswan
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home
dave::ipsec up home
dave::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/acert-cached/test.conf
Regular → Executable
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/ikev2/acert-fallback/description.txt
+1 -1
View File
@@ -5,7 +5,7 @@ The authentication is based on <b>X.509 certificates</b>. To authorize clients,
the <i>finance</i> groups. The attribute certificate for <i>finance</i> is not
valid anymore, hence <b>carol</b> gets access to the <i>sales</i> connection
only.</p>
<p>Upon the successful establishment of the IPsec tunnel, <b>leftfirewall=yes</b>
<p>Upon the successful establishment of the IPsec tunnel, the updown-script
automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, <b>carol</b> tries to ping both
<b>alice</b> and <b>venus</b>, but only the ping for the <i>sales</i> related
testing/tests/ikev2/acert-fallback/evaltest.dat
+2 -3
View File
@@ -1,6 +1,5 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::finance.*: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO
moon:: ipsec status 2> /dev/null::sales.*: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.20/32]::YES
moon:: swanctl --list-sas --raw 2> /dev/null::sales.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*venus.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.20/32] remote-ts=\[192.168.0.100/32]::YES
moon::cat /var/log/daemon.log::constraint check failed: group membership to 'finance' required::YES
carol::ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
testing/tests/ikev2/acert-fallback/hosts/carol/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add
testing/tests/ikev2/acert-fallback/hosts/carol/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 gmp curve25519 x509 curl revocation hmac kernel-netlink socket-default vici
}
testing/tests/ikev2/acert-fallback/hosts/carol/etc/swanctl/swanctl.conf
Executable
+25
View File
@@ -0,0 +1,25 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = carol@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/acert-fallback/hosts/moon/etc/ipsec.conf
-32
View File
@@ -1,32 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn finance
left=PH_IP_MOON
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.10/32
leftfirewall=yes
right=%any
rightid=*@strongswan.org
rightgroups=finance
keyexchange=ikev2
auto=add
conn sales
left=PH_IP_MOON
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.20/32
leftfirewall=yes
right=%any
rightgroups=sales
keyexchange=ikev2
auto=add
testing/tests/ikev2/acert-fallback/hosts/moon/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation acert hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 gmp curve25519 x509 acert curl revocation hmac kernel-netlink socket-default vici
}
testing/tests/ikev2/acert-fallback/hosts/moon/etc/swanctl/swanctl.conf
Executable
+46
View File
@@ -0,0 +1,46 @@
connections {
finance {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
groups = finance
}
children {
alice {
local_ts = 10.1.0.10/32
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
sales {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
groups = sales
}
children {
venus {
esp_proposals = aes128gcm128-x25519
local_ts = 10.1.0.20/32
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/acert-fallback/posttest.dat
+4 -8
View File
@@ -1,8 +1,4 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
carol::rm /etc/ipsec.d/acerts/carol-sales.pem
carol::rm /etc/ipsec.d/acerts/carol-finance-expired.pem
moon::rm /etc/ipsec.d/private/aaKey.pem
moon::rm /etc/ipsec.d/aacerts/aaCert.pem
carol::systemctl stop strongswan
moon::systemctl stop strongswan
moon::cd /etc/swanctl; rm rsa/* x509aa/*
carol:: rm /etc/swanctl/x509ac/*
testing/tests/ikev2/acert-fallback/pretest.dat
+3 -5
View File
@@ -1,8 +1,6 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
moon::systemctl start strongswan
carol::systemctl start strongswan
moon::expect-connection finance
moon::expect-connection sales
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/acert-fallback/test.conf
+6 -3
View File
@@ -5,17 +5,20 @@
# All guest instances that are required for this test
#
VIRTHOSTS="alice venus moon carol winnetou"
VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
DIAGRAM="m-c-w.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
# charon controlled by swanctl
SWANCTL=1
testing/tests/ikev2/acert-inline/description.txt
Regular → Executable
+10 -11
View File
@@ -1,12 +1,11 @@
<p>The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
To authorize clients, <b>moon</b> expects attribute certificates sent inline in
IKEv2 CERT payloads. <b>Carol</b> provides a valid attribute certificate for
the group <i>sales</i>, but <b>dave</b> offers two invalid attribute
certificates: One is not for the <i>sales</i> group, and the other is issued by
an AA that has been expired.</p>
<p>Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> try
to ping the client <b>alice</b> behind the gateway <b>moon</b>, but dave fails
to do so.</p>
To authorize clients, <b>moon</b> uses locally cached attribute certificates.
While for <b>carol</b> a valid attribute certificate for the group <i>sales</i>
is available, <b>dave</b>'s attribute certificates are either expired or
do not grant permissions for the <i>sales</i> group.
<p/>
The updown script automatically inserts iptables-based firewall rules that let pass
the tunneled traffic. In order to test both tunnel and firewall, both <b>carol</b>
and <b>dave</b> try to ping the client <b>alice</b> behind the gateway <b>moon</b>,
but dave fails to do so.
testing/tests/ikev2/acert-inline/evaltest.dat
Regular → Executable
+4 -4
View File
@@ -1,7 +1,7 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::NO
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED.*child-sas.*home.*state=INSTALLED.*::NO
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=dave@strongswan.org.*child-sas.*net.*state=INSTALLED::NO
moon::cat /var/log/daemon.log::constraint check failed: group membership to 'sales' required::YES
carol::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Attribute Authority\"::YES
dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Attribute Authority\"::YES
testing/tests/ikev2/acert-inline/hosts/carol/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add
testing/tests/ikev2/acert-inline/hosts/carol/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
}
testing/tests/ikev2/acert-inline/hosts/carol/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = carol@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/acert-inline/hosts/dave/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn home
left=PH_IP_DAVE
leftcert=daveCert.pem
leftid=dave@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add
testing/tests/ikev2/acert-inline/hosts/dave/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
}
testing/tests/ikev2/acert-inline/hosts/dave/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = daveCert.pem
id = dave@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/acert-inline/hosts/moon/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any
rightgroups="finance, sales"
keyexchange=ikev2
auto=add
testing/tests/ikev2/acert-inline/hosts/moon/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation acert hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 acert revocation curve25519 gmp curl kernel-netlink socket-default updown vici
}
testing/tests/ikev2/acert-inline/hosts/moon/etc/swanctl/swanctl.conf
Executable
+26
View File
@@ -0,0 +1,26 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
groups = finance,sales
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/acert-inline/posttest.dat
Regular → Executable
+6 -10
View File
@@ -1,13 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
carol::systemctl stop strongswan
dave::systemctl stop strongswan
moon::systemctl stop strongswan
moon::cd /etc/swanctl; rm rsa/* x509aa/*
carol::rm /etc/swanctl/x509ac/*
dave::rm /etc/swanctl/x509ac/*
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
carol::rm /etc/ipsec.d/acerts/carol-sales.pem
dave::rm /etc/ipsec.d/acerts/dave-expired-aa.pem
dave::rm /etc/ipsec.d/acerts/dave-marketing.pem
moon::rm /etc/ipsec.d/private/aaKey-expired.pem
moon::rm /etc/ipsec.d/private/aaKey.pem
moon::rm /etc/ipsec.d/aacerts/aaCert-expired.pem
moon::rm /etc/ipsec.d/aacerts/aaCert.pem
testing/tests/ikev2/acert-inline/pretest.dat
Regular → Executable
+5 -5
View File
@@ -1,11 +1,11 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
moon::systemctl start strongswan
carol::systemctl start strongswan
dave::systemctl start strongswan
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home
dave::ipsec up home
dave::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/acert-inline/test.conf
Regular → Executable
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/ikev2/after-2038-certs/description.txt
+3 -3
View File
@@ -1,13 +1,13 @@
The roadwarrior <b>carol</b> sets up a connection to gateway <b>moon</b>.
The authentication is based on <b>X.509 certificates</b> that are valid until
the year 2039 and are issued by a certification authority with a root ca
the year 2039 and are issued by a certification authority with a root ca
certificate valid until the year 2059. On 32-bit platforms, dates after
Jan 19 03:14:07 UTC 2038 cannot by represented by the time_t data type.
Thus if a time wrap-around occurs during ASN.1 to time_t conversions,
dates contained in the certificates are set to the maximum value,
i.e. to Jan 19 03:14:07 UTC 2038.
Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
<p/>
Upon the successful establishment of the IPsec tunnel, the updown script
automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, <b>carol</b> ping the client <b>alice</b>
behind the gateway <b>moon</b>.
testing/tests/ikev2/after-2038-certs/evaltest.dat
+2 -5
View File
@@ -1,8 +1,5 @@
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
testing/tests/ikev2/after-2038-certs/hosts/carol/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add
testing/tests/ikev2/after-2038-certs/hosts/carol/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
}
testing/tests/ikev2/after-2038-certs/hosts/carol/etc/swanctl/swanctl.conf
Executable
+24
View File
@@ -0,0 +1,24 @@
connections {
home {
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = carol@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
esp_proposals = aes128gcm16-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/after-2038-certs/hosts/moon/etc/ipsec.conf
-19
View File
@@ -1,19 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any
keyexchange=ikev2
auto=add
testing/tests/ikev2/after-2038-certs/hosts/moon/etc/strongswan.conf
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
}
testing/tests/ikev2/after-2038-certs/hosts/moon/etc/swanctl/swanctl.conf
Executable
+23
View File
@@ -0,0 +1,23 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/10
esp_proposals = aes128gcm16-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/after-2038-certs/posttest.dat
+3 -4
View File
@@ -1,4 +1,3 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
carol::systemctl stop strongswan
moon::systemctl stop strongswan
moon::rm /etc/swanctl/x509ca/*
testing/tests/ikev2/after-2038-certs/pretest.dat
+3 -5
View File
@@ -1,7 +1,5 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
moon::systemctl start strongswan
carol::systemctl start strongswan
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/after-2038-certs/test.conf
+5 -1
View File
@@ -5,7 +5,7 @@
# All guest instances that are required for this test
#
VIRTHOSTS="alice moon carol winnetou"
VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/ikev2/alg-3des-md5/description.txt
-4
View File
@@ -1,4 +0,0 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the ESP cipher suite
<b>3DES_CBC / HMAC_MD5_96</b> by defining <b>esp=3des-md5-modp1024!</b>
in ipsec.conf. The same cipher suite is used for IKE.
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
testing/tests/ikev2/alg-3des-md5/evaltest.dat
-15
View File
@@ -1,15 +0,0 @@
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*3DES_CBC/HMAC_MD5_96,::YES
carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_MD5_96,::YES
moon:: ip xfrm state::enc cbc(des3_ede)::YES
carol::ip xfrm state::enc cbc(des3_ede)::YES
moon:: ip xfrm state::auth-trunc hmac(md5)::YES
carol::ip xfrm state::auth-trunc hmac(md5)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES
testing/tests/ikev2/alg-3des-md5/hosts/carol/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=3des-md5-modp1024!
esp=3des-md5-modp1024!
conn home
left=PH_IP_CAROL
leftfirewall=yes
leftcert=carolCert.pem
leftid=carol@strongswan.org
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add
testing/tests/ikev2/alg-3des-md5/hosts/carol/etc/strongswan.conf
-5
View File
@@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes des sha1 sha2 md5 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
}
testing/tests/ikev2/alg-3des-md5/hosts/moon/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=3des-md5-modp1024!
esp=3des-md5-modp1024!
conn rw
left=PH_IP_MOON
leftfirewall=yes
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
right=%any
auto=add
testing/tests/ikev2/alg-3des-md5/hosts/moon/etc/strongswan.conf
-5
View File
@@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce des sha1 sha2 md5 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
}
testing/tests/ikev2/alg-3des-md5/posttest.dat
-4
View File
@@ -1,4 +0,0 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/alg-3des-md5/pretest.dat
-7
View File
@@ -1,7 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
testing/tests/ikev2/alg-3des-md5/test.conf
-21
View File
@@ -1,21 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
testing/tests/ikev2/alg-aes-ccm/description.txt
-4
View File
@@ -1,4 +0,0 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the cipher suite
<b>AES_CCM_12_128</b> both for IKE and ESP by defining <b>ike=aes128ccm12-aesxcbc-curve25519</b>
(or alternatively <b>aes128ccm96</b>) and <b>esp=aes128ccm12-curve25519</b> in ipsec.conf, respectively.
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
testing/tests/ikev2/alg-aes-ccm/evaltest.dat
-13
View File
@@ -1,13 +0,0 @@
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_CCM_12_128::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: AES_CCM_12_128::YES
moon:: ipsec statusall 2> /dev/null::AES_CCM_12_128,::YES
carol::ipsec statusall 2> /dev/null::AES_CCM_12_128,::YES
moon:: ip xfrm state::aead rfc4309(ccm(aes))::YES
carol::ip xfrm state::aead rfc4309(ccm(aes))::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES
testing/tests/ikev2/alg-aes-ccm/hosts/carol/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128ccm96-aesxcbc-x25519!
esp=aes128ccm96-x25519!
conn home
left=PH_IP_CAROL
leftfirewall=yes
leftcert=carolCert.pem
leftid=carol@strongswan.org
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add
testing/tests/ikev2/alg-aes-ccm/hosts/carol/etc/strongswan.conf
-5
View File
@@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation xcbc ccm stroke kernel-netlink socket-default updown
}
testing/tests/ikev2/alg-aes-ccm/hosts/moon/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128ccm12-aesxcbc-x25519!
esp=aes128ccm12-x25519!
conn rw
left=PH_IP_MOON
leftfirewall=yes
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
right=%any
auto=add
testing/tests/ikev2/alg-aes-ccm/posttest.dat
-4
View File
@@ -1,4 +0,0 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/alg-aes-ccm/pretest.dat
-7
View File
@@ -1,7 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
testing/tests/ikev2/alg-aes-ccm/test.conf
-21
View File
@@ -1,21 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
testing/tests/ikev2/alg-aes-ctr/description.txt
-4
View File
@@ -1,4 +0,0 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the cipher suite
<b>AES_CTR_128</b> both for IKE and ESP by defining <b>ike=aes128ctr-aesxcbc-curve25519</b>
and <b>esp=aes128ctr-aesxcbc-curve25519</b> in ipsec.conf, respectively.
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
testing/tests/ikev2/alg-aes-ctr/evaltest.dat
-14
View File
@@ -1,14 +0,0 @@
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_CTR_128::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: AES_CTR_128::YES
moon:: ipsec statusall 2> /dev/null::AES_CTR_128/AES_XCBC_96,::YES
carol::ipsec statusall 2> /dev/null::AES_CTR_128/AES_XCBC_96,::YES
moon:: ip xfrm state::rfc3686(ctr(aes))::YES
carol::ip xfrm state::rfc3686(ctr(aes))::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES
testing/tests/ikev2/alg-aes-ctr/hosts/carol/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128ctr-aesxcbc-x25519!
esp=aes128ctr-aesxcbc-x25519!
conn home
left=PH_IP_CAROL
leftfirewall=yes
leftcert=carolCert.pem
leftid=carol@strongswan.org
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add
testing/tests/ikev2/alg-aes-ctr/hosts/carol/etc/strongswan.conf
-5
View File
@@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation xcbc ctr stroke kernel-netlink socket-default updown
}
testing/tests/ikev2/alg-aes-ctr/hosts/moon/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128ctr-aesxcbc-x25519!
esp=aes128ctr-aesxcbc-x25519!
conn rw
left=PH_IP_MOON
leftfirewall=yes
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
right=%any
auto=add
testing/tests/ikev2/alg-aes-ctr/posttest.dat
-4
View File
@@ -1,4 +0,0 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/alg-aes-ctr/pretest.dat
-7
View File
@@ -1,7 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
testing/tests/ikev2/alg-aes-ctr/test.conf
-21
View File
@@ -1,21 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
testing/tests/ikev2/alg-aes-gcm/description.txt
-5
View File
@@ -1,5 +0,0 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the cipher suite
<b>AES_GCM_16_256</b> both for IKE and ESP by defining <b>ike=aes256gcm16-aesxcbc-curve25519</b>
(or alternatively <b>aes256gcm128</b>) and <b>esp=aes256gcm16-curve25519</b> in ipsec.conf,
respectively.
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
testing/tests/ikev2/alg-aes-gcm/evaltest.dat
-13
View File
@@ -1,13 +0,0 @@
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_GCM_16_256::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: AES_GCM_16_256::YES
moon:: ipsec statusall 2> /dev/null::AES_GCM_16_256,::YES
carol::ipsec statusall 2> /dev/null::AES_GCM_16_256,::YES
moon:: ip xfrm state::aead rfc4106(gcm(aes))::YES
carol::ip xfrm state::aead rfc4106(gcm(aes))::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 184::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 184::YES
testing/tests/ikev2/alg-aes-gcm/hosts/carol/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes256gcm128-aesxcbc-x25519!
esp=aes256gcm128-x25519!
conn home
left=PH_IP_CAROL
leftfirewall=yes
leftcert=carolCert.pem
leftid=carol@strongswan.org
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add
testing/tests/ikev2/alg-aes-gcm/hosts/carol/etc/strongswan.conf
-5
View File
@@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation xcbc gcm stroke kernel-netlink socket-default updown
}
testing/tests/ikev2/alg-aes-gcm/hosts/moon/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes256gcm16-aesxcbc-x25519!
esp=aes256gcm16-x25519!
conn rw
left=PH_IP_MOON
leftfirewall=yes
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
right=%any
auto=add
testing/tests/ikev2/alg-aes-gcm/posttest.dat
-4
View File
@@ -1,4 +0,0 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/alg-aes-gcm/pretest.dat
-7
View File
@@ -1,7 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
testing/tests/ikev2/alg-aes-xcbc/description.txt
-4
View File
@@ -1,4 +0,0 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the ESP cipher suite
<b>AES_CBC_128 / AES_XCBC_96</b> by defining <b>esp=aes128-aesxcbc-curve25519!</b>
in ipsec.conf. The same cipher suite is used for IKE.
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
testing/tests/ikev2/alg-aes-xcbc/evaltest.dat
-14
View File
@@ -1,14 +0,0 @@
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/CURVE_25519::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/CURVE_25519::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES
moon:: ip xfrm state::auth-trunc xcbc(aes)::YES
carol::ip xfrm state::auth-trunc xcbc(aes)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
testing/tests/ikev2/alg-aes-xcbc/hosts/carol/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-aesxcbc-x25519!
esp=aes128-aesxcbc-x25519!
conn home
left=PH_IP_CAROL
leftfirewall=yes
leftcert=carolCert.pem
leftid=carol@strongswan.org
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add
testing/tests/ikev2/alg-aes-xcbc/hosts/carol/etc/strongswan.conf
-5
View File
@@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation xcbc stroke kernel-netlink socket-default updown
}
testing/tests/ikev2/alg-aes-xcbc/hosts/moon/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-aesxcbc-x25519!
esp=aes128-aesxcbc-x25519!
conn rw
left=PH_IP_MOON
leftfirewall=yes
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
right=%any
auto=add
testing/tests/ikev2/alg-aes-xcbc/hosts/moon/etc/strongswan.conf
-5
View File
@@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation xcbc stroke kernel-netlink socket-default updown
}
testing/tests/ikev2/alg-aes-xcbc/posttest.dat
-4
View File
@@ -1,4 +0,0 @@
moon::ipsec stop
carol::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/alg-aes-xcbc/pretest.dat
-7
View File
@@ -1,7 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
testing/tests/ikev2/alg-aes-xcbc/test.conf
-21
View File
@@ -1,21 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
testing/tests/ikev2/alg-blowfish/evaltest.dat
-17
View File
@@ -1,17 +0,0 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES
dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_256_128,::YES
dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA1_96,::YES
carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES
dave:: ip -s xfrm state::enc cbc(blowfish).*(128 bits)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 184::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 184::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP.*length 180::YES
testing/tests/ikev2/alg-blowfish/hosts/carol/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=blowfish256-sha512-modp2048!
esp=blowfish192-sha256!
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
auto=add
testing/tests/ikev2/alg-blowfish/hosts/carol/etc/strongswan.conf
-10
View File
@@ -1,10 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes blowfish md5 sha1 sha2 pem pkcs1 gmp curl x509 revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
cfg = 2
}
}
}
testing/tests/ikev2/alg-blowfish/hosts/dave/etc/ipsec.conf
-22
View File
@@ -1,22 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=blowfish128-sha256-modp1536!
esp=blowfish128-sha1!
conn home
left=PH_IP_DAVE
leftcert=daveCert.pem
leftid=dave@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
auto=add
testing/tests/ikev2/alg-blowfish/hosts/dave/etc/strongswan.conf
-5
View File
@@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce blowfish sha1 sha2 pem pkcs1 gmp curl x509 revocation hmac stroke kernel-netlink socket-default updown
}
testing/tests/ikev2/alg-blowfish/hosts/moon/etc/ipsec.conf
-19
View File
@@ -1,19 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=blowfish256-sha512-modp2048,blowfish128-sha256-modp1536!
esp=blowfish192-sha256,blowfish128-sha1!
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any
auto=add
testing/tests/ikev2/alg-blowfish/hosts/moon/etc/strongswan.conf
-10
View File
@@ -1,10 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce blowfish sha1 sha2 pem pkcs1 gmp curl x509 revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
cfg = 2
}
}
}
testing/tests/ikev2/alg-blowfish/posttest.dat
-6
View File
@@ -1,6 +0,0 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/alg-chacha20poly1305/description.txt
-5
View File
@@ -1,5 +0,0 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the cipher suite
<b>CHACHA20_POLY1305</b> both for IKE and ESP by defining
<b>ike=chacha20poly1305-prfsha256-ntru256</b> and
<b>esp=chacha20poly1305-ntru256</b> in ipsec.conf, respectively.
A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
Loaded 100 of 4054 files, more files were not shown because too many files have changed in this diff. Show more