denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,077 Commits 1 Branch 0 Tags
39e1ddec2ed3480e0edc07bbabfacbf907dc4e3f
Commit Graph
457 Commits
Author SHA1 Message Date
Tobias Brunner 3d964213f5 testing: Remove obsolete leftnexthop option from configs 2015-03-12 15:51:25 +01:00
Tobias Brunner 8b2af616ac testing: Update modified updown scripts to the latest template 
This avoids confusion and makes identifying the changes needed for each
scenario easier.
 2015-03-06 16:51:50 +01:00
Andreas Steffen 3fcb59b62a use SHA512 for moon's BLISS signature 2015-03-04 14:08:37 +01:00
Tobias Brunner 26ebe5fea8 testing: Test classic public key authentication in ikev2/net2net-cert scenario 2015-03-04 13:54:12 +01:00
Tobias Brunner 7a9c0d51f4 testing: Don't check for exact IKEv2 fragment size 
Because SHA-256 is now used for signatures the size of the two IKE_AUTH
messages changed.
 2015-03-04 13:54:10 +01:00
Tobias Brunner 4aa24d4c13 testing: Update test conditions because signature schemes are now logged 
RFC 7427 signature authentication is now used between strongSwan hosts
by default, which causes the actual signature schemes to get logged.
 2015-03-04 13:54:10 +01:00
Tobias Brunner 2f1b2d9183 testing: Add ikev2/rw-sig-auth scenario 2015-03-04 13:54:10 +01:00
Tobias Brunner 3b31245a0f testing: Add ikev2/net2net-cert-sha2 scenario 2015-03-04 13:54:10 +01:00
Andreas Steffen c2aca9eed2 Implemented improved BLISS-B signature algorithm 2015-02-25 21:45:34 +01:00
Martin Willi c10b2be967 testing: Add a forecast test case 2015-02-20 16:34:55 +01:00
Martin Willi 9ed09d5f77 testing: Add a connmark plugin test 
In this test two hosts establish a transport mode connection from behind
moon. sun uses the connmark plugin to distinguish the flows.

This is an example that shows how one can terminate L2TP/IPsec connections
from two hosts behind the same NAT. For simplification of the test, we use
an SSH connection instead, but this works for any connection initiated flow
that conntrack can track.
 2015-02-20 16:34:54 +01:00
Martin Willi f27fb58ae0 testing: Update description and test evaluation of host2host-transport-nat 
As we now reuse the reqid for identical SAs, the behavior changes for
transport connections to multiple peers behind the same NAT. Instead of
rejecting the SA, we now have two valid SAs active. For the reverse path,
however, sun sends traffic always over the newer SA, resembling the behavior
before we introduced explicit SA conflicts for different reqids.
 2015-02-20 13:34:58 +01:00
Martin Willi 050556bf59 testing: Be a little more flexible in testing for established CHILD_SA modes 
As we now print the reqid parameter in the CHILD_SA details, adapt the grep
to still match the CHILD_SA mode and protocol.
 2015-02-20 13:34:58 +01:00
Martin Willi b1ff437bbc testing: Add a test scenario for make-before-break reauth using a virtual IP 2015-02-20 13:34:58 +01:00
Martin Willi ae3fdf2603 testing: Add a test scenario for make-before-break reauth without a virtual IP 2015-02-20 13:34:57 +01:00
Andreas Steffen 5028644943 Updated RFC3779 certificates 2014-12-28 12:53:16 +01:00
Andreas Steffen ac0cb2d363 Updated BLISS CA certificate in ikev2/rw-ntru-bliss scenario 2014-12-12 13:55:03 +01:00
Andreas Steffen c44f481ae0 Updated BLISS scenario keys and certificates to new format 2014-12-12 12:00:20 +01:00
Andreas Steffen c02ebf1ecd Renewed expired certificates 2014-11-29 14:51:18 +01:00
Andreas Steffen 43d9247599 Created ikev2/rw-ntru-bliss scenario 2014-11-29 14:51:18 +01:00
Tobias Brunner 1836c1845b testing: Add ikev2/net2net-fragmentation scenario 2014-10-10 09:33:23 +02:00
Andreas Steffen 73af3a1b04 Updated revoked certificate in ikev2/ocsp-revoked scenario 2014-10-05 21:33:35 +02:00
Andreas Steffen 006518e859 The critical-extension scenarios need the old private keys 2014-10-05 20:58:03 +02:00
Tobias Brunner 722a8a177e testing: Make sure the whitelist plugin is ready before configuring it 2014-10-03 12:44:14 +02:00
Tobias Brunner 09f1fb82f9 testing: Update PKCS#12 containers 2014-10-03 12:44:13 +02:00
Tobias Brunner 079c797421 testing: Update PKCS#8 keys 2014-10-03 12:44:13 +02:00
Tobias Brunner 9f5fd7899e testing: Update public keys in DNSSEC scenarios 
The tests are successful even if the public keys are not stored locally,
but an additional DNS query is required to fetch them.
 2014-10-03 12:44:13 +02:00
Tobias Brunner 2c7ad260f9 testing: Update carols certificate in several test cases 2014-10-03 12:44:13 +02:00
Martin Willi 7ab320def3 testing: Add some notes about how to reissue attribute certificates 2014-10-03 12:31:01 +02:00
Martin Willi 16469e8474 testing: Reissue attribute certificates for the new holder certificates 
Due to the expired and reissued holder certificates of carol and dave, new
attribute certificates are required to match the holder certificates serial in
the ikev2/acert-{cached,fallback,inline} tests.
 2014-10-03 12:28:11 +02:00
Martin Willi 44b6a34d43 configure: Load fetcher plugins after crypto base plugins 
Some fetcher plugins (such as curl) might build upon OpenSSL to implement
HTTPS fetching. As we set (and can't unset) threading callbacks in our
openssl plugin, we must ensure that OpenSSL functions don't get called after
openssl plugin unloading.

We achieve that by loading curl and all other fetcher plugins after the base
crypto plugins, including openssl.
 2014-09-24 17:34:54 +02:00
Andreas Steffen 51da5b920b Generated new test certificates 2014-08-28 21:34:40 +02:00
Tobias Brunner 73211f9b74 testing: Add pfkey/shunt-policies-nat-rw scenario 2014-06-26 18:13:26 +02:00
Tobias Brunner 2ef6f57456 testing: Add ikev2/shunt-policies-nat-rw scenario 2014-06-19 14:23:07 +02:00
Tobias Brunner d93987ce24 testing: Remove ikev2/shunt-policies scenario 
This scenario doesn't really apply anymore (especially its use of drop
policies).
 2014-06-19 14:23:07 +02:00
Andreas Steffen edd2ed860f Renewed expired user certificate 2014-04-15 09:28:37 +02:00
Tobias Brunner 7a61bf9032 testing: Run 'conntrack -F' before all test scenarios 
This prevents failures due to remaining conntrack entries.
 2014-04-02 11:55:05 +02:00
Andreas Steffen 96e3142c39 Test TLS AEAD cipher suites 2014-04-01 10:12:15 +02:00
Andreas Steffen 05eb83e986 Slightly edited evaltest of ikev2/ocsp-untrusted-cert scenario 2014-03-31 22:22:58 +02:00
Martin Willi 91d71abb16 revocation: Restrict OCSP signing to specific certificates 
To avoid considering each cached OCSP response and evaluating its trustchain,
we limit the certificates considered for OCSP signing to:

- The issuing CA of the checked certificate
- A directly delegated signer by the same CA, having the OCSP signer constraint
- Any locally installed (trusted) certificate having the OCSP signer constraint

The first two options cover the requirements from RFC 6960 2.6. For
compatibility with non-conforming CAs, we allow the third option as exception,
but require the installation of such certificates locally.
 2014-03-31 14:40:33 +02:00
Martin Willi babd848778 testing: Add an acert test that forces a fallback connection based on groups 2014-03-31 11:14:59 +02:00
Martin Willi 1a4d3222be testing: Add an acert test case sending attribute certificates inline 2014-03-31 11:14:59 +02:00
Martin Willi 9f676321a9 testing: Add an acert test using locally cached attribute certificates 2014-03-31 11:14:59 +02:00
Andreas Steffen 7afd217ff9 Renewed self-signed OCSP signer certificate 2014-03-27 22:52:11 +01:00
Andreas Steffen c6d173a1f1 Check that valid OCSP responses are received in the ikev2/ocsp-multi-level scenario 2014-03-24 23:57:55 +01:00
Andreas Steffen bee64a82d7 Updated expired certificates issued by the Research and Sales Intermediate CAs 2014-03-24 23:38:45 +01:00
Andreas Steffen 2d79f6d81e Renewed revoked Research CA certificate 2014-03-22 15:16:15 +01:00
Andreas Steffen 22e1aa51f9 Completed integration of ntru_crypto library into ntru plugin 2014-03-22 09:51:00 +01:00
Andreas Steffen c683b389ba Merged libstrongswan options into charon section 2014-03-15 14:07:34 +01:00
Andreas Steffen a334ac80ae Added ikev2/lookip scenario 2014-02-17 12:04:21 +01:00