denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,803 Commits 1 Branch 0 Tags
44107cb7b75551e02afd56061534495c10b94de3
Commit Graph
1071 Commits
Author SHA1 Message Date
Andreas Steffen 25217488d2 testing: Created swanctl/rw-eap-aka-sql-rsa scenario 2017-04-26 20:38:23 +02:00
Andreas Steffen 64f9fa9e9f testing: Created ikev2/rw-eap-aka-sql-rsa scenario 
This test scenario tests the eap-simaka-sql plugin.
 2017-04-26 20:38:23 +02:00
Andreas Steffen c5ccf933ec testing: List BLIS certs in swanctl/rw-newhope-bliss scenario 2017-03-27 16:56:50 +02:00
Andreas Steffen 1732ca7b5b testing: Updated OCSP certificate for carol 2017-03-21 09:09:06 +01:00
Andreas Steffen efc1b98461 Allow x25519 as an alias of the curve25519 KE algorithm 2017-03-20 21:18:00 +01:00
Tobias Brunner 0c549169c4 testing: Fix ALLOWED_HOSTS in strongTNC settings.ini 2017-02-16 18:24:25 +01:00
Tobias Brunner 150a902b83 testing: Fix swanctl/ocsp-disabled scenario after changing the log messages 2017-02-16 17:51:16 +01:00
Andreas Steffen 91a4a4aa83 testing: Added swanctl/ocsp-disabled scenario 2017-01-02 14:34:39 +01:00
Andreas Steffen db0953d41f testing: Added swanctl/ocsp-signer-cert scenario 2017-01-02 14:34:18 +01:00
Andreas Steffen 08253bbba3 testing: Convert swanctl scenarios to curve-25519 2016-12-30 16:22:12 +01:00
Andreas Steffen 470e61ae77 testing: strongTNC does not come with django.db any more 2016-12-17 18:09:20 +01:00
Andreas Steffen 3c1e5ad6ce testing: Added ikev2/net2net-ed25519 scenario 2016-12-17 18:07:29 +01:00
Andreas Steffen 94ae1ac18e Added swanctl/net2net-ed2559 scenario and needed Ed25519 certificates 2016-12-14 11:15:48 +01:00
Andreas Steffen 99c03e9a11 testing: make curve25519 the default DH group 2016-11-14 16:20:51 +01:00
Andreas Steffen ba6c7a52c0 testing: Renewed expired certificates 2016-10-18 18:13:58 +02:00
Andreas Steffen 85b5a6ace2 Save both base and delta CRLs to disk 2016-10-11 17:18:22 +02:00
Andreas Steffen 2a2669ee3e vici: strongswan.conf cache_crls = yes saves fetched CRLs to disk 2016-10-11 17:18:22 +02:00
Tobias Brunner 597e057b9e testing: Remove ikev2/default-keys scenario 
No default keys are generated anymore.
 2016-10-05 12:25:29 +02:00
Tobias Brunner 62636da4f3 testing: Enable outbound FWD policies in swanctl/manual-prio scenario 2016-09-28 17:56:43 +02:00
Andreas Steffen a9562a3f58 testing: Added swanctl/net2net-multicast scenario 2016-09-27 18:36:28 +02:00
Andreas Steffen d7e0ce2878 testing: Added ikev2/net2net-multicast scenario 2016-09-27 18:36:28 +02:00
Andreas Steffen d505658038 testing: Added swanctl/net2net-sha3-rsa-cert and swanctl/rw-eap-tls-sha3-rsa scenarios 2016-09-22 17:34:31 +02:00
Andreas Steffen 40f2589abf gmp: Support of SHA-3 RSA signatures 2016-09-22 17:34:31 +02:00
Andreas Steffen 188b190a70 mgf1: Refactored MGF1 as an XOF 2016-09-21 06:40:52 +02:00
Tobias Brunner b69cbacdfb testing: Use curl instead of soup plugin in libipsec/rw-suite-b scenario 
The soup plugin is already used in the openssl-ikev2/rw-suite-b*
scenarios.
 2016-09-20 15:36:15 +02:00
Andreas Steffen ce20979ce2 testing: Virtual IPs went missing 2016-08-16 17:18:17 +02:00
Andreas Steffen c1a1f9f548 testing: Added swanctl/rw-newhope-bliss scenario 2016-08-10 15:14:26 +02:00
Andreas Steffen 1e0dc2c329 testing: Add chapoly, ntru and newhope plugins to crypto and integrity tests 2016-08-10 14:34:27 +02:00
Andreas Steffen 277ef8c2fa testing: Added ikev2/rw-newhope-bliss scenario 2016-08-10 14:22:00 +02:00
Tobias Brunner c3e5109c37 testing: Add ikev1/net2net-esn scenario 2016-06-29 11:16:48 +02:00
Tobias Brunner 5a09734c2c testing: Start charon before Apache in tnc/tnccs-20-pdp-pt-tls 
The change in c423d0e8a1 ("testing: Fix race in tnc/tnccs-20-pdp-pt-tls
scenario") is not really ideal as now the vici plugin might not yet be
ready when `swanctl --load-creds` is called.  Perhaps starting charon
before Apache causes enough delay.

Once we switch to charon-systemd this isn't a problem anymore as starting the
unit will block until everything is up and ready.  Also, the individual
swanctl calls will be redundant as the default service unit calls --load-all.
But start scripts do run before charon-systemd signals that the daemon is
ready, so using these would work too then.
 2016-06-21 17:24:43 +02:00
Tobias Brunner c423d0e8a1 testing: Fix race in tnc/tnccs-20-pdp-pt-tls scenario 
aacf84d837 ("testing: Add expect-connection calls for all tests and
hosts") removed the expect-connection call for the non-existing aaa
connection.  However, because the credentials were loaded asynchronously
via start-script the clients might have been connecting when the secrets
were not yet loaded.  As `swanctl --load-creds` is a synchronous call
this change avoids that issue without having to add a sleep or failing
expect-connection call.
 2016-06-17 18:43:36 +02:00
Tobias Brunner 44e83f76f3 testing: Use TLS 1.2 in RADIUS test cases 
This took a while as in the OpenSSL package shipped with Debian and on which
our FIPS-enabled package is based, the function SSL_export_keying_material(),
which is used by FreeRADIUS to derive the MSK, did not use the correct digest
to calculate the result when TLS 1.2 was used.  This caused IKE to fail with
"verification of AUTH payload with EAP MSK failed".  The fix was only
backported to jessie recently.
 2016-06-17 15:53:12 +02:00
Tobias Brunner 67b9e151fa testing: Fix firewall rule on alice in tnc/tnccs-20-pdp-pt-tls scenario 2016-06-17 10:22:03 +02:00
Tobias Brunner aacf84d837 testing: Add expect-connection calls for all tests and hosts 
There are some exceptions (e.g. those that use auto=start or p2pnat).
 2016-06-16 14:35:18 +02:00
Tobias Brunner 8f56bbc82b testing: Update test scenarios for Debian jessie 
The main difference is that ping now reports icmp_seq instead of
icmp_req, so we match for icmp_.eq, which works with both releases.

tcpdump now also reports port 4500 as ipsec-nat-t.
 2016-06-16 14:04:11 +02:00
Tobias Brunner b71104a3df testing: Fix posttest.dat for ikev2/rw-dnssec scenario 2016-06-16 14:01:47 +02:00
Tobias Brunner 1c616eccae testing: Update Apache config for newer Debian releases 
It is still compatible with the current release as the config in
sites-available will be ignored, while conf-enabled does not exist and
is not included in the main config.
 2016-06-15 16:24:44 +02:00
Tobias Brunner 796c36ade1 testing: Fix scenarios that check /etc/resolv.conf 2016-06-13 16:18:38 +02:00
Andreas Steffen 78adb5a7b1 testing: Changed gcrypt-ikev1 scenarios to swanctl 2016-05-15 19:02:57 +02:00
Andreas Steffen 141ac4df8f testing: wait until connections are loaded 2016-05-15 19:02:57 +02:00
Andreas Steffen b9522f9d64 swanctl: Do not display rekey times for shunts 2016-05-05 14:53:22 +02:00
Andreas Steffen ff4e01dab5 testing: Use reauthentication and set CHILD_SA rekey time, bytes and packets limits 2016-05-04 18:13:52 +02:00
Andreas Steffen 87381a55a9 testing: uses xauth_id in swanctl/xauth-rsa scenario 2016-05-04 18:13:52 +02:00
Andreas Steffen 278497f2ba testing: Use absolute path of imv_policy_manager 2016-04-26 17:15:37 +02:00
Andreas Steffen 0ff486f507 testing: Added swanctl/rw-multi-ciphers-ikev1 scenario 2016-04-12 18:50:58 +02:00
Andreas Steffen d3edc8aa0f testing: Added swanctl/manual_prio scenario 2016-04-09 16:51:02 +02:00
Tobias Brunner 638b4638e3 testing: Add swanctl/net2net-gw scenario 2016-04-09 16:51:00 +02:00
Tobias Brunner ea3a4d3f72 testing: List conntrack table on sun in ikev2/host2host-transport-connmark scenario 2016-04-06 14:01:18 +02:00
Tobias Brunner a9f9598ed0 testing: Updated updown scripts in libipsec scenarios to latest version 2016-03-23 14:13:07 +01:00