Tobias Brunner
44e83f76f3
testing: Use TLS 1.2 in RADIUS test cases
...
This took a while as in the OpenSSL package shipped with Debian and on which
our FIPS-enabled package is based, the function SSL_export_keying_material(),
which is used by FreeRADIUS to derive the MSK, did not use the correct digest
to calculate the result when TLS 1.2 was used. This caused IKE to fail with
"verification of AUTH payload with EAP MSK failed". The fix was only
backported to jessie recently.
2016-06-17 15:53:12 +02:00
Tobias Brunner
67b9e151fa
testing: Fix firewall rule on alice in tnc/tnccs-20-pdp-pt-tls scenario
2016-06-17 10:22:03 +02:00
Tobias Brunner
aacf84d837
testing: Add expect-connection calls for all tests and hosts
...
There are some exceptions (e.g. those that use auto=start or p2pnat).
2016-06-16 14:35:18 +02:00
Tobias Brunner
8f56bbc82b
testing: Update test scenarios for Debian jessie
...
The main difference is that ping now reports icmp_seq instead of
icmp_req, so we match for icmp_.eq, which works with both releases.
tcpdump now also reports port 4500 as ipsec-nat-t.
2016-06-16 14:04:11 +02:00
Tobias Brunner
b71104a3df
testing: Fix posttest.dat for ikev2/rw-dnssec scenario
2016-06-16 14:01:47 +02:00
Tobias Brunner
1c616eccae
testing: Update Apache config for newer Debian releases
...
It is still compatible with the current release as the config in
sites-available will be ignored, while conf-enabled does not exist and
is not included in the main config.
2016-06-15 16:24:44 +02:00
Tobias Brunner
796c36ade1
testing: Fix scenarios that check /etc/resolv.conf
2016-06-13 16:18:38 +02:00
Andreas Steffen
78adb5a7b1
testing: Changed gcrypt-ikev1 scenarios to swanctl
2016-05-15 19:02:57 +02:00
Andreas Steffen
141ac4df8f
testing: wait until connections are loaded
2016-05-15 19:02:57 +02:00
Andreas Steffen
b9522f9d64
swanctl: Do not display rekey times for shunts
2016-05-05 14:53:22 +02:00
Andreas Steffen
ff4e01dab5
testing: Use reauthentication and set CHILD_SA rekey time, bytes and packets limits
2016-05-04 18:13:52 +02:00
Andreas Steffen
87381a55a9
testing: uses xauth_id in swanctl/xauth-rsa scenario
2016-05-04 18:13:52 +02:00
Andreas Steffen
278497f2ba
testing: Use absolute path of imv_policy_manager
2016-04-26 17:15:37 +02:00
Andreas Steffen
0ff486f507
testing: Added swanctl/rw-multi-ciphers-ikev1 scenario
2016-04-12 18:50:58 +02:00
Andreas Steffen
d3edc8aa0f
testing: Added swanctl/manual_prio scenario
2016-04-09 16:51:02 +02:00
Tobias Brunner
638b4638e3
testing: Add swanctl/net2net-gw scenario
2016-04-09 16:51:00 +02:00
Tobias Brunner
ea3a4d3f72
testing: List conntrack table on sun in ikev2/host2host-transport-connmark scenario
2016-04-06 14:01:18 +02:00
Tobias Brunner
a9f9598ed0
testing: Updated updown scripts in libipsec scenarios to latest version
2016-03-23 14:13:07 +01:00
Andreas Steffen
90ef7e8af6
Updated swanctl/rw-psk-ikev1 scenario
2016-03-10 13:59:37 +01:00
Tobias Brunner
dc57c1b817
testing: Add ikev2/reauth-mbb-revoked scenario
2016-03-10 11:07:15 +01:00
Andreas Steffen
c2523355a4
testing: Added swanctl/mult-auth-rsa-eap-sim-id scenario
2016-03-06 19:09:03 +01:00
Andreas Steffen
70ff382e41
testing: Added swanctl/xauth-rsa scenario
2016-03-06 12:28:55 +01:00
Andreas Steffen
07b0eac4b1
testing: attr-sql is a charon plugin
2016-03-05 15:53:22 +01:00
Andreas Steffen
26d2011b14
testing: Added swanctl/rw-psk-ikev1 scenario
2016-03-05 13:50:41 +01:00
Andreas Steffen
1989c7a381
testing: Include IKE port information in evaltests
2016-03-05 13:44:06 +01:00
Tobias Brunner
f80e910cce
testing: Add ikev2/redirect-active scenario
2016-03-04 16:03:00 +01:00
Andreas Steffen
ba919f393d
testing: Added swanctl/protoport-range scenario
2016-03-04 09:52:34 +01:00
Tobias Brunner
28649f6d91
libhydra: Remove empty unused library
2016-03-03 17:36:11 +01:00
Andreas Steffen
efefa0c6a1
testing: Added swanctl/shunt-policies-nat-rw
2016-02-28 22:25:50 +01:00
Andreas Steffen
13891e2a4f
testing: Some minor fixes in test scenarios
2016-02-28 22:25:21 +01:00
Andreas Steffen
68c9f0bb80
testing: Added swanctl/protoport-dual scenario
2016-02-28 14:33:48 +01:00
Andreas Steffen
ddf1fc7692
testing: converted af-alg scenarios to swanctl
2016-02-26 13:31:36 +01:00
Tobias Brunner
4625113b1a
testing: Use absolute path to the _updown script in SQL scenarios
...
/usr/local/sbin is not included in PATH set by the charon init script and
since the ipsec script is obsolete when using swanctl it makes sense to
change this anyway.
2016-02-17 12:00:20 +01:00
Andreas Steffen
963b080810
testing: Increased ping interval in ikev2/trap-any scenario
2016-02-16 18:21:19 +01:00
Andreas Steffen
726a45b2f2
Corrected the description of the swanctl/dhcp-dynamic scenario
2016-02-16 18:17:17 +01:00
Andreas Steffen
4d83c5b4a6
Fix of the mutual TNC measurement use case
...
If the IKEv2 initiator acting as a TNC server receives invalid TNC measurements
from the IKEv2 responder acting as a TNC clienti, the exchange of PB-TNC batches
is continued until the IKEv2 responder acting as a TNC server has also finished
its TNC measurements.
In the past if these measurements in the other direction were correct
the IKEv2 responder acting as EAP server declared the IKEv2 EAP authentication
successful and the IPsec connection was established even though the TNC
measurement verification on the EAP peer side failed.
The fix adds an "allow" group membership on each endpoint if the corresponding
TNC measurements of the peer are successful. By requiring a "allow" group
membership in the IKEv2 connection definition the IPsec connection succeeds
only if the TNC measurements on both sides are valid.
2016-02-16 18:00:27 +01:00
Andreas Steffen
ac134b470a
testing: Added swanctl/dhcp-dynamic scenario
2016-02-03 12:10:59 +01:00
Thomas Egerer
beb4a07ea8
ikev1: Log successful authentication with signature scheme
...
Output is now identical to that of the IKEv2 pubkey authenticator.
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com >
2016-02-01 15:58:53 +01:00
Tobias Brunner
4cfcbe97a4
testing: Don't attempt to start the daemon twice in ha/active-passive scenario
2016-02-01 10:51:12 +01:00
Andreas Steffen
67a38ac6f1
testing: Added swanctl/config-payload scenario
2016-01-14 06:31:28 +01:00
Andreas Steffen
e7b5171e43
testing: Use include statement in swanctl/rw-pubkey-keyid scenario
2016-01-14 01:44:17 +01:00
Andreas Steffen
2aa2b17d41
testing: swanctl/rw-pubkey-anon uses anonymous public keys in remote access scenario
2016-01-09 07:23:30 +01:00
Andreas Steffen
b83cef2412
testing: added swanctl scenarios net2net-pubkey, rw-pubkey-keyid and rw-dnssec
2016-01-09 07:23:30 +01:00
Andreas Steffen
bffbf2f5fd
testing: Fixed description of swanctl/frags-iv4 scenario
2016-01-09 00:17:31 +01:00
Andreas Steffen
9db530493f
testing: Change sql scenarios to swanctl
2016-01-03 06:28:48 +01:00
Tobias Brunner
1a79525559
testing: Fix some IKEv1 scenarios after listing DH groups for CHILD_SAs
2015-12-21 12:14:12 +01:00
Andreas Steffen
490ba67682
testing: Fixed description in swanctl/rw-ntru-bliss scenario
2015-12-18 15:24:59 +01:00
Andreas Steffen
76cbf1df34
testing: Added swanctl/rw-ntru-bliss scenario
2015-12-17 17:49:48 +01:00
Andreas Steffen
5e2b740a00
128 bit default security strength requires 3072 bit prime DH group
2015-12-14 10:39:40 +01:00
Andreas Steffen
36b6d400d2
testing: swanctl/rw-cert scenario tests password-protected RSA key
2015-12-12 17:12:44 +01:00
Tobias Brunner