denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,871 Commits 1 Branch 0 Tags
aba5b76ce170deb486f7a1eb36282b3458545fba
Commit Graph
449 Commits
Author SHA1 Message Date
Andreas Steffen c2aca9eed2 Implemented improved BLISS-B signature algorithm 2015-02-25 21:45:34 +01:00
Martin Willi c10b2be967 testing: Add a forecast test case 2015-02-20 16:34:55 +01:00
Martin Willi 9ed09d5f77 testing: Add a connmark plugin test 
In this test two hosts establish a transport mode connection from behind
moon. sun uses the connmark plugin to distinguish the flows.

This is an example that shows how one can terminate L2TP/IPsec connections
from two hosts behind the same NAT. For simplification of the test, we use
an SSH connection instead, but this works for any connection initiated flow
that conntrack can track.
 2015-02-20 16:34:54 +01:00
Martin Willi f27fb58ae0 testing: Update description and test evaluation of host2host-transport-nat 
As we now reuse the reqid for identical SAs, the behavior changes for
transport connections to multiple peers behind the same NAT. Instead of
rejecting the SA, we now have two valid SAs active. For the reverse path,
however, sun sends traffic always over the newer SA, resembling the behavior
before we introduced explicit SA conflicts for different reqids.
 2015-02-20 13:34:58 +01:00
Martin Willi 050556bf59 testing: Be a little more flexible in testing for established CHILD_SA modes 
As we now print the reqid parameter in the CHILD_SA details, adapt the grep
to still match the CHILD_SA mode and protocol.
 2015-02-20 13:34:58 +01:00
Martin Willi b1ff437bbc testing: Add a test scenario for make-before-break reauth using a virtual IP 2015-02-20 13:34:58 +01:00
Martin Willi ae3fdf2603 testing: Add a test scenario for make-before-break reauth without a virtual IP 2015-02-20 13:34:57 +01:00
Andreas Steffen 5028644943 Updated RFC3779 certificates 2014-12-28 12:53:16 +01:00
Andreas Steffen ac0cb2d363 Updated BLISS CA certificate in ikev2/rw-ntru-bliss scenario 2014-12-12 13:55:03 +01:00
Andreas Steffen c44f481ae0 Updated BLISS scenario keys and certificates to new format 2014-12-12 12:00:20 +01:00
Andreas Steffen c02ebf1ecd Renewed expired certificates 2014-11-29 14:51:18 +01:00
Andreas Steffen 43d9247599 Created ikev2/rw-ntru-bliss scenario 2014-11-29 14:51:18 +01:00
Tobias Brunner 1836c1845b testing: Add ikev2/net2net-fragmentation scenario 2014-10-10 09:33:23 +02:00
Andreas Steffen 73af3a1b04 Updated revoked certificate in ikev2/ocsp-revoked scenario 2014-10-05 21:33:35 +02:00
Andreas Steffen 006518e859 The critical-extension scenarios need the old private keys 2014-10-05 20:58:03 +02:00
Tobias Brunner 722a8a177e testing: Make sure the whitelist plugin is ready before configuring it 2014-10-03 12:44:14 +02:00
Tobias Brunner 09f1fb82f9 testing: Update PKCS#12 containers 2014-10-03 12:44:13 +02:00
Tobias Brunner 079c797421 testing: Update PKCS#8 keys 2014-10-03 12:44:13 +02:00
Tobias Brunner 9f5fd7899e testing: Update public keys in DNSSEC scenarios 
The tests are successful even if the public keys are not stored locally,
but an additional DNS query is required to fetch them.
 2014-10-03 12:44:13 +02:00
Tobias Brunner 2c7ad260f9 testing: Update carols certificate in several test cases 2014-10-03 12:44:13 +02:00
Martin Willi 7ab320def3 testing: Add some notes about how to reissue attribute certificates 2014-10-03 12:31:01 +02:00
Martin Willi 16469e8474 testing: Reissue attribute certificates for the new holder certificates 
Due to the expired and reissued holder certificates of carol and dave, new
attribute certificates are required to match the holder certificates serial in
the ikev2/acert-{cached,fallback,inline} tests.
 2014-10-03 12:28:11 +02:00
Martin Willi 44b6a34d43 configure: Load fetcher plugins after crypto base plugins 
Some fetcher plugins (such as curl) might build upon OpenSSL to implement
HTTPS fetching. As we set (and can't unset) threading callbacks in our
openssl plugin, we must ensure that OpenSSL functions don't get called after
openssl plugin unloading.

We achieve that by loading curl and all other fetcher plugins after the base
crypto plugins, including openssl.
 2014-09-24 17:34:54 +02:00
Andreas Steffen 51da5b920b Generated new test certificates 2014-08-28 21:34:40 +02:00
Tobias Brunner 73211f9b74 testing: Add pfkey/shunt-policies-nat-rw scenario 2014-06-26 18:13:26 +02:00
Tobias Brunner 2ef6f57456 testing: Add ikev2/shunt-policies-nat-rw scenario 2014-06-19 14:23:07 +02:00
Tobias Brunner d93987ce24 testing: Remove ikev2/shunt-policies scenario 
This scenario doesn't really apply anymore (especially its use of drop
policies).
 2014-06-19 14:23:07 +02:00
Andreas Steffen edd2ed860f Renewed expired user certificate 2014-04-15 09:28:37 +02:00
Tobias Brunner 7a61bf9032 testing: Run 'conntrack -F' before all test scenarios 
This prevents failures due to remaining conntrack entries.
 2014-04-02 11:55:05 +02:00
Andreas Steffen 96e3142c39 Test TLS AEAD cipher suites 2014-04-01 10:12:15 +02:00
Andreas Steffen 05eb83e986 Slightly edited evaltest of ikev2/ocsp-untrusted-cert scenario 2014-03-31 22:22:58 +02:00
Martin Willi 91d71abb16 revocation: Restrict OCSP signing to specific certificates 
To avoid considering each cached OCSP response and evaluating its trustchain,
we limit the certificates considered for OCSP signing to:

- The issuing CA of the checked certificate
- A directly delegated signer by the same CA, having the OCSP signer constraint
- Any locally installed (trusted) certificate having the OCSP signer constraint

The first two options cover the requirements from RFC 6960 2.6. For
compatibility with non-conforming CAs, we allow the third option as exception,
but require the installation of such certificates locally.
 2014-03-31 14:40:33 +02:00
Martin Willi babd848778 testing: Add an acert test that forces a fallback connection based on groups 2014-03-31 11:14:59 +02:00
Martin Willi 1a4d3222be testing: Add an acert test case sending attribute certificates inline 2014-03-31 11:14:59 +02:00
Martin Willi 9f676321a9 testing: Add an acert test using locally cached attribute certificates 2014-03-31 11:14:59 +02:00
Andreas Steffen 7afd217ff9 Renewed self-signed OCSP signer certificate 2014-03-27 22:52:11 +01:00
Andreas Steffen c6d173a1f1 Check that valid OCSP responses are received in the ikev2/ocsp-multi-level scenario 2014-03-24 23:57:55 +01:00
Andreas Steffen bee64a82d7 Updated expired certificates issued by the Research and Sales Intermediate CAs 2014-03-24 23:38:45 +01:00
Andreas Steffen 2d79f6d81e Renewed revoked Research CA certificate 2014-03-22 15:16:15 +01:00
Andreas Steffen 22e1aa51f9 Completed integration of ntru_crypto library into ntru plugin 2014-03-22 09:51:00 +01:00
Andreas Steffen c683b389ba Merged libstrongswan options into charon section 2014-03-15 14:07:34 +01:00
Andreas Steffen a334ac80ae Added ikev2/lookip scenario 2014-02-17 12:04:21 +01:00
Tobias Brunner 96e8715e32 testing: Use installed SQL schema instead of local copy 2014-02-12 14:08:34 +01:00
Tobias Brunner 571025a609 testing: Add ikev2/host2host-transport-nat scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 6055e347f8 testing: Add ikev2/compress-nat scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 1fde30cc23 testing: Enable firewall for ikev2/compress scenario 
Additionally, send a regular (small) ping as the kernel does not
compress small packets and handles those differently inbound.
 2014-01-23 10:27:13 +01:00
Andreas Steffen 802eaf3789 Any of the four NTRU parameter sets can be selected 2013-11-27 20:21:41 +01:00
Andreas Steffen d5cd6eba2b Added ikev2/net2net-ntru-cert and ikev2/rw-ntru-psk scenarios 2013-11-27 20:21:40 +01:00
Tobias Brunner ca28e13fe8 testing: Add ikev2/net2net-dnscert scenario 2013-10-11 15:45:42 +02:00
Martin Willi 80a82b8d67 testing: Add an IKEv2 host2host AH transport mode test case 2013-10-11 10:15:22 +02:00