denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,655 Commits 1 Branch 0 Tags
e36b1e2edb439056503580fbb2685d082a6bb6dc
Commit Graph
1420 Commits
Author SHA1 Message Date
Andreas Steffen 1c1f713431 testing: Error messages of curl plugin have changed 2015-11-13 14:02:45 +01:00
Andreas Steffen c4b9b7ef2c testing: Fixed another timing issue 2015-11-13 14:02:06 +01:00
Andreas Steffen 019c7c2310 testing: Check for leases in swanctl/ip-pool scenario 2015-11-11 08:43:43 +01:00
Andreas Steffen 946bc3a3f5 testing: Fixed some more timing issues 2015-11-10 16:54:38 +01:00
Tobias Brunner 10051b01e9 testing: Reduce runtime of all tests that use SQLite databases by storing them in ramfs 2015-11-09 15:18:39 +01:00
Tobias Brunner 3102da20a7 testing: tnc/tnccs-20-hcd-eap scenario does not use SWID IMV/strongTNC 2015-11-09 15:18:38 +01:00
Tobias Brunner e873cb5a28 testing: Add test config to create and remove a directory for DBs stored in ramfs 2015-11-09 15:18:38 +01:00
Tobias Brunner 10fa70ee5c testing: Improve runtime of TNC tests by storing the SQLite DB in ramfs 
This saves about 50%-70% of the time needed for scenarios that use a DB.
 2015-11-09 15:18:38 +01:00
Tobias Brunner f24ec20ebb testing: Fix test constraints in ikev2/rw-ntru-bliss scenario 
Changed with a88d958933 ("Explicitly mention SHA2 algorithm in BLISS
OIDs and signature schemes").
 2015-11-09 15:18:38 +01:00
Andreas Steffen 529357f09a testing: Use sha3 plugin in ikev2/rw-cert scenario 2015-11-09 15:18:38 +01:00
Tobias Brunner bcad0f761f testing: Report the actual strongSwan and kernel versions 2015-11-09 15:18:37 +01:00
Tobias Brunner 5a919312b3 testing: Record strongSwan version when building from tarball 2015-11-09 15:18:37 +01:00
Tobias Brunner aee35392d1 testing: Record strongSwan version when building from source tree 2015-11-09 15:18:37 +01:00
Tobias Brunner d4908c06c1 testing: Report time required for all scenarios on test overview page 2015-11-09 15:18:37 +01:00
Tobias Brunner f7234e5e9f testing: Remove old SWID tags when building from repository 
This fixes the TNC-PDP scenarios.
 2015-11-09 15:18:36 +01:00
Tobias Brunner e22a663129 testing: Don't log anything to the console if auth.log or daemon.log do not exist 2015-11-09 15:18:36 +01:00
Tobias Brunner 12f08e07e1 testing: Simplify fetching of swanctl --list-* output 2015-11-09 15:18:36 +01:00
Tobias Brunner bde9fb6fa1 testing: Don't run redundant crypto tests in sql/rw-cert scenario 
They run in all other rw-cert scenarios but in the SQL version there is
no change in the loaded crypto plugins.
 2015-11-09 15:18:36 +01:00
Tobias Brunner 1091b3a636 testing: Fix CRL URIs in ipv6/net2net-ip4-in-ip6-ikev* scenarios 2015-11-09 15:18:36 +01:00
Tobias Brunner bb66b4d56b testing: Speed up OCSP scenarios 
Don't make clients wait for the TCP connections to timeout by dropping
packets.  By rejecting them the OCSP requests fail immediately.
 2015-11-09 15:18:35 +01:00
Tobias Brunner 0ee4a333a8 testing: Speed up ifdown calls in ikev2/mobike scenarios 
ifdown calls bind's rndc, which tries to access TCP port 953 on lo.
If these packets are dropped by the firewall we have to wait for the TCP
connections to time out, which takes quite a while.
 2015-11-09 15:18:35 +01:00
Tobias Brunner cbaafa03c7 testing: Avoid delays with ping by using -W and -i options 
With -W we reduce timeouts when we don't expect a response.  With -i the
interval between pings is reduced (mostly in case of auto=route where
the first ping yields no reply).
 2015-11-09 15:18:35 +01:00
Tobias Brunner f519acd42f testing: Remove nearly all sleep calls from pretest and posttest scripts 
By consistently using the `expect-connection` helper we can avoid pretty
much all previously needed calls to sleep.
 2015-11-09 15:18:35 +01:00
Tobias Brunner f36b6d49af testing: Adapt tests to retransmission settings and reduce DPD delay/timeout 2015-11-09 15:18:34 +01:00
Tobias Brunner 8713e32435 testing: Only send two retransmits after 1 second each to fail negative tests earlier 2015-11-09 15:18:34 +01:00
Tobias Brunner 9a0871ab94 testing: Add a base strongswan.conf file used by all hosts in all scenarios 
We will use this to set some defaults (e.g. timeouts to make testing
negative tests quicker).  We don't want these settings to show up in the
configs of the actual scenarios though.
 2015-11-09 15:18:34 +01:00
Tobias Brunner 17816515d2 testing: Add libipsec/net2net-null scenario 2015-11-09 11:09:48 +01:00
Andreas Steffen a98360a64c testing: BLISS CA uses SHA-3 in its CRL 2015-11-03 21:35:09 +01:00
Tobias Brunner 92ef3c2f21 testing: Update tkm to version 0.1.3 
Adds XFRM state/policy flush when terminating which caused tests to fail
due to the check added with 9086f060d3 ("testing: Let test scenarios
fail if IPsec SAs or policies are not removed").
 2015-10-30 11:19:44 +01:00
Tobias Brunner c6aa606a65 testing: Actually send an uncompressed packet in the ipv6/rw-compress-ikev2 scenario 
The default of 56 bytes already exceeds the threshold of 90 bytes (8 bytes
ICMP + 40 bytes IPv6 = 104 bytes).  By reducing the size we make sure the
packet is not compressed (40 + 8 + 40 = 88).

This also fixes a strange failure of this scenario due to the recently
added post-test `ip xfrm state` check.  The kernel stores a reference to
the used SAs on the inbound skbuffs and since these are garbage collected
it could take a while until all references to an SA disappear and the SA
is finally destroyed.  But while SAs might not get destroyed immediately
when we delete them, they are actually marked as dead and therefore won't
show up in `ip xfrm state`.  However, that's not the case for the tunnel
SAs the kernel attaches to IPComp SAs, which we don't explicitly delete,
and which aren't modified by the kernel until the IPComp SA is destroyed.
So what happened when the last ping unintentionally got compressed is that
the skbuff had a reference to the IPComp SA and therefore the tunnel SA.
This skbuff often was destroyed after the `ip xfrm state` check ran and
because the tunnel SA would still get reported the test case failed.
 2015-10-06 15:48:55 +02:00
Andreas Steffen 2b5c543051 testing: added ikev2/alg-chacha20poly1305 scenario 2015-09-01 17:30:15 +02:00
Andreas Steffen 57eb3b2b25 testing: update to Linux 4.2 kernel 2015-09-01 17:29:30 +02:00
Tobias Brunner e9ea7e6fb7 testing: Updated environment variable documentation in updown scripts 2015-08-31 11:00:05 +02:00
Andreas Steffen cdb61c3e88 Added some spaces in swanctl.conf 2015-08-25 15:10:13 +02:00
Tobias Brunner 9086f060d3 testing: Let test scenarios fail if IPsec SAs or policies are not removed 
The IKE daemon should delete all installed SAs and policies when
everything works properly, so we fail the test if that's not the case.
 2015-08-21 18:27:06 +02:00
Tobias Brunner c91682d1b8 testing: Flush state and policies before every scenario 
Similar to conntrack we make sure we are working on a clean slate.
 2015-08-21 18:27:06 +02:00
Tobias Brunner 8923621280 testing: Fix typo in p2pnat/behind-same-nat scenario 2015-08-21 17:48:37 +02:00
Tobias Brunner efb4b9440a testing: Add missing sim_files file to ikev2/rw-eap-sim-radius scenario 2015-08-21 11:37:23 +02:00
Tobias Brunner 161d75f403 testing: alice is RADIUS server in the ikev2/rw-eap-sim-radius scenario 2015-08-21 11:17:25 +02:00
Tobias Brunner 18943c1f1b testing: Print triplets.dat files of clients in EAP-SIM scenarios 
References #1078.
 2015-08-21 11:16:56 +02:00
Tobias Brunner bb1d9e454d testing: Add ikev2/trap-any scenario 2015-08-19 11:34:25 +02:00
Andreas Steffen 5f60c55919 Extend HCD attribute data for tnc/tnccs-20-hcd-eap scenario 2015-08-18 21:25:39 +02:00
Andreas Steffen b19ef52d51 Added reason string support to HCD IMV 2015-08-18 21:25:39 +02:00
Andreas Steffen 627e4b9659 Fixed patches format delimited by CR/LF 2015-08-18 21:25:39 +02:00
Andreas Steffen ac28daac38 testing: Added tnc/tnccs-20-hcd-eap scenario 2015-08-18 21:25:39 +02:00
Andreas Steffen ebed384887 testing: enable HCD IMC and IMV 2015-08-18 21:25:38 +02:00
Andreas Steffen 626b2e85f0 testing: Update AAA certificate on Freeradius as well 2015-08-05 10:01:21 +02:00
Andreas Steffen 9b1eaf083f testing: Updated expired AAA server certificate 2015-08-04 21:50:01 +02:00
Tobias Brunner 008a9ad12c testing: Don't run do-tests when hosts are not running 
running_any is satisfied if at least one host is running.  We could
easily add a running_all() helper to check if all hosts are running if
it turns out that's not strong enough.
 2015-08-03 13:34:05 +02:00
Tobias Brunner 50dd7de226 testing: Suppress errors when checking for running hosts 
If libvirt is not running virsh can't connect to it and will complain that
the socket does not exist.
 2015-08-03 12:54:09 +02:00