mirror of
https://github.com/strongswan/strongswan.git
synced 2025-10-04 00:00:14 -04:00
testing: Add TKM scenarios with multiple key exchanges
This commit is contained in:
Tobias Brunner
parent
5a8f0767b8
commit
2b1885b892
@ -176,9 +176,9 @@ do
|
||||
done
|
||||
|
||||
# Put DER-encoded moon private key and Root CA certificate into tkm scenarios
|
||||
for t in host2host-initiator host2host-responder host2host-xfrmproxy \
|
||||
multi-level-ca net2net-initiator net2net-xfrmproxy xfrmproxy-expire \
|
||||
xfrmproxy-rekey
|
||||
for t in host2host-initiator host2host-initiator-multi-ke host2host-responder \
|
||||
host2host-responder-multi-ke host2host-xfrmproxy multi-level-ca \
|
||||
net2net-initiator net2net-xfrmproxy xfrmproxy-expire xfrmproxy-rekey
|
||||
do
|
||||
TEST="${TEST_DIR}/tkm/${t}"
|
||||
mkdir -p ${TEST}/hosts/moon/${TKM_DIR}
|
||||
@ -1919,9 +1919,9 @@ done
|
||||
# TKM CA ID mapping #
|
||||
################################################################################
|
||||
|
||||
for t in host2host-initiator host2host-responder host2host-xfrmproxy \
|
||||
multi-level-ca net2net-initiator net2net-xfrmproxy xfrmproxy-expire \
|
||||
xfrmproxy-rekey
|
||||
for t in host2host-initiator host2host-initiator-multi-ke host2host-responder \
|
||||
host2host-responder-multi-ke host2host-xfrmproxy multi-level-ca \
|
||||
net2net-initiator net2net-xfrmproxy xfrmproxy-expire xfrmproxy-rekey
|
||||
do
|
||||
for h in moon
|
||||
do
|
||||
|
||||
@ -0,0 +1,5 @@
|
||||
A connection between the hosts <b>moon</b> and <b>sun</b> is set up using
|
||||
multiple key exchanges. The host <b>moon</b> uses the Trusted Key Manager (TKM)
|
||||
and is the initiator of the transport connection. The authentication is based
|
||||
on X.509 certificates. Rekeyings are initiated by <b>moon</b> for both the IKE
|
||||
and the ESP SA to test rekeying with multiple key exchanges.
|
||||
24
testing/tests/tkm/host2host-initiator-multi-ke/evaltest.dat
Normal file
24
testing/tests/tkm/host2host-initiator-multi-ke/evaltest.dat
Normal file
@ -0,0 +1,24 @@
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
|
||||
sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
|
||||
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||
moon::swanctl --rekey --ike conn1
|
||||
moon::sleep 1
|
||||
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||
moon::swanctl --rekey --child conn1
|
||||
moon::sleep 1
|
||||
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::3
|
||||
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::3
|
||||
moon::cat /tmp/tkm.log::Updating ISA context with ID 1 (KE 1)::YES
|
||||
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
|
||||
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
|
||||
moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
|
||||
moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
|
||||
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
|
||||
moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
|
||||
moon::cat /tmp/tkm.log::Creating new child ISA context with ID 2 (Parent Isa 1, KE 1 #1 / 2, nonce 1, spi_loc.*::YES
|
||||
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 2, Sp 1, Ea 1, Ke_Id 1 #1 / 2, Nc_Loc_Id 1, Initiator TRUE, spi_loc.*::YES
|
||||
moon::swanctl --terminate --ike conn1 && sleep 1::no output expected::NO
|
||||
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES
|
||||
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
|
||||
moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
|
||||
@ -0,0 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-tkm {
|
||||
ke_mapping {
|
||||
15 = 1
|
||||
16 = 2
|
||||
}
|
||||
ca_mapping {
|
||||
strongswan_ca {
|
||||
id = 1
|
||||
fingerprint = CA_SPK_HEX
|
||||
}
|
||||
}
|
||||
start-scripts {
|
||||
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,26 @@
|
||||
# pre-generated and modified as tkm_cfgtool doesn't support multiple KEs yet
|
||||
|
||||
connections {
|
||||
conn1 {
|
||||
local_addrs=192.168.0.1
|
||||
remote_addrs=192.168.0.2
|
||||
proposals=aes256-sha512-modp3072-ke1_modp4096
|
||||
local {
|
||||
id=moon.strongswan.org
|
||||
certs=moonCert.pem
|
||||
}
|
||||
remote {
|
||||
id=sun.strongswan.org
|
||||
}
|
||||
children {
|
||||
conn1 {
|
||||
reqid=1
|
||||
life_time=60
|
||||
rekey_time=30
|
||||
mode=transport
|
||||
esp_proposals=aes256-sha512-modp3072-ke1_modp4096
|
||||
start_action=trap
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,21 @@
|
||||
<tkmconfig>
|
||||
<local_identity id="1">
|
||||
<identity>moon.strongswan.org</identity>
|
||||
<certificate>moonCert.pem</certificate>
|
||||
</local_identity>
|
||||
<policy id="1">
|
||||
<mode>transport</mode>
|
||||
<local>
|
||||
<identity_id>1</identity_id>
|
||||
<ip>192.168.0.1</ip>
|
||||
</local>
|
||||
<remote>
|
||||
<identity>sun.strongswan.org</identity>
|
||||
<ip>192.168.0.2</ip>
|
||||
</remote>
|
||||
<lifetime>
|
||||
<soft>30</soft>
|
||||
<hard>60</hard>
|
||||
</lifetime>
|
||||
</policy>
|
||||
</tkmconfig>
|
||||
@ -0,0 +1,22 @@
|
||||
connections {
|
||||
|
||||
host-host {
|
||||
proposals = aes256-sha512-modp3072-ke1_modp4096
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = sunCert.pem
|
||||
id = sun.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
host-host {
|
||||
mode = transport
|
||||
esp_proposals = aes256-sha512-modp3072-ke1_modp4096
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,4 @@
|
||||
moon::service charon-tkm stop
|
||||
moon::killall tkm_keymanager
|
||||
moon::rm -f /tmp/swanctl.conf /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
|
||||
sun::systemctl stop strongswan
|
||||
11
testing/tests/tkm/host2host-initiator-multi-ke/pretest.dat
Normal file
11
testing/tests/tkm/host2host-initiator-multi-ke/pretest.dat
Normal file
@ -0,0 +1,11 @@
|
||||
moon::rm /etc/swanctl/rsa/*
|
||||
# swanctl.conf is not generated as tkm_cfgtool doesn't support multiple KEs yet
|
||||
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /tmp/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
|
||||
moon::cat /etc/swanctl/swanctl.conf
|
||||
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
|
||||
moon::expect-file /tmp/tkm.rpc.ike
|
||||
moon::service charon-tkm start
|
||||
sun::systemctl start strongswan
|
||||
sun::expect-connection host-host
|
||||
moon::expect-connection conn1
|
||||
moon::swanctl --initiate --child conn1 2> /dev/null
|
||||
25
testing/tests/tkm/host2host-initiator-multi-ke/test.conf
Normal file
25
testing/tests/tkm/host2host-initiator-multi-ke/test.conf
Normal file
@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="moon winnetou sun"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="m-w-s.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="sun"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon sun"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
@ -0,0 +1,5 @@
|
||||
A connection between the hosts <b>moon</b> and <b>sun</b> is set up using
|
||||
multiple key exchanges. The host <b>moon</b> uses the Trusted Key Manager (TKM)
|
||||
and is the responder of the transport connection. The authentication is based
|
||||
on X.509 certificates. Rekeyings are initiated by <b>sun</b> for both the IKE
|
||||
and the ESP SA to test rekeying with multiple key exchanges.
|
||||
20
testing/tests/tkm/host2host-responder-multi-ke/evaltest.dat
Normal file
20
testing/tests/tkm/host2host-responder-multi-ke/evaltest.dat
Normal file
@ -0,0 +1,20 @@
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
|
||||
sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
|
||||
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||
sun::swanctl --rekey --ike host-host
|
||||
sun::sleep 1
|
||||
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||
sun::swanctl --rekey --child host-host
|
||||
sun::sleep 1
|
||||
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
||||
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::3
|
||||
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::3
|
||||
moon::cat /tmp/tkm.log::Updating ISA context with ID 1 (KE 1)::YES
|
||||
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
|
||||
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
|
||||
moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
|
||||
moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
|
||||
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
|
||||
moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
|
||||
moon::cat /tmp/tkm.log::Creating new child ISA context with ID 2 (Parent Isa 1, KE 1 #1 / 2, nonce 1, spi_loc.*::YES
|
||||
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 2, Sp 1, Ea 1, Ke_Id 1 #1 / 2, Nc_Loc_Id 1, Initiator FALSE, spi_loc.*::YES
|
||||
@ -0,0 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-tkm {
|
||||
ke_mapping {
|
||||
15 = 1
|
||||
16 = 2
|
||||
}
|
||||
ca_mapping {
|
||||
strongswan_ca {
|
||||
id = 1
|
||||
fingerprint = CA_SPK_HEX
|
||||
}
|
||||
}
|
||||
start-scripts {
|
||||
swanctl = /usr/local/sbin/swanctl --load-all --noprompt
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,26 @@
|
||||
# pre-generated and modified as tkm_cfgtool doesn't support multiple KEs yet
|
||||
|
||||
connections {
|
||||
conn1 {
|
||||
local_addrs=192.168.0.1
|
||||
remote_addrs=192.168.0.2
|
||||
proposals=aes256-sha512-modp3072-ke1_modp4096
|
||||
local {
|
||||
id=moon.strongswan.org
|
||||
certs=moonCert.pem
|
||||
}
|
||||
remote {
|
||||
id=sun.strongswan.org
|
||||
}
|
||||
children {
|
||||
conn1 {
|
||||
reqid=1
|
||||
life_time=60
|
||||
rekey_time=30
|
||||
mode=transport
|
||||
esp_proposals=aes256-sha512-modp3072-ke1_modp4096
|
||||
start_action=trap
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,21 @@
|
||||
<tkmconfig>
|
||||
<local_identity id="1">
|
||||
<identity>moon.strongswan.org</identity>
|
||||
<certificate>moonCert.pem</certificate>
|
||||
</local_identity>
|
||||
<policy id="1">
|
||||
<mode>transport</mode>
|
||||
<local>
|
||||
<identity_id>1</identity_id>
|
||||
<ip>192.168.0.1</ip>
|
||||
</local>
|
||||
<remote>
|
||||
<identity>sun.strongswan.org</identity>
|
||||
<ip>192.168.0.2</ip>
|
||||
</remote>
|
||||
<lifetime>
|
||||
<soft>30</soft>
|
||||
<hard>60</hard>
|
||||
</lifetime>
|
||||
</policy>
|
||||
</tkmconfig>
|
||||
@ -0,0 +1,25 @@
|
||||
connections {
|
||||
|
||||
host-host {
|
||||
local_addrs = PH_IP_SUN
|
||||
remote_addrs = PH_IP_MOON
|
||||
|
||||
proposals = aes256-sha512-modp3072-ke1_modp4096
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = sunCert.pem
|
||||
id = sun.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
host-host {
|
||||
mode = transport
|
||||
esp_proposals = aes256-sha512-modp3072-ke1_modp4096
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,5 @@
|
||||
moon::service charon-tkm stop
|
||||
moon::killall tkm_keymanager
|
||||
moon::cat /tmp/tkm.log
|
||||
moon::rm -f /tmp/swanctl.conf /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
|
||||
sun::systemctl stop strongswan
|
||||
11
testing/tests/tkm/host2host-responder-multi-ke/pretest.dat
Normal file
11
testing/tests/tkm/host2host-responder-multi-ke/pretest.dat
Normal file
@ -0,0 +1,11 @@
|
||||
moon::rm /etc/swanctl/rsa/*
|
||||
# swanctl.conf is not generated as tkm_cfgtool doesn't support multiple KEs yet
|
||||
moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /tmp/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
|
||||
moon::cat /etc/swanctl/swanctl.conf
|
||||
moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
|
||||
moon::expect-file /tmp/tkm.rpc.ike
|
||||
moon::service charon-tkm start
|
||||
sun::systemctl start strongswan
|
||||
sun::expect-connection host-host
|
||||
moon::expect-connection conn1
|
||||
sun::swanctl --initiate --child host-host 2> /dev/null
|
||||
25
testing/tests/tkm/host2host-responder-multi-ke/test.conf
Normal file
25
testing/tests/tkm/host2host-responder-multi-ke/test.conf
Normal file
@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="moon winnetou sun"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="m-w-s.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="sun"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon sun"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
Loading…
x
Reference in New Issue
Block a user