sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-07 00:01:49 -04:00
Code Issues Projects Releases Wiki Activity

testing: Migrated openssl/rw-cert scenario to swanctl

Browse Source
This commit is contained in:
Andreas Steffen 2018-11-09 21:45:12 +01:00
parent 6617341390
commit 97493cbe17
14 changed files with 106 additions and 88 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
testing/tests/openssl-ikev2/rw-cert/description.txt
View File

@ -1,11 +1,12 @@
The roadwarrior <b>carol</b> and the gateway <b>moon</b> use the <b>openssl</b> The roadwarrior <b>carol</b> and the gateway <b>moon</b> use the <b>openssl</b>
plugin based on the <b>OpenSSL</b> library for all cryptographical and X.509 certificate plugin based on the <b>OpenSSL</b> library for all cryptographical and X.509 certificate
functions whereas roadwarrior <b>dave</b> uses the default <b>strongSwan</b> cryptographical functions whereas roadwarrior <b>dave</b> uses the default <b>strongSwan</b> cryptographical
plugins <b>aes des sha1 sha2 md5 gmp</b> and <b>x509</b>. plugins <b>aes des sha1 sha2 hmac gmp</b> and <b>x509</b>.
<p> <p/>
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>. to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b> <p/>
Upon the successful establishment of the IPsec tunnels, the updown script
automatically inserts iptables-based firewall rules that let pass the tunneled traffic. automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
the client <b>alice</b> behind the gateway <b>moon</b>. the client <b>alice</b> behind the gateway <b>moon</b>.

13
testing/tests/openssl-ikev2/rw-cert/evaltest.dat
View File

@ -1,15 +1,10 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_2048.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=3DES_CBC.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=dave@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_2048.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=3DES_CBC.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES

21
testing/tests/openssl-ikev2/rw-cert/hosts/carol/etc/ipsec.conf
View File

@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=3des-sha1-modp1536!
conn home
left=PH_IP_CAROL
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
auto=add

2
testing/tests/openssl-ikev2/rw-cert/hosts/carol/etc/strongswan.conf
View File

@ -1,7 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = test-vectors pem pkcs1 openssl curl revocation nonce xcbc cmac ctr ccm stroke kernel-netlink socket-default updown load = test-vectors pem pkcs1 openssl curl revocation nonce xcbc cmac ctr ccm vici kernel-netlink socket-default updown
integrity_test = yes integrity_test = yes
crypto_test { crypto_test {

27
testing/tests/openssl-ikev2/rw-cert/hosts/carol/etc/swanctl/swanctl.conf Executable file
View File

@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = carol@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = 3des-sha1-modp2048
}
}
version = 2
proposals = 3des-sha1-modp2048
}
}

21
testing/tests/openssl-ikev2/rw-cert/hosts/dave/etc/ipsec.conf
View File

@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes256-sha256-modp2048!
conn home
left=PH_IP_DAVE
leftcert=daveCert.pem
leftid=dave@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightid=@moon.strongswan.org
rightsubnet=10.1.0.0/16
auto=add

2
testing/tests/openssl-ikev2/rw-cert/hosts/dave/etc/strongswan.conf
View File

@ -1,7 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc cmac ctr ccm gcm stroke kernel-netlink socket-default updown load = test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc cmac ctr ccm gcm vici kernel-netlink socket-default updown
integrity_test = yes integrity_test = yes
crypto_test { crypto_test {

27
testing/tests/openssl-ikev2/rw-cert/hosts/dave/etc/swanctl/swanctl.conf Executable file
View File

@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = daveCert.pem
id = dave@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}

20
testing/tests/openssl-ikev2/rw-cert/hosts/moon/etc/ipsec.conf
View File

@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes256-sha256-modp2048,3des-sha1-modp1536!
conn rw
left=PH_IP_MOON
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any
auto=add

2
testing/tests/openssl-ikev2/rw-cert/hosts/moon/etc/strongswan.conf
View File

@ -1,7 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = test-vectors pem pkcs1 openssl curl revocation nonce xcbc cmac ctr ccm stroke kernel-netlink socket-default updown load = test-vectors pem pkcs1 openssl curl revocation nonce xcbc cmac ctr ccm vici kernel-netlink socket-default updown
integrity_test = yes integrity_test = yes
crypto_test { crypto_test {

25
testing/tests/openssl-ikev2/rw-cert/hosts/moon/etc/swanctl/swanctl.conf Executable file
View File

@ -0,0 +1,25 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-modp3072,3des-sha1-modp2048
}
}
version = 2
proposals = aes128-sha256-modp3072,3des-sha1-modp2048
}
}

8
testing/tests/openssl-ikev2/rw-cert/posttest.dat
View File

@ -1,6 +1,8 @@
moon::ipsec stop carol::swanctl --terminate --ike home
carol::ipsec stop dave::swanctl --terminate --ike home
dave::ipsec stop carol::systemctl stop strongswan-swanctl
dave::systemctl stop strongswan-swanctl
moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush dave::iptables-restore < /etc/iptables.flush

13
testing/tests/openssl-ikev2/rw-cert/pretest.dat
View File

@ -1,12 +1,11 @@
moon::iptables-restore < /etc/iptables.rules mmoon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules dave::iptables-restore < /etc/iptables.rules
moon::ipsec start moon::systemctl start strongswan-swanctl
carol::ipsec start carol::systemctl start strongswan-swanctl
dave::ipsec start dave::systemctl start strongswan-swanctl
# moon runs crypto tests, so make sure it is ready
moon::expect-connection rw moon::expect-connection rw
carol::expect-connection home carol::expect-connection home
carol::ipsec up home carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home dave::expect-connection home
dave::ipsec up home dave::swanctl --initiate --child home 2> /dev/null

4
testing/tests/openssl-ikev2/rw-cert/test.conf
View File

@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes # Used for IPsec logging purposes
# #
IPSECHOSTS="moon carol dave" IPSECHOSTS="moon carol dave"
# charon controlled by swanctl
#
SWANCTL=1