sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-04 00:00:14 -04:00
Code Issues Projects Releases Wiki Activity
18,344 Commits 101 Branches 327 Tags
Commit Graph

1974 Commits

Author SHA1 Message Date
Tobias Brunner
5ef10ec326 testing: Add scenarios that use a CA with two intermediate CA certificates 
Mainly to test TKM's ability for handling multiple CAs and that the
received intermediate CA certificates are passed in the right order.
But also added a regular scenario where two intermediate CA certificates
are sent by one of the clients.
 2021-01-11 15:28:10 +01:00
Tobias Brunner
16fcdb460a charon-tkm: Don't use starter/stroke with charon-tkm anymore 
For the tests, the unused init script that was used before switching to
charon-systemd is repurposed to manage the daemon.
 2021-01-11 15:28:01 +01:00
Tobias Brunner
b322539ef5 charon-tkm: Deinitialize IKE tkm-rpc client 
This is necessary if tkm-rpc supports multiple parallel client requests.
 2021-01-08 17:22:37 +01:00
Adrian-Ken Rueegsegger
a0a0571bd1 charon-tkm: Reverse cert chain processing order 
Verify certificate chains starting from the root CA certificate and
moving towards the leaf/user certificate.

Also update TKM-RPC and TKM in testing scripts to version supporting the
reworked CC handling.
 2021-01-08 17:22:36 +01:00
Adrian-Ken Rueegsegger
532023dcf1 testing: Use latest TKM RPC library 
Brings some cleanups and minor improvements.
 2021-01-08 17:22:36 +01:00
Adrian-Ken Rueegsegger
eccca505aa testing: Use multi-CA aware TKM 
Also add CA ID to tkm_keymanager command.
 2021-01-08 17:22:36 +01:00
Adrian-Ken Rueegsegger
d6cf4a165b testing: Add CA ID mappings to TKM tests 
Extend the build-certs-chroot script is to fill in the public key
fingerprint of the CA certificate in the appropriate strongswan.con
files.
 2021-01-08 17:22:36 +01:00
Adrian-Ken Rueegsegger
524751ae76 testing: Switch to https for codelabs recipes 2021-01-08 17:22:36 +01:00
Tobias Brunner
fde5374a86 testing: Explicitly encode backing image format in metadata 
Apparently, there is no probing anymore in newer versions of qemu due
to security considerations.
 2021-01-08 11:39:44 +01:00
Andreas Steffen
fcb595f961 Version bump to 5.9.2dr1 2021-01-08 11:00:15 +01:00
Tobias Brunner
b58740996f testing: Use build-strongswan to implement build-rootimage 2020-11-27 12:05:22 +01:00
Tobias Brunner
88c94063d2 testing: Make building guest images after strongSwan optional 
This is basically only for the build-rootimage use case.
 2020-11-27 12:05:22 +01:00
Tobias Brunner
386e9a96a1 testing: Optionally build strongSwan from a release tarball 
This will allow us to replace the build-rootimage script.
 2020-11-27 12:05:22 +01:00
Tobias Brunner
a7d920059e testing: Optionally replace root image when building strongSwan 2020-11-27 12:05:22 +01:00
Tobias Brunner
c1dc7c4149 testing: Optionally use a new strongSwan build directory 
This can be useful when building completely different versions for the
first time to avoid issues with build artifacts of previous builds.
 2020-11-27 12:05:22 +01:00
Tobias Brunner
543d09c4b4 testing: Add option to build all software recipes when building strongSwan 
This is like building the root image but using a specific strongSwan
source tree, which is helpful if code changes depend on other software
packages (e.g. TKM-related or testing new crypto libraries).  If the script
is called and the root image does not exist, the new option is enabled
automatically.

The option to build in a specific guest image is now also moved to an
explicit command line option so that the source dir path is the only
remaining positional argument (see --help for details).
 2020-11-27 12:05:22 +01:00
Tobias Brunner
edc55f0876 testing: Create root image if it does not exist yet when building strongSwan 
This allows running the script directly after building the base image.
 2020-11-27 12:05:22 +01:00
Tobias Brunner
29c59885ca Use Botan 2.17.1 for tests 2020-11-27 12:05:22 +01:00
Tobias Brunner
1c2f5eea2c testing: Improve building different revisions of Git-recipes 
If we check out and build a certain revision of a dependency in a branch and
switch to another that requires a different revision and then switch back,
the previous approach installed the wrong revision as it would incorrectly
assume the required revision was already built and ready to install.
 2020-11-27 12:05:22 +01:00
Andreas Steffen
0fc6767097 Version bump to 5.9.1 2020-11-10 20:45:13 +01:00
Tobias Brunner
a6f0e19bf5 Fixed some typos, courtesy of codespell 2020-11-04 10:06:46 +01:00
Andreas Steffen
d63e6156bb Version bump to 5.9.1rc1 2020-11-01 18:45:34 +01:00
Tobias Brunner
8f2b6d7094 testing: Ignore hosts that are not running during shutdown 
This allows properly terminating the environment if a host has crashed
or was terminated manually for some reason.
 2020-10-29 10:22:51 +01:00
Tobias Brunner
60caa4f6c6 testing: Use silent rules to build strongSwan 2020-10-27 16:42:00 +01:00
Andreas Steffen
f3d96b7bc9 Version bump to 5.9.1dr1 2020-10-07 16:54:32 +02:00
Tobias Brunner
78015d14ac Use Botan 2.16.0 for tests 2020-10-07 12:38:52 +02:00
Tobias Brunner
428c0b293d testing: Build certificates when make-testing is called 2020-09-30 12:52:43 +02:00
Tobias Brunner
6638191cd7 testing: Increase memory of alice by 20 MiB 
It's ever so close with strongTNC, sometimes the OOM killer got triggered
and the tests failed, or even worse, the whole guest system got stuck.
This might just be enough for now.
 2020-09-04 15:48:12 +02:00
Tobias Brunner
64148f046e testing: Fix dependency issue with strongTNC 
Apparently, djangorestframework-camel-case, in the referenced version,
uses `six` but does not itself require/install it (later versions removed
Python 2 support altogether).
 2020-09-04 14:56:58 +02:00
Tobias Brunner
210c1e2628 testing: Fix route-based/net2net-xfrmi-ike scenario 
On newer systems, the upper hard limit for open file descriptors (see
`ulimit -H -n`) was increased from 4096 to 524288.  Due to how python-daemon
closes potentially open file descriptors (basically stores them in a set,
removes those excluded by config, and loops through all of them), the updown
script was either killed immediately (by the OOM killer) or not ready yet
when updown events occurred.
 2020-09-03 15:46:46 +02:00
Tobias Brunner
5bba0ec0f7 testing: Use Debian buster as base image 2020-09-03 15:24:37 +02:00
Tobias Brunner
1f97415fe7 testing: Use latest x509-ada release 
This fixes an issue with newer compiler versions where crashes would be
caused if functions of the generated C X.509 parser are not aligned.
 2020-09-03 15:24:37 +02:00
Tobias Brunner
fb78b0e533 testing: Add man, valgrind and strace to base image 2020-09-03 13:34:19 +02:00
Tobias Brunner
dcd8327933 testing: Install vici Python module manually 
easy_install is not included in Debian's python-setuptools package
anymore, so we install it manually using setup.py.
 2020-09-03 13:34:19 +02:00
Tobias Brunner
d9785b36a3 testing: Replace deprecated/removed pip install --download command 
It was deprecated for a while and has been replaced by `pip download`.
 2020-09-03 13:34:19 +02:00
Tobias Brunner
94eebc9c2c testing: Use legacy iptables on Debian buster 
The iptables-nft wrapper that uses the nftables framework can't handle
the CLUSTERIP target (plus we'd require nftables in the kernel).
 2020-09-03 13:34:19 +02:00
Tobias Brunner
5c4ebbdde8 testing: Increase maximum guest image size 
Seems that each Debian release increases the image size by about 200 MiB.
But increase it a bit more so we have room for logs/tools/debug symbols.
 2020-09-03 13:34:19 +02:00
Tobias Brunner
3d1e2c56df testing: Use pkill to reload rsyslogd config/recreate log files 
The PID location changes with newer Debian releases so it's more
portable this way.
 2020-09-03 13:34:19 +02:00
Tobias Brunner
d538b22afe testing: Remove deprecated UsePrivilegeSeparation option from sshd_config 2020-09-03 13:34:19 +02:00
Tobias Brunner
0d84b32e82 testing: Add Linux 5.8 kernel config 
Enables TCP encap for ESP.
 2020-09-03 13:34:19 +02:00
Tobias Brunner
5747ec4eae testing: Use host's /dev/urandom as /dev/random on guests via VirtIO RNG 
Newer versions of systemd etc. seem to require quite a lot of entropy
from /dev/random while booting, which can block and therefore delay the
start of other services (in particular sshd) by more than a minute.
Using the host's /dev/urandom via VirtIO RNG, we can avoid blocking the
guests.

The required kernel options are added for kernel versions 5.4+.
 2020-09-03 13:34:19 +02:00
Tobias Brunner
ad7d712cb5 testing: Support build with Debian buster base image 2020-09-03 13:33:32 +02:00
Andreas Steffen
2205c75bad Version bump to 5.9.0 2020-07-29 13:08:09 +02:00
Andreas Steffen
2eec7efd46 Version bump to 5.9.0rc1 2020-07-21 22:43:36 +02:00
Tobias Brunner
59455137b4 Use Botan 2.15.0 for tests 2020-07-20 16:58:03 +02:00
Tobias Brunner
f2d240954a testing: Skip tests with missing files, don't abort the test run 
This allows simple test configs in testing/tests/local that are no
actual test cases.
 2020-06-23 16:24:18 +02:00
Andreas Steffen
d470422974 Version bump to 5.9.0dr2 2020-06-14 12:15:44 +02:00
Tobias Brunner
84bce03a64 testing: Fix SQL scenarios after preferring AEAD for ESP 
sql/net2net-route|start-pem seem to be the only ones that configure a
proposal via database.
 2020-06-12 13:45:58 +02:00
Tobias Brunner
4261f915d6 testing: Fix ikev2/net2net-fragmentation scenario 
The IKE_AUTH message from moon is now larger because of the AEAD proposal.
 2020-06-12 13:45:58 +02:00
Andreas Steffen
12e4dbb231 Version bump to 5.9.0dr1 2020-06-06 15:02:42 +02:00