diff options
Diffstat (limited to 'testing/tests/ikev2/ocsp-timeouts-unknown')
7 files changed, 101 insertions, 0 deletions
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt new file mode 100644 index 000000000..d17534b1b --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt @@ -0,0 +1,7 @@ +This scenario is based on <a href="../ocsp-signer-cert">ikev2/ocsp-signer-cert</a> +and tests the timeouts of the <b>libcurl</b> library used for http-based OCSP fetching +by adding an ocspuri1 in <b>moon</b>'s strongswan ca section on which no OCSP +server is listening and an ocspuri2 that cannot be resolved by <b>DNS</b>. +Since the certificate status is <b>unknown</b> the connection setup is aborted by +<b>moon</b> with an <b>AUTHORIZATION_FAILED</b> notification sent to <b>carol</b>. + diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat new file mode 100644 index 000000000..c9c09a72f --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::http post request using libcurl failed::YES +moon::cat /var/log/daemon.log::certificate status unknown::YES +carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO + diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..cdc1560ae --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri1=http://bob.strongswan.org:8800 + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..e759d1d79 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri1=http://bob.strongswan.org:8800 + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat new file mode 100644 index 000000000..cf72480d4 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::iptables -F OUTPUT +carol::iptables -F OUTPUT diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat new file mode 100644 index 000000000..7d9d600ff --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat @@ -0,0 +1,6 @@ +moon::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP +carol::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" |