diff options
Diffstat (limited to 'testing')
1161 files changed, 9013 insertions, 945 deletions
diff --git a/testing/INSTALL b/testing/INSTALL index 7f2fb70cd..e11b7302e 100644 --- a/testing/INSTALL +++ b/testing/INSTALL @@ -53,7 +53,7 @@ are required for the strongSwan testing environment: * A vanilla Linux kernel on which the UML kernel will be based on. We recommend the use of - http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.20.1.tar.bz2 + http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.20.3.tar.bz2 * Starting with Linux kernel 2.6.9 no patch must be applied any more in order to make the vanilla kernel UML-capable. For older kernels you'll find @@ -71,7 +71,7 @@ are required for the strongSwan testing environment: * The latest strongSwan distribution - http://download.strongswan.org/strongswan-2.8.3.tar.gz + http://download.strongswan.org/strongswan-4.1.0.tar.gz 3. Creating the environment @@ -146,5 +146,5 @@ README document. ----------------------------------------------------------------------------- -This file is RCSID $Id: INSTALL,v 1.46 2007/02/21 22:17:52 as Exp $ +This file is RCSID $Id: INSTALL,v 1.39 2006/04/24 16:58:03 as Exp $ diff --git a/testing/do-tests b/testing/do-tests index 6119d37d4..fd11a6324 100755 --- a/testing/do-tests +++ b/testing/do-tests @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: do-tests,v 1.21 2006/10/19 21:12:43 as Exp $ +# RCSID $Id: do-tests,v 1.20 2006/02/08 21:27:59 as Exp $ DIR=`dirname $0` @@ -45,6 +45,7 @@ TESTDATE=`date +%Y%m%d-%H%M` TODAYDIR=$TESTRESULTSDIR/$TESTDATE mkdir $TODAYDIR TESTRESULTSHTML=$TODAYDIR/index.html +ALLHTML=$TODAYDIR/all.html DEFAULTTESTSDIR=$UMLTESTDIR/testing/tests testnumber="0" @@ -58,9 +59,6 @@ passed_cnt="0" TESTSDIR=$BUILDDIR/tests [ -d $TESTSDIR ] || mkdir $TESTSDIR -rm -rf $TESTSDIR/* -cp -rfp $DEFAULTTESTSDIR/* $TESTSDIR - ############################################################################## # assign IP for each host to hostname @@ -68,44 +66,38 @@ cp -rfp $DEFAULTTESTSDIR/* $TESTSDIR for host in $STRONGSWANHOSTS do - eval ip_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" + eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" + eval ipv6_${host}="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" case $host in moon) - eval ip1_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_MOON $ip_moon $TESTSDIR - searchandreplace PH_IP1_MOON $ip1_moon $TESTSDIR + eval ipv4_moon1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" + eval ipv6_moon1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" ;; sun) - eval ip1_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_SUN $ip_sun $TESTSDIR - searchandreplace PH_IP1_SUN $ip1_sun $TESTSDIR + eval ipv4_sun1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" + eval ipv6_sun1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" ;; alice) - searchandreplace PH_IP_ALICE $ip_alice $TESTSDIR ;; venus) - searchandreplace PH_IP_VENUS $ip_venus $TESTSDIR ;; bob) - searchandreplace PH_IP_BOB $ip_bob $TESTSDIR ;; carol) - eval ip1_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_CAROL $ip_carol $TESTSDIR - searchandreplace PH_IP1_CAROL $ip1_carol $TESTSDIR - ;; + eval ipv4_carol1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" + eval ipv6_carol1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" + ;; dave) - eval ip1_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" - searchandreplace PH_IP_DAVE $ip_dave $TESTSDIR - searchandreplace PH_IP1_DAVE $ip1_dave $TESTSDIR + eval ipv4_dave1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" + eval ipv6_dave1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`" ;; winnetou) - searchandreplace PH_IP_WINNETOU $ip_winnetou $TESTSDIR ;; esac done + ############################################################################## # create header for the results html file # @@ -131,6 +123,21 @@ cat > $TESTRESULTSHTML <<@EOF <thead align="left"><th>Number</th><th>Test</th><th>Result</th></thead> @EOF +cat > $ALLHTML <<@EOF +<html> +<head> + <title>strongSwan UML Testing</title> +</head> +<body> + <h2>strongSwan UML Testing</h2> + <table border="0" cellspacing="2"> + <tr><td><b>Host:</b></td><td>`uname -a`</td></tr> + <tr><td><b>UML kernel: </b></td><td>$KERNEL_VERSION</td></tr> + <tr><td><b>IPsec:</b></td><td>$IPSEC_VERSION</td></tr> + <tr><td><b>Date:</b></td><td>$TESTDATE</td></tr> + <tr><td colspan="2"> </td></tr> +@EOF + cecho "UML kernel: $KERNEL_VERSION" cecho "IPsec: $IPSEC_VERSION" cecho "Date: $TESTDATE" @@ -150,143 +157,217 @@ then TESTS=$SELECTEDTESTS else # set internal field seperator - TESTS="`ls $TESTSDIR`" + TESTS="`ls $DEFAULTTESTSDIR`" fi -for testname in $TESTS +for SUBDIR in $TESTS do - let "testnumber += 1" - cecho-n " $testnumber $testname.." - - if [ ! -d $TESTSDIR/${testname} ] + SUBTESTS="`basename $SUBDIR`" + + if [ $SUBTESTS = $SUBDIR ] then - cecho "is missing..skipped" - continue + SUBTESTS="`ls $DEFAULTTESTSDIR/$SUBDIR`" + else + SUBDIR="`dirname $SUBDIR`" fi - [ -f $TESTSDIR/${testname}/description.txt ] || die "!! File 'description.txt' is missing" - [ -f $TESTSDIR/${testname}/test.conf ] || die "!! File 'test.conf' is missing" - [ -f $TESTSDIR/${testname}/pretest.dat ] || die "!! File 'pretest.dat' is missing" - [ -f $TESTSDIR/${testname}/posttest.dat ] || die "!! File 'posttest.dat' is missing" - [ -f $TESTSDIR/${testname}/evaltest.dat ] || die "!! File 'evaltest.dat' is missing" + if [ ! -d $TODAYDIR/$SUBDIR ] + then + mkdir $TODAYDIR/$SUBDIR + echo "<tr><td> </td><td><a href=\"$SUBDIR\">$SUBDIR</a></td>" >> $ALLHTML + fi - TESTRESULTDIR=$TODAYDIR/$testname - mkdir $TESTRESULTDIR - CONSOLE_LOG=$TESTRESULTDIR/console.log - touch $CONSOLE_LOG + for name in $SUBTESTS + do + let "testnumber += 1" + testname=$SUBDIR/$name + cecho-n " $testnumber $testname.." + + if [ ! -d $DEFAULTTESTSDIR/${testname} ] + then + cecho "is missing..skipped" + continue + fi + [ -f $DEFAULTTESTSDIR/${testname}/description.txt ] || die "!! File 'description.txt' is missing" + [ -f $DEFAULTTESTSDIR/${testname}/test.conf ] || die "!! File 'test.conf' is missing" + [ -f $DEFAULTTESTSDIR/${testname}/pretest.dat ] || die "!! File 'pretest.dat' is missing" + [ -f $DEFAULTTESTSDIR/${testname}/posttest.dat ] || die "!! File 'posttest.dat' is missing" + [ -f $DEFAULTTESTSDIR/${testname}/evaltest.dat ] || die "!! File 'evaltest.dat' is missing" - ########################################################################## - # copy test specific configurations to uml hosts and clear auth.log files - # + TESTRESULTDIR=$TODAYDIR/$testname + mkdir -p $TESTRESULTDIR + CONSOLE_LOG=$TESTRESULTDIR/console.log + touch $CONSOLE_LOG - $DIR/scripts/load-testconfig $testname - source $TESTSDIR/$testname/test.conf + TESTDIR=$TESTSDIR/${testname} + rm -rf $TESTDIR + mkdir -p $TESTDIR + cp -rfp $DEFAULTTESTSDIR/${testname}/* $TESTDIR - - ########################################################################## - # run tcpdump in the background - # - if [ "$TCPDUMPHOSTS" != "" ] - then - echo -e "TCPDUMP\n" >> $CONSOLE_LOG 2>&1 - - for host_iface in $TCPDUMPHOSTS - do - host=`echo $host_iface | awk -F ":" '{print $1}'` - iface=`echo $host_iface | awk -F ":" '{if ($2 != "") { print $2 } else { printf("eth0") }}'` - tcpdump_cmd="tcpdump -i $iface not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 &" - echo "${host}# $tcpdump_cmd" >> $CONSOLE_LOG - ssh root@`eval echo \\\$ip_$host '$tcpdump_cmd'` - eval TDUP_${host}="true" - done - fi + ############################################################################## + # replace IP wildcards with actual IPv4 and IPv6 addresses + # - ########################################################################## - # execute pre-test commands - # + for host in $STRONGSWANHOSTS + do + case $host in + moon) + searchandreplace PH_IP_MOON1 $ipv4_moon1 $TESTDIR + searchandreplace PH_IP_MOON $ipv4_moon $TESTDIR + searchandreplace PH_IP6_MOON1 $ipv6_moon1 $TESTDIR + searchandreplace PH_IP6_MOON $ipv6_moon $TESTDIR + ;; + sun) + searchandreplace PH_IP_SUN1 $ipv4_sun1 $TESTDIR + searchandreplace PH_IP_SUN $ipv4_sun $TESTDIR + searchandreplace PH_IP6_SUN1 $ipv6_sun1 $TESTDIR + searchandreplace PH_IP6_SUN $ipv6_sun $TESTDIR + ;; + alice) + searchandreplace PH_IP_ALICE $ipv4_alice $TESTDIR + searchandreplace PH_IP6_ALICE $ipv6_alice $TESTDIR + ;; + venus) + searchandreplace PH_IP_VENUS $ipv4_venus $TESTDIR + searchandreplace PH_IP6_VENUS $ipv6_venus $TESTDIR + ;; + bob) + searchandreplace PH_IP_BOB $ipv4_bob $TESTDIR + searchandreplace PH_IPV6_BOB $ipv6_bob $TESTDIR + ;; + carol) + searchandreplace PH_IP_CAROL1 $ipv4_carol1 $TESTDIR + searchandreplace PH_IP_CAROL $ipv4_carol $TESTDIR + searchandreplace PH_IP6_CAROL1 $ipv6_carol1 $TESTDIR + searchandreplace PH_IP6_CAROL $ipv6_carol $TESTDIR + ;; + dave) + searchandreplace PH_IP_DAVE1 $ipv4_dave1 $TESTDIR + searchandreplace PH_IP_DAVE $ipv4_dave $TESTDIR + searchandreplace PH_IP6_DAVE1 $ipv6_dave1 $TESTDIR + searchandreplace PH_IP6_DAVE $ipv6_dave $TESTDIR + ;; + winnetou) + searchandreplace PH_IP_WINNETOU $ipv4_winnetou $TESTDIR + searchandreplace PH_IP6_WINNETOU $ipv6_winnetou $TESTDIR + ;; + esac + done - cecho-n "pre.." - echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1 - eval `awk -F "::" '{ - if ($2 != "") - { - printf("echo \"%s# %s\"; ", $1, $2) - printf("ssh root@\044ip_%s \"%s\"; ", $1, $2) - printf("echo;\n") - } - }' $TESTSDIR/${testname}/pretest.dat` >> $CONSOLE_LOG 2>&1 + ########################################################################## + # copy test specific configurations to uml hosts and clear auth.log files + # + $DIR/scripts/load-testconfig $testname + source $TESTDIR/test.conf - ########################################################################## - # stop tcpdump - # - function stop_tcpdump { - echo "${1}# killall tcpdump" >> $CONSOLE_LOG - eval ssh root@\$ip_${1} killall tcpdump - eval TDUP_${1}="false" - echo "" - } + ########################################################################## + # run tcpdump in the background + # + if [ "$TCPDUMPHOSTS" != "" ] + then + echo -e "TCPDUMP\n" >> $CONSOLE_LOG 2>&1 + + for host_iface in $TCPDUMPHOSTS + do + host=`echo $host_iface | awk -F ":" '{print $1}'` + iface=`echo $host_iface | awk -F ":" '{if ($2 != "") { print $2 } else { printf("eth0") }}'` + tcpdump_cmd="tcpdump -i $iface not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 &" + echo "${host}# $tcpdump_cmd" >> $CONSOLE_LOG + ssh root@`eval echo \\\$ipv4_$host '$tcpdump_cmd'` + eval TDUP_${host}="true" + done + fi - ########################################################################## - # get and evaluate test results - # - cecho-n "test.." - echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1 + ########################################################################## + # execute pre-test commands + # - STATUS="passed" + cecho-n "pre.." + echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1 - eval `awk -F "::" '{ - host=$1 - command=$2 - pattern=$3 - hit=$4 - if (command != "") - { - if (command == "tcpdump") - { - printf("if [ \044TDUP_%s == \"true\" ]; then stop_tcpdump %s; fi; \n", host, host) - printf("echo \"%s# cat /tmp/tcpdump.log | grep \047%s\047 [%s]\"; ", host, pattern, hit) - printf("ssh root@\044ip_%s cat /tmp/tcpdump.log | grep \"%s\"; ", host, pattern) - } - else + eval `awk -F "::" '{ + if ($2 != "") { - printf("echo \"%s# %s | grep \047%s\047 [%s]\"; ", host, command, pattern, hit) - printf("ssh root@\044ip_%s %s | grep \"%s\"; ", host, command, pattern) + printf("echo \"%s# %s\"; ", $1, $2) + printf("ssh root@\044ipv4_%s \"%s\"; ", $1, $2) + printf("echo;\n") } - printf("cmd_exit=\044?; ") - printf("echo; ") - printf("if [ \044cmd_exit -eq 0 -a \"%s\" = \"NO\" ] ", hit) - printf("|| [ \044cmd_exit -ne 0 -a \"%s\" = \"YES\" ] ", hit) - printf("; then STATUS=\"failed\"; fi; \n") + }' $TESTDIR/pretest.dat` >> $CONSOLE_LOG 2>&1 + + + ########################################################################## + # stop tcpdump + # + function stop_tcpdump { + echo "${1}# killall tcpdump" >> $CONSOLE_LOG + eval ssh root@\$ipv4_${1} killall tcpdump + eval TDUP_${1}="false" + echo "" } - }' $TESTSDIR/${testname}/evaltest.dat` >> $CONSOLE_LOG 2>&1 - ########################################################################## - # set counters - # + ########################################################################## + # get and evaluate test results + # - if [ $STATUS = "failed" ] - then - let "failed_cnt += 1" - else - let "passed_cnt += 1" - fi + cecho-n "test.." + echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1 + STATUS="passed" + + eval `awk -F "::" '{ + host=$1 + command=$2 + pattern=$3 + hit=$4 + if (command != "") + { + if (command == "tcpdump") + { + printf("if [ \044TDUP_%s == \"true\" ]; then stop_tcpdump %s; fi; \n", host, host) + printf("echo \"%s# cat /tmp/tcpdump.log | grep \047%s\047 [%s]\"; ", host, pattern, hit) + printf("ssh root@\044ipv4_%s cat /tmp/tcpdump.log | grep \"%s\"; ", host, pattern) + } + else + { + printf("echo \"%s# %s | grep \047%s\047 [%s]\"; ", host, command, pattern, hit) + printf("ssh root@\044ipv4_%s %s | grep \"%s\"; ", host, command, pattern) + } + printf("cmd_exit=\044?; ") + printf("echo; ") + printf("if [ \044cmd_exit -eq 0 -a \"%s\" = \"NO\" ] ", hit) + printf("|| [ \044cmd_exit -ne 0 -a \"%s\" = \"YES\" ] ", hit) + printf("; then STATUS=\"failed\"; fi; \n") + } + }' $TESTDIR/evaltest.dat` >> $CONSOLE_LOG 2>&1 + + + ########################################################################## + # set counters + # + + if [ $STATUS = "failed" ] + then + let "failed_cnt += 1" + else + let "passed_cnt += 1" + fi - ########################################################################## - # log statusall and listall output - # get copies of ipsec.conf, ipsec.secrets - # create index.html for the given test case - cat > $TESTRESULTDIR/index.html <<@EOF + ########################################################################## + # log statusall and listall output + # get copies of ipsec.conf, ipsec.secrets + # create index.html for the given test case + + cat > $TESTRESULTDIR/index.html <<@EOF <html> <head> <title>Test $testname</title> @@ -298,46 +379,62 @@ do <h3>Description</h3> @EOF - cat $TESTSDIR/${testname}/description.txt >> $TESTRESULTDIR/index.html + cat $TESTDIR/description.txt >> $TESTRESULTDIR/index.html - cat >> $TESTRESULTDIR/index.html <<@EOF + cat >> $TESTRESULTDIR/index.html <<@EOF <ul> <li><a href="console.log">console.log</a></li> </ul> - <img src="../images/$DIAGRAM" alt="$UMLHOSTS"> + <img src="../../images/$DIAGRAM" alt="$UMLHOSTS"> @EOF - - for host in $IPSECHOSTS - do - eval HOSTLOGIN=root@\$ip_${host} - - for command in statusall listall - do - ssh $HOSTLOGIN ipsec $command \ - > $TESTRESULTDIR/${host}.$command 2>/dev/null - done - - for file in ipsec.conf ipsec.secrets + for host in $IPSECHOSTS do - scp $HOSTLOGIN:/etc/$file \ - $TESTRESULTDIR/${host}.$file > /dev/null 2>&1 - done - - cat >> $TESTRESULTDIR/index.html <<@EOF + eval HOSTLOGIN=root@\$ipv4_${host} + + for command in statusall listall + do + ssh $HOSTLOGIN ipsec $command \ + > $TESTRESULTDIR/${host}.$command 2>/dev/null + done + + for file in ipsec.conf ipsec.secrets + do + scp $HOSTLOGIN:/etc/$file \ + $TESTRESULTDIR/${host}.$file > /dev/null 2>&1 + done + + ssh $HOSTLOGIN ip route list \ + > $TESTRESULTDIR/${host}.iproute 2>/dev/null + ssh $HOSTLOGIN iptables -v -n -L \ + > $TESTRESULTDIR/${host}.iptables 2>/dev/null + cat >> $TESTRESULTDIR/index.html <<@EOF <h3>$host</h3> - <ul> - <li><a href="$host.ipsec.conf">ipsec.conf</a></li> - <li><a href="$host.ipsec.secrets">ipsec.secrets</a></li> - <li><a href="$host.statusall">ipsec statusall</a></li> - <li><a href="$host.listall">ipsec listall</a></li> - <li><a href="$host.auth.log">auth.log</a></li> - </ul> + <table border="0" cellspacing="0" width="400"> + <tr> + <td> + <ul> + <li><a href="$host.ipsec.conf">ipsec.conf</a></li> + <li><a href="$host.ipsec.secrets">ipsec.secrets</a></li> + <li><a href="$host.statusall">ipsec statusall</a></li> + <li><a href="$host.listall">ipsec listall</a></li> + </ul> + </td> + <td> + <ul> + <li><a href="$host.auth.log">auth.log</a></li> + <li><a href="$host.daemon.log">daemon.log</a></li> + <li><a href="$host.iproute">ip route list</a></li> + <li><a href="$host.iptables">iptables -L</a></li> + </ul> + </td> + </tr> + </table> @EOF - done + done - cat >> $TESTRESULTDIR/index.html <<@EOF + cat >> $TESTRESULTDIR/index.html <<@EOF </td></tr> <tr><td align="right"> <b><a href="../index.html">Back</a></b> @@ -348,70 +445,88 @@ do @EOF - ########################################################################## - # execute post-test commands - # + ########################################################################## + # execute post-test commands + # - cecho-n "post.." - echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1 + cecho-n "post.." + echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1 - eval `awk -F "::" '{ - if ($2 != "") - { - printf("echo \"%s# %s\"; ", $1, $2) - printf("ssh root@\044ip_%s \"%s\"; ", $1, $2) - printf("echo;\n") - } - }' $TESTSDIR/${testname}/posttest.dat` >> $CONSOLE_LOG 2>&1 + eval `awk -F "::" '{ + if ($2 != "") + { + printf("echo \"%s# %s\"; ", $1, $2) + printf("ssh root@\044ipv4_%s \"%s\"; ", $1, $2) + printf("echo;\n") + } + }' $TESTDIR/posttest.dat` >> $CONSOLE_LOG 2>&1 - ########################################################################## - # get a copy of /var/log/auth.log - # + ########################################################################## + # get a copy of /var/log/auth.log + # - for host in $IPSECHOSTS - do - eval HOSTLOGIN=root@\$ip_${host} - ssh $HOSTLOGIN grep pluto /var/log/auth.log \ - > $TESTRESULTDIR/${host}.auth.log - done + for host in $IPSECHOSTS + do + eval HOSTLOGIN=root@\$ipv4_${host} + ssh $HOSTLOGIN grep pluto /var/log/auth.log \ + > $TESTRESULTDIR/${host}.auth.log + echo >> $TESTRESULTDIR/${host}.auth.log + ssh $HOSTLOGIN grep charon /var/log/auth.log \ + >> $TESTRESULTDIR/${host}.auth.log + done - ########################################################################## - # stop tcpdump if necessary - # + ########################################################################## + # get a copy of /var/log/daemon.log + # - for host in $TCPDUMPHOSTS - do - if [ "`eval echo \\\$TDUP_${host}`" = "true" ] - then - echo "${host}# killall tcpdump" >> $CONSOLE_LOG - eval ssh root@\$ip_$host killall tcpdump - eval TDUP_${host}="false" - fi - done + for host in $IPSECHOSTS + do + eval HOSTLOGIN=root@\$ipv4_${host} + ssh $HOSTLOGIN grep pluto /var/log/daemon.log \ + > $TESTRESULTDIR/${host}.daemon.log + echo >> $TESTRESULTDIR/${host}.daemon.log + ssh $HOSTLOGIN grep charon /var/log/daemon.log \ + >> $TESTRESULTDIR/${host}.daemon.log + done - ########################################################################## - # copy default host config back if necessary - # + ########################################################################## + # stop tcpdump if necessary + # - $DIR/scripts/restore-defaults $testname + for host in $TCPDUMPHOSTS + do + if [ "`eval echo \\\$TDUP_${host}`" = "true" ] + then + echo "${host}# killall tcpdump" >> $CONSOLE_LOG + eval ssh root@\$ipv4_$host killall tcpdump + eval TDUP_${host}="false" + fi + done - ########################################################################## - # write test status to html file - # + ########################################################################## + # copy default host config back if necessary + # - cecho "$STATUS" - if [ $STATUS = "passed" ] - then - COLOR="green" - else - COLOR="red" - fi + $DIR/scripts/restore-defaults $testname - cat >> $TESTRESULTSHTML << @EOF + + ########################################################################## + # write test status to html file + # + + cecho "$STATUS" + if [ $STATUS = "passed" ] + then + COLOR="green" + else + COLOR="red" + fi + + cat >> $TESTRESULTSHTML << @EOF <tr> <td>$testnumber</td> <td><a href="$testname/">$testname</a></td> @@ -419,6 +534,7 @@ do </tr> @EOF + done done @@ -436,6 +552,12 @@ cat >> $TESTRESULTSHTML << @EOF </html> @EOF +cat >> $ALLHTML << @EOF + </table> +</body> +</html> +@EOF + cecho "" cecho "Passed: $passed_cnt" cecho "Failed: $failed_cnt" @@ -449,10 +571,10 @@ cecho "" HTDOCS="/var/www/localhost/htdocs" cecho-n "Copying test results to winnetou.." -ssh root@${ip_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1 -scp -r $TODAYDIR root@${ip_winnetou}:$HTDOCS/testresults > /dev/null 2>&1 -ssh root@${ip_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1 +ssh root@${ipv4_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1 +scp -r $TODAYDIR root@${ipv4_winnetou}:$HTDOCS/testresults > /dev/null 2>&1 +ssh root@${ipv4_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1 cecho "done" cecho "" cecho "The results are available in $TODAYDIR" -cecho "or via the link http://$ip_winnetou/testresults/$TESTDATE" +cecho "or via the link http://$ipv4_winnetou/testresults/$TESTDATE" diff --git a/testing/hosts/alice/etc/ipsec.conf b/testing/hosts/alice/etc/ipsec.conf index 4e525d929..312cadb8f 100755 --- a/testing/hosts/alice/etc/ipsec.conf +++ b/testing/hosts/alice/etc/ipsec.conf @@ -5,6 +5,7 @@ config setup crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/hosts/bob/etc/ipsec.conf b/testing/hosts/bob/etc/ipsec.conf index 9040fc25d..0172c043b 100755 --- a/testing/hosts/bob/etc/ipsec.conf +++ b/testing/hosts/bob/etc/ipsec.conf @@ -5,6 +5,7 @@ config setup crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/hosts/carol/etc/ipsec.conf b/testing/hosts/carol/etc/ipsec.conf index 43deae00f..6f1097e9e 100755 --- a/testing/hosts/carol/etc/ipsec.conf +++ b/testing/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/hosts/dave/etc/ipsec.conf b/testing/hosts/dave/etc/ipsec.conf index 5fc5eef46..16e5299ce 100755 --- a/testing/hosts/dave/etc/ipsec.conf +++ b/testing/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/hosts/moon/etc/ipsec.conf b/testing/hosts/moon/etc/ipsec.conf index c7d7dc2ed..b26f81911 100755 --- a/testing/hosts/moon/etc/ipsec.conf +++ b/testing/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/hosts/moon/etc/ipsec.secrets b/testing/hosts/moon/etc/ipsec.secrets index c90b4c4a3..e86d6aa5c 100644 --- a/testing/hosts/moon/etc/ipsec.secrets +++ b/testing/hosts/moon/etc/ipsec.secrets @@ -1,7 +1,3 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file : RSA moonKey.pem - - - - diff --git a/testing/hosts/sun/etc/ipsec.conf b/testing/hosts/sun/etc/ipsec.conf index 1106ded6f..77d3fb183 100755 --- a/testing/hosts/sun/etc/ipsec.conf +++ b/testing/hosts/sun/etc/ipsec.conf @@ -5,6 +5,7 @@ config setup crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/hosts/venus/etc/ipsec.conf b/testing/hosts/venus/etc/ipsec.conf index 8e4e47459..524640cda 100755 --- a/testing/hosts/venus/etc/ipsec.conf +++ b/testing/hosts/venus/etc/ipsec.conf @@ -5,6 +5,7 @@ config setup crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/hosts/winnetou/etc/apache2/httpd.conf b/testing/hosts/winnetou/etc/apache2/httpd.conf new file mode 100644 index 000000000..41c74453a --- /dev/null +++ b/testing/hosts/winnetou/etc/apache2/httpd.conf @@ -0,0 +1,1103 @@ +# +# This is a modification of the default Apache 2 configuration +# file by Gentoo Linux. .... [insert more] +# +# Support: +# http://www.gentoo.org/main/en/lists.xml [mailing lists] +# http://forums.gentoo.org/ [web forums] +# +# Bug Reports: +# http://bugs.gentoo.org/ [gentoo related bugs] +# http://bugs.apache.org/ [apache httpd related bugs] + +# +# +# +# Based upon the NCSA server configuration files originally by Rob McCool. +# +# This is the main Apache server configuration file. It contains the +# configuration directives that give the server its instructions. +# See <URL:http://httpd.apache.org/docs/2.0/> for detailed information about +# the directives. +# +# Do NOT simply read the instructions in here without understanding +# what they do. They're here only as hints or reminders. If you are unsure +# consult the online docs. You have been warned. +# +# The configuration directives are grouped into three basic sections: +# 1. Directives that control the operation of the Apache server process as a +# whole (the 'global environment'). +# 2. Directives that define the parameters of the 'main' or 'default' server, +# which responds to requests that aren't handled by a virtual host. +# These directives also provide default values for the settings +# of all virtual hosts. +# 3. Settings for virtual hosts, which allow Web requests to be sent to +# different IP addresses or hostnames and have them handled by the +# same Apache server process. +# +# Configuration and logfile names: If the filenames you specify for many +# of the server's control files begin with "/" (or "drive:/" for Win32), the +# server will use that explicit path. If the filenames do *not* begin +# with "/", the value of ServerRoot is prepended -- so "logs/foo.log" +# with ServerRoot set to "/usr/lib/apache2" will be interpreted by the +# server as "/usr/lib/apache2/logs/foo.log". +# + +### Section 1: Global Environment +# +# The directives in this section affect the overall operation of Apache, +# such as the number of concurrent requests it can handle or where it +# can find its configuration files. +# + +# +# ServerRoot: The top of the directory tree under which the server's +# configuration, error, and log files are kept. +# +# NOTE! If you intend to place this on an NFS (or otherwise network) +# mounted filesystem then please read the LockFile documentation (available +# at <URL:http://httpd.apache.org/docs/2.0/mod/mpm_common.html#lockfile>); +# you will save yourself a lot of trouble. +# +# Do NOT add a slash at the end of the directory path. +# +ServerRoot "/usr/lib/apache2" + +# +# The accept serialization lock file MUST BE STORED ON A LOCAL DISK. +# +#LockFile "/var/run/apache2.lock" + +# +# ScoreBoardFile: File used to store internal server process information. +# If unspecified (the default), the scoreboard will be stored in an +# anonymous shared memory segment, and will be unavailable to third-party +# applications. +# If specified, ensure that no two invocations of Apache share the same +# scoreboard file. The scoreboard file MUST BE STORED ON A LOCAL DISK. +# +<IfModule !perchild.c> + #ScoreBoardFile /var/run/apache2_runtime_status +</IfModule> + + +# +# PidFile: The file in which the server should record its process +# identification number when it starts. +# +PidFile "/var/run/apache2.pid" + +# +# Timeout: The number of seconds before receives and sends time out. +# +Timeout 300 + +# +# KeepAlive: Whether or not to allow persistent connections (more than +# one request per connection). Set to "Off" to deactivate. +# +KeepAlive On + +# +# MaxKeepAliveRequests: The maximum number of requests to allow +# during a persistent connection. Set to 0 to allow an unlimited amount. +# We recommend you leave this number high, for maximum performance. +# +MaxKeepAliveRequests 100 + +# +# KeepAliveTimeout: Number of seconds to wait for the next request from the +# same client on the same connection. +# +KeepAliveTimeout 15 + +## +## Server-Pool Size Regulation (MPM specific) +## + +# prefork MPM [DEFAULT IF USE=-threads] +# StartServers: number of server processes to start +# MinSpareServers: minimum number of server processes which are kept spare +# MaxSpareServers: maximum number of server processes which are kept spare +# MaxClients: maximum number of server processes allowed to start +# MaxRequestsPerChild: maximum number of requests a server process serves +<IfModule prefork.c> + StartServers 5 + MinSpareServers 5 + MaxSpareServers 10 + MaxClients 150 + MaxRequestsPerChild 0 +</IfModule> + +# worker MPM [DEFAULT IF USE=threads] +# StartServers: initial number of server processes to start +# MaxClients: maximum number of simultaneous client connections +# MinSpareThreads: minimum number of worker threads which are kept spare +# MaxSpareThreads: maximum number of worker threads which are kept spare +# ThreadsPerChild: constant number of worker threads in each server process +# MaxRequestsPerChild: maximum number of requests a server process serves +<IfModule worker.c> + StartServers 2 + MaxClients 150 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadsPerChild 25 + MaxRequestsPerChild 0 +</IfModule> + +# perchild MPM [THIS MPM IS NOT SUPPORTED] +# NumServers: constant number of server processes +# StartThreads: initial number of worker threads in each server process +# MinSpareThreads: minimum number of worker threads which are kept spare +# MaxSpareThreads: maximum number of worker threads which are kept spare +# MaxThreadsPerChild: maximum number of worker threads in each server process +# MaxRequestsPerChild: maximum number of connections per server process +<IfModule perchild.c> + NumServers 5 + StartThreads 5 + MinSpareThreads 5 + MaxSpareThreads 10 + MaxThreadsPerChild 20 + MaxRequestsPerChild 0 +</IfModule> + +# peruser MPM [THIS MPM IS NOT SUPPORTED] +# MinSpareServers - Minimum number of idle children, to handle request spikes +# MaxClients - Maximum number of children alive at the same time +# MaxProcessors - Maximum number of processors per vhost +# Multiplexer - Specify an Multiplexer Child configuration. +# Processor - Specify a User and Group for a specific child process. +# ServerEnvironment - Specify the server environment for this virtual host. +<IfModule peruser.c> + ServerLimit 256 + MaxClients 256 + MinSpareProcessors 2 + MaxProcessors 10 + MaxRequestsPerChild 1000 + + # kill off idle processors after this many seconds + # set to 0 to disable + ExpireTimeout 1800 + + Multiplexer nobody nobody + + Processor apache apache + + # chroot dir is optional: + # Processor user group /path/to/chroot +</IfModule> + +# itk MPM [THIS MPM IS NOT SUPPORTED] +# StartServers: number of server processes to start +# MinSpareServers: minimum number of server processes which are kept spare +# MaxSpareServers: maximum number of server processes which are kept spare +# MaxClients: maximum number of server processes allowed to start +# MaxRequestsPerChild: maximum number of requests a server process serves +<IfModule itk.c> + StartServers 5 + MinSpareServers 2 + MaxSpareServers 10 + MaxClients 150 + MaxRequestsPerChild 1000 +</IfModule> + +# +# Listen: Allows you to bind Apache to specific IP addresses and/or +# ports, instead of the default. See also the <VirtualHost> +# directive. +# +# Change this to Listen on specific IP addresses as shown below to +# prevent Apache from glomming onto all bound IP addresses (0.0.0.0) +# +#Listen 12.34.56.78:80 +Listen 80 +Listen 8880 +Listen 8881 +Listen 8882 + +# +# Dynamic Shared Object (DSO) Support +# +# To be able to use the functionality of a module which was built as a DSO you +# have to place corresponding `LoadModule' lines at this location so the +# directives contained in it are actually available _before_ they are used. +# Statically compiled modules (those listed by `httpd -l') do not need +# to be loaded here. +# +# The following modules are considered as the default configuration. +# If you wish to disable one of them, you may have to alter other +# configuration directives. +# +# You should always leave these three, as they are needed for normal use. +# mod_access (Order, Allow, etc..) +# mod_log_config (Transferlog, etc..) +# mod_mime (AddType, etc...) +# +# Example: +# LoadModule foo_module modules/mod_foo.so + + +# Authentication Modules +# +# These modules provide authentication and authorization for +# clients. They should not normally be disabled. +# +LoadModule access_module modules/mod_access.so +LoadModule auth_module modules/mod_auth.so +LoadModule auth_anon_module modules/mod_auth_anon.so +LoadModule auth_dbm_module modules/mod_auth_dbm.so +LoadModule auth_digest_module modules/mod_auth_digest.so + +# +# Metadata Modules +# +# These modules provide extra data to clients about +# a file, such as the mime-type or charset. +# +LoadModule charset_lite_module modules/mod_charset_lite.so +LoadModule env_module modules/mod_env.so +LoadModule expires_module modules/mod_expires.so +LoadModule headers_module modules/mod_headers.so +LoadModule mime_module modules/mod_mime.so +LoadModule negotiation_module modules/mod_negotiation.so +LoadModule setenvif_module modules/mod_setenvif.so + +# +# Logging Modules +# +# These modules provide logging services for Apache +# +LoadModule log_config_module modules/mod_log_config.so +LoadModule logio_module modules/mod_logio.so + + +# +# CGI Modules +# +# These modules provide the ability to execute CGI Scripts. +# +LoadModule cgi_module modules/mod_cgi.so +LoadModule cgid_module modules/mod_cgid.so + + +# +# This `suexec` module provides the ability to exeucte CGI scripts under +# a different user than apache is run. +# +LoadModule suexec_module modules/mod_suexec.so + + +# +# Mappers +# +# These Modules provide URL mappings or translations. +LoadModule alias_module modules/mod_alias.so +LoadModule rewrite_module modules/mod_rewrite.so +<IfDefine USERDIR> + LoadModule userdir_module modules/mod_userdir.so +</IfDefine> + + +# +# Handlers +# +# These modules create content for a client. +# +<IfDefine INFO> + LoadModule info_module modules/mod_info.so + LoadModule status_module modules/mod_status.so +</IfDefine> +LoadModule actions_module modules/mod_actions.so +LoadModule autoindex_module modules/mod_autoindex.so +LoadModule dir_module modules/mod_dir.so + +# +# Filters +# +# These modules provide filters for Apache. +# They preform common tasks like gzip encoding or SSI +# +# +LoadModule ext_filter_module modules/mod_ext_filter.so +LoadModule deflate_module modules/mod_deflate.so +LoadModule include_module modules/mod_include.so + + +# +# Cache Modules +# +# The following modules are used for storing a cache of +# generated or proxied content. +# +#LoadModule cache_module modules/mod_cache.so +#LoadModule disk_cache_module modules/mod_disk_cache.so +#LoadModule mem_cache_module modules/mod_mem_cache.so +#LoadModule file_cache_module modules/mod_file_cache.so + +# +# Proxy Modules +# +# The following modules are only needed if you are running +# Apache as a Forward or Reverse Proxy. +# +# WARNING: Enabling these modules can be dangerous! +# READ THE DOCUMENTATION FIRST: +# http://httpd.apache.org/docs/2.0/mod/mod_proxy.html +<IfDefine PROXY> + LoadModule proxy_module modules/mod_proxy.so + LoadModule proxy_connect_module modules/mod_proxy_connect.so + LoadModule proxy_ftp_module modules/mod_proxy_ftp.so + LoadModule proxy_http_module modules/mod_proxy_http.so +</IfDefine> + +# +# Uncommon Modules +# +# The following Modules are not commonly loaded for Apache +# +#LoadModule case_filter_module modules/mod_case_filter.so +#LoadModule case_filter_in_module modules/mod_case_filter_in.so +#LoadModule echo_module modules/mod_echo.so +#LoadModule mime_magic_module modules/mod_mime_magic.so +#LoadModule speling_module modules/mod_speling.so +#LoadModule unique_id_module modules/mod_unique_id.so +#LoadModule vhost_alias_module modules/mod_vhost_alias.so + +# +# Obsolete Modules +# +# The Following modules are not commonly needed and use +# obsolete technologies. +# +#LoadModule cern_meta_module modules/mod_cern_meta.so +#LoadModule imap_module modules/mod_imap.so +#LoadModule usertrack_module modules/mod_usertrack.so +#LoadModule asis_module modules/mod_asis.so + + +# +# Extra Modules +# +# We Include extra .conf files from /etc/apache2/modules.d +# This is used to load things like PHP and mod_ssl. +# +Include /etc/apache2/modules.d/*.conf + +### Section 2: 'Main' server configuration +# +# The directives in this section set up the values used by the 'main' +# server, which responds to any requests that aren't handled by a +# <VirtualHost> definition. These values also provide defaults for +# any <VirtualHost> containers you may define later in the file. +# +# All of these directives may appear inside <VirtualHost> containers, +# in which case these default settings will be overridden for the +# virtual host being defined. +# + +# +# If you wish httpd to run as a different user or group, you must run +# httpd as root initially and it will switch. +# +# User/Group: The name (or #number) of the user/group to run httpd as. +# . On SCO (ODT 3) use "User nouser" and "Group nogroup". +# . On HPUX you may not be able to use shared memory as nobody, and the +# suggested workaround is to create a user www and use that user. +# NOTE that some kernels refuse to setgid(Group) or semctl(IPC_SET) +# when the value of (unsigned)Group is above 60000; +# don't use Group #-1 on these systems! +# +User apache +Group apache + +# +# ServerAdmin: Your address, where problems with the server should be +# e-mailed. This address appears on some server-generated pages, such +# as error documents. e.g. admin@your-domain.com +# +ServerAdmin root@localhost + +# +# ServerName gives the name and port that the server uses to identify itself. +# This can often be determined automatically, but we recommend you specify +# it explicitly to prevent problems during startup. +# +# If this is not set to valid DNS name for your host, server-generated +# redirections will not work. See also the UseCanonicalName directive. +# +# If your host doesn't have a registered DNS name, enter its IP address here. +# You will have to access it by its address anyway, and this will make +# redirections work in a sensible way. +# +#ServerName localhost + +# +# UseCanonicalName: Determines how Apache constructs self-referencing +# URLs and the SERVER_NAME and SERVER_PORT variables. +# When set "Off", Apache will use the Hostname and Port supplied +# by the client. When set "On", Apache will use the value of the +# ServerName directive. +# +UseCanonicalName Off + + +# +# Each directory to which Apache has access can be configured with respect +# to which services and features are allowed and/or disabled in that +# directory (and its subdirectories). +# +# First, we configure the "default" to be a very restrictive set of +# features. +# +<Directory /> + Options FollowSymLinks + AllowOverride None +</Directory> + +# +# Note that from this point forward you must specifically allow +# particular features to be enabled - so if something's not working as +# you might expect, make sure that you have specifically enabled it +# below. +# + +# +# UserDir: The name of the directory that is appended onto a user's home +# directory if a ~user request is received. +# enable by adding -D USERDIR to /etc/conf.d/apache2 +# +<IfModule mod_userdir.c> + UserDir public_html + +# +# Control access to UserDir directories. The following is an example +# for a site where these directories are restricted to read-only. +# + <Directory /home/*/public_html> + AllowOverride FileInfo AuthConfig Limit Indexes + Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec + <Limit GET POST OPTIONS PROPFIND> + Order allow,deny + Allow from all + </Limit> + <LimitExcept GET POST OPTIONS PROPFIND> + Order deny,allow + Deny from all + </LimitExcept> + </Directory> + + +# Enable this additional section if you would like to make use of a +# suexec-enabled cgi-bin directory on a per-user basis. +# +#<Directory /home/*/public_html/cgi-bin> +# Options ExecCGI +# SetHandler cgi-script +#</Directory> + +</IfModule> + + +# +# DirectoryIndex: sets the file that Apache will serve if a directory +# is requested. +# +# The index.html.var file (a type-map) is used to deliver content- +# negotiated documents. The MultiViews Option can be used for the +# same purpose, but it is much slower. +# +DirectoryIndex index.html ocsp.cgi + +# +# AccessFileName: The name of the file to look for in each directory +# for additional configuration directives. See also the AllowOverride +# directive. +# +AccessFileName .htaccess + +# +# The following lines prevent .htaccess and .htpasswd files from being +# viewed by Web clients. +# +<FilesMatch "^\.ht"> + Order allow,deny + Deny from all +</FilesMatch> + +# +# TypesConfig describes where the mime.types file (or equivalent) is +# to be found. +# +TypesConfig /etc/mime.types + +# +# DefaultType is the default MIME type the server will use for a document +# if it cannot otherwise determine one, such as from filename extensions. +# If your server contains mostly text or HTML documents, "text/plain" is +# a good value. If most of your content is binary, such as applications +# or images, you may want to use "application/octet-stream" instead to +# keep browsers from trying to display binary files as though they are +# text. +# +DefaultType text/plain + +# +# The mod_mime_magic module allows the server to use various hints from the +# contents of the file itself to determine its type. The MIMEMagicFile +# directive tells the module where the hint definitions are located. +# +<IfModule mod_mime_magic.c> + MIMEMagicFile /etc/apache2/magic +</IfModule> + +# +# HostnameLookups: Log the names of clients or just their IP addresses +# e.g., www.apache.org (on) or 204.62.129.132 (off). +# The default is off because it'd be overall better for the net if people +# had to knowingly turn this feature on, since enabling it means that +# each client request will result in AT LEAST one lookup request to the +# nameserver. +# +HostnameLookups Off + +# +# EnableMMAP: Control whether memory-mapping is used to deliver +# files (assuming that the underlying OS supports it). +# The default is on; turn this off if you serve from NFS-mounted +# filesystems. On some systems, turning it off (regardless of +# filesystem) can improve performance; for details, please see +# http://httpd.apache.org/docs/2.0/mod/core.html#enablemmap +# +#EnableMMAP off + +# +# EnableSendfile: Control whether the sendfile kernel support is +# used to deliver files (assuming that the OS supports it). +# The default is on; turn this off if you serve from NFS-mounted +# filesystems. Please see +# http://httpd.apache.org/docs/2.0/mod/core.html#enablesendfile +# +#EnableSendfile off + +# +# ErrorLog: The location of the error log file. +# If you do not specify an ErrorLog directive within a <VirtualHost> +# container, error messages relating to that virtual host will be +# logged here. If you *do* define an error logfile for a <VirtualHost> +# container, that host's errors will be logged there and not here. +# +ErrorLog logs/error_log + +# +# LogLevel: Control the number of messages logged to the error_log. +# Possible values include: debug, info, notice, warn, error, crit, +# alert, emerg. +# +LogLevel warn + +# +# The following directives define some format nicknames for use with +# a CustomLog directive (see below). +# +LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined +LogFormat "%h %l %u %t \"%r\" %>s %b" common +LogFormat "%{Referer}i -> %U" referer +LogFormat "%{User-agent}i" agent +LogFormat "%v %h %l %u %t \"%r\" %>s %b %T" script +LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" VLOG=%{VLOG}e" vhost + +# You need to enable mod_logio.c to use %I and %O +#LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio + +# +# The location and format of the access logfile (Common Logfile Format). +# If you do not define any access logfiles within a <VirtualHost> +# container, they will be logged here. Contrariwise, if you *do* +# define per-<VirtualHost> access logfiles, transactions will be +# logged therein and *not* in this file. +# +CustomLog logs/access_log common + +# +# If you would like to have agent and referer logfiles, uncomment the +# following directives. +# +#CustomLog logs/referer_log referer +#CustomLog logs/agent_log agent + +# +# If you prefer a single logfile with access, agent, and referer information +# (Combined Logfile Format) you can use the following directive. +# +#CustomLog logs/access_log combined + +# +# ServerTokens +# This directive configures what you return as the Server HTTP response +# Header. The default is 'Full' which sends information about the OS-Type +# and compiled in modules. +# Set to one of: Full | OS | Minor | Minimal | Major | Prod +# where Full conveys the most information, and Prod the least. +# +ServerTokens Prod + +# +# Optionally add a line containing the server version and virtual host +# name to server-generated pages (internal error documents, FTP directory +# listings, mod_status and mod_info output etc., but not CGI generated +# documents or custom error documents). +# Set to "EMail" to also include a mailto: link to the ServerAdmin. +# Set to one of: On | Off | EMail +# +ServerSignature On + +# +# Aliases: Add here as many aliases as you need (with no limit). The format is +# Alias fakename realname +# +# Note that if you include a trailing / on fakename then the server will +# require it to be present in the URL. So "/icons" isn't aliased in this +# example, only "/icons/". If the fakename is slash-terminated, then the +# realname must also be slash terminated, and if the fakename omits the +# trailing slash, the realname must also omit it. +# +# We include the /icons/ alias for FancyIndexed directory listings. If you +# do not use FancyIndexing, you may comment this out. +# +Alias /icons/ "/var/www/localhost/icons/" + +<Directory "/var/www/localhost/icons/"> + Options Indexes MultiViews + AllowOverride None + Order allow,deny + Allow from all +</Directory> + +# +# ScriptAlias: This controls which directories contain server scripts. +# ScriptAliases are essentially the same as Aliases, except that +# documents in the realname directory are treated as applications and +# run by the server when requested rather than as documents sent to the client. +# The same rules about trailing "/" apply to ScriptAlias directives as to +# Alias. +# +ScriptAlias /cgi-bin/ /var/www/localhost/cgi-bin/ + +<IfModule mod_cgid.c> + # + # Additional to mod_cgid.c settings, mod_cgid has Scriptsock <path> + # for setting UNIX socket for communicating with cgid. + # + #Scriptsock /var/run/cgisock +</IfModule> + +# +# "/var/www/localhost/cgi-bin/" should be changed to whatever your ScriptAliased +# CGI directory exists, if you have that configured. +# +<Directory "/var/www/localhost/cgi-bin/"> + AllowOverride None + Options None + Order allow,deny + Allow from all +</Directory> + +# +# Redirect allows you to tell clients about documents which used to exist in +# your server's namespace, but do not anymore. This allows you to tell the +# clients where to look for the relocated document. +# Example: +# Redirect permanent /foo http://www.example.com/bar + +# +# Directives controlling the display of server-generated directory listings. +# +<IfModule mod_autoindex.c> + # + # IndexOptions: Controls the appearance of server-generated directory + # listings. + # + IndexOptions FancyIndexing VersionSort + + # + # AddIcon* directives tell the server which icon to show for different + # files or filename extensions. These are only displayed for + # FancyIndexed directories. + # + AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip + + AddIconByType (TXT,/icons/text.gif) text/* + AddIconByType (IMG,/icons/image2.gif) image/* + AddIconByType (SND,/icons/sound2.gif) audio/* + AddIconByType (VID,/icons/movie.gif) video/* + + AddIcon /icons/binary.gif .bin .exe + AddIcon /icons/binhex.gif .hqx + AddIcon /icons/tar.gif .tar + AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv + AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip + AddIcon /icons/a.gif .ps .ai .eps + AddIcon /icons/layout.gif .html .shtml .htm .pdf + AddIcon /icons/text.gif .txt + AddIcon /icons/c.gif .c + AddIcon /icons/p.gif .pl .py + AddIcon /icons/f.gif .for + AddIcon /icons/dvi.gif .dvi + AddIcon /icons/uuencoded.gif .uu + AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl + AddIcon /icons/tex.gif .tex + AddIcon /icons/bomb.gif core + + AddIcon /icons/back.gif .. + AddIcon /icons/hand.right.gif README + AddIcon /icons/folder.gif ^^DIRECTORY^^ + AddIcon /icons/blank.gif ^^BLANKICON^^ + + # + # DefaultIcon is which icon to show for files which do not have an icon + # explicitly set. + # + DefaultIcon /icons/unknown.gif + + # + # AddDescription allows you to place a short description after a file in + # server-generated indexes. These are only displayed for FancyIndexed + # directories. + # Format: AddDescription "description" filename + # + #AddDescription "GZIP compressed document" .gz + #AddDescription "tar archive" .tar + #AddDescription "GZIP compressed tar archive" .tgz + + # + # ReadmeName is the name of the README file the server will look for by + # default, and append to directory listings. + # + # HeaderName is the name of a file which should be prepended to + # directory indexes. + ReadmeName README.html + HeaderName HEADER.html + + # + # IndexIgnore is a set of filenames which directory indexing should ignore + # and not include in the listing. Shell-style wildcarding is permitted. + # + IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t .svn +</IfModule> + +# +# DefaultLanguage and AddLanguage allows you to specify the language of +# a document. You can then use content negotiation to give a browser a +# file in a language the user can understand. +# +# Specify a default language. This means that all data +# going out without a specific language tag (see below) will +# be marked with this one. You probably do NOT want to set +# this unless you are sure it is correct for all cases. +# +# * It is generally better to not mark a page as +# * being a certain language than marking it with the wrong +# * language! +# +# DefaultLanguage nl +# +# Note 1: The suffix does not have to be the same as the language +# keyword --- those with documents in Polish (whose net-standard +# language code is pl) may wish to use "AddLanguage pl .po" to +# avoid the ambiguity with the common suffix for perl scripts. +# +# Note 2: The example entries below illustrate that in some cases +# the two character 'Language' abbreviation is not identical to +# the two character 'Country' code for its country, +# E.g. 'Danmark/dk' versus 'Danish/da'. +# +# Note 3: In the case of 'ltz' we violate the RFC by using a three char +# specifier. There is 'work in progress' to fix this and get +# the reference data for rfc1766 cleaned up. +# +# Catalan (ca) - Croatian (hr) - Czech (cs) - Danish (da) - Dutch (nl) +# English (en) - Esperanto (eo) - Estonian (et) - French (fr) - German (de) +# Greek-Modern (el) - Hebrew (he) - Italian (it) - Japanese (ja) +# Korean (ko) - Luxembourgeois* (ltz) - Norwegian Nynorsk (nn) +# Norwegian (no) - Polish (pl) - Portugese (pt) +# Brazilian Portuguese (pt-BR) - Russian (ru) - Swedish (sv) +# Simplified Chinese (zh-CN) - Spanish (es) - Traditional Chinese (zh-TW) +# +AddLanguage ca .ca +AddLanguage cs .cz .cs +AddLanguage da .dk +AddLanguage de .de +AddLanguage el .el +AddLanguage en .en +AddLanguage eo .eo +AddLanguage es .es +AddLanguage et .et +AddLanguage fr .fr +AddLanguage he .he +AddLanguage hr .hr +AddLanguage it .it +AddLanguage ja .ja +AddLanguage ko .ko +AddLanguage ltz .ltz +AddLanguage nl .nl +AddLanguage nn .nn +AddLanguage no .no +AddLanguage pl .po +AddLanguage pt .pt +AddLanguage pt-BR .pt-br +AddLanguage ru .ru +AddLanguage sv .sv +AddLanguage zh-CN .zh-cn +AddLanguage zh-TW .zh-tw + +# +# LanguagePriority allows you to give precedence to some languages +# in case of a tie during content negotiation. +# +# Just list the languages in decreasing order of preference. We have +# more or less alphabetized them here. You probably want to change this. +# +LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW + +# +# ForceLanguagePriority allows you to serve a result page rather than +# MULTIPLE CHOICES (Prefer) [in case of a tie] or NOT ACCEPTABLE (Fallback) +# [in case no accepted languages matched the available variants] +# +ForceLanguagePriority Prefer Fallback + +# +# Commonly used filename extensions to character sets. You probably +# want to avoid clashes with the language extensions, unless you +# are good at carefully testing your setup after each change. +# See http://www.iana.org/assignments/character-sets for the +# official list of charset names and their respective RFCs. +# +AddCharset ISO-8859-1 .iso8859-1 .latin1 +AddCharset ISO-8859-2 .iso8859-2 .latin2 .cen +AddCharset ISO-8859-3 .iso8859-3 .latin3 +AddCharset ISO-8859-4 .iso8859-4 .latin4 +AddCharset ISO-8859-5 .iso8859-5 .latin5 .cyr .iso-ru +AddCharset ISO-8859-6 .iso8859-6 .latin6 .arb +AddCharset ISO-8859-7 .iso8859-7 .latin7 .grk +AddCharset ISO-8859-8 .iso8859-8 .latin8 .heb +AddCharset ISO-8859-9 .iso8859-9 .latin9 .trk +AddCharset ISO-2022-JP .iso2022-jp .jis +AddCharset ISO-2022-KR .iso2022-kr .kis +AddCharset ISO-2022-CN .iso2022-cn .cis +AddCharset Big5 .Big5 .big5 +# For russian, more than one charset is used (depends on client, mostly): +AddCharset WINDOWS-1251 .cp-1251 .win-1251 +AddCharset CP866 .cp866 +AddCharset KOI8-r .koi8-r .koi8-ru +AddCharset KOI8-ru .koi8-uk .ua +AddCharset ISO-10646-UCS-2 .ucs2 +AddCharset ISO-10646-UCS-4 .ucs4 +AddCharset UTF-8 .utf8 + +# The set below does not map to a specific (iso) standard +# but works on a fairly wide range of browsers. Note that +# capitalization actually matters (it should not, but it +# does for some browsers). +# +# See http://www.iana.org/assignments/character-sets +# for a list of sorts. But browsers support few. +# +AddCharset GB2312 .gb2312 .gb +AddCharset utf-7 .utf7 +AddCharset utf-8 .utf8 +AddCharset big5 .big5 .b5 +AddCharset EUC-TW .euc-tw +AddCharset EUC-JP .euc-jp +AddCharset EUC-KR .euc-kr +AddCharset shift_jis .sjis + +# +# AddType allows you to add to or override the MIME configuration +# file mime.types for specific file types. +# +#AddType application/x-tar .tgz +# +# AddEncoding allows you to have certain browsers uncompress +# information on the fly. Note: Not all browsers support this. +# Despite the name similarity, the following Add* directives have nothing +# to do with the FancyIndexing customization directives above. +# +#AddEncoding x-compress .Z +#AddEncoding x-gzip .gz .tgz +# +# If the AddEncoding directives above are commented-out, then you +# probably should define those extensions to indicate media types: +# +AddType application/x-compress .Z +AddType application/x-gzip .gz .tgz + +# +# AddHandler allows you to map certain file extensions to "handlers": +# actions unrelated to filetype. These can be either built into the server +# or added with the Action directive (see below) +# +# To use CGI scripts outside of ScriptAliased directories: +# (You will also need to add "ExecCGI" to the "Options" directive.) +# +AddHandler cgi-script .cgi + +# +# For files that include their own HTTP headers: +# +#AddHandler send-as-is asis + +# +# For server-parsed imagemap files: +# +#AddHandler imap-file map + +# +# For type maps (negotiated resources): +# (This is enabled by default to allow the Apache "It Worked" page +# to be distributed in multiple languages.) +# +AddHandler type-map var + +# +# Filters allow you to process content before it is sent to the client. +# +# To parse .shtml files for server-side includes (SSI): +# (You will also need to add "Includes" to the "Options" directive.) +# +#AddType text/html .shtml +#AddOutputFilter INCLUDES .shtml + +# +# Action lets you define media types that will execute a script whenever +# a matching file is called. This eliminates the need for repeated URL +# pathnames for oft-used CGI file processors. +# Format: Action media/type /cgi-script/location +# Format: Action handler-name /cgi-script/location +# + +# +# Customizable error responses come in three flavors: +# 1) plain text 2) local redirects 3) external redirects +# +# Some examples: +#ErrorDocument 500 "The server made a boo boo." +#ErrorDocument 404 /missing.html +#ErrorDocument 404 "/cgi-bin/missing_handler.pl" +#ErrorDocument 402 http://www.example.com/subscription_info.html +# + +# +# Putting this all together, we can internationalize error responses. +# +# We use Alias to redirect any /error/HTTP_<error>.html.var response to +# our collection of by-error message multi-language collections. We use +# includes to substitute the appropriate text. +# +# You can modify the messages' appearance without changing any of the +# default HTTP_<error>.html.var files by adding the line: +# +# Alias /error/include/ "/your/include/path/" +# +# which allows you to create your own set of files by starting with the +# /var/www/localhost/error/include files and copying them to /your/includepath/ +# even on a per-VirtualHost basis. The default include files will display +# your Apache version number and your ServerAdmin email address regardless +# of the setting of ServerSignature. +# +# The internationalized error documents require mod_alias, mod_include +# and mod_negotiation. To activate them, uncomment the following 30 lines. + +# Alias /error/ "/var/www/localhost/error/" +# +# <Directory "/var/www/localhost/error"> +# AllowOverride None +# Options IncludesNoExec +# AddOutputFilter Includes html +# AddHandler type-map var +# Order allow,deny +# Allow from all +# LanguagePriority en cs de es fr it nl sv pt-br ro +# ForceLanguagePriority Prefer Fallback +# </Directory> +# +# ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var +# ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var +# ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var +# ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var +# ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var +# ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var +# ErrorDocument 410 /error/HTTP_GONE.html.var +# ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var +# ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var +# ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var +# ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var +# ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var +# ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var +# ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var +# ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var +# ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var +# ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var + + +# +# The following directives modify normal HTTP response behavior to +# handle known problems with browser implementations. +# +BrowserMatch "Mozilla/2" nokeepalive +BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0 +BrowserMatch "RealPlayer 4\.0" force-response-1.0 +BrowserMatch "Java/1\.0" force-response-1.0 +BrowserMatch "JDK/1\.0" force-response-1.0 + +# +# The following directive disables redirects on non-GET requests for +# a directory that does not include the trailing slash. This fixes a +# problem with Microsoft WebFolders which does not appropriately handle +# redirects for folders with DAV methods. +# Same deal with Apple's DAV filesystem and Gnome VFS support for DAV. +# +BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully +BrowserMatch "MS FrontPage" redirect-carefully +BrowserMatch "^WebDrive" redirect-carefully +BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully +BrowserMatch "^gnome-vfs" redirect-carefully +BrowserMatch "^XML Spy" redirect-carefully +BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully + +# +# Allow server status reports generated by mod_status, +# with the URL of http://servername/server-status +# Change the ".example.com" to match your domain to enable. +# +<IfDefine INFO> + ExtendedStatus On + <Location /server-status> + SetHandler server-status + Order deny,allow + Deny from all + Allow from localhost + </Location> +</IfDefine> + +# +# Allow remote server configuration reports, with the URL of +# http://localhost/server-info (This is useful for debugging) +# +<IfDefine INFO> + <Location /server-info> + SetHandler server-info + Order deny,allow + Deny from all + Allow from localhost + </Location> +</IfDefine> + + +# +# Gentoo VHosts +# +# For Gentoo we include External Virtual Hosts Files. +# Please see vhosts.d/00_default_vhost.conf for the default virtual host. +# +Include /etc/apache2/vhosts.d/*.conf diff --git a/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf b/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf new file mode 100644 index 000000000..c97c30936 --- /dev/null +++ b/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf @@ -0,0 +1,37 @@ +# OCSP Server + +<VirtualHost *:8880> + ServerAdmin root@strongswan.org + DocumentRoot /etc/openssl/ocsp + ServerName ocsp.strongswan.org + ServerAlias 192.168.0.150 + <Directory "/etc/openssl/ocsp"> + Options +ExecCGI + </Directory> + ErrorLog /var/log/apache2/ocsp/error_log + CustomLog /var/log/apache2/ocsp/access_log combined +</VirtualHost> + +<VirtualHost *:8881> + ServerAdmin root@research.strongswan.org + DocumentRoot /etc/openssl/research/ocsp + ServerName ocsp.research.strongswan.org + ServerAlias ocsp.strongswan.org 192.168.0.150 + <Directory "/etc/openssl/research/ocsp"> + Options +ExecCGI + </Directory> + ErrorLog /var/log/apache2/ocsp/error_log + CustomLog /var/log/apache2/ocsp/access_log combined +</VirtualHost> + +<VirtualHost *:8882> + ServerAdmin root@sales.strongswan.org + DocumentRoot /etc/openssl/sales/ocsp + ServerName ocsp.sales.strongswan.org + ServerAlias ocsp.strongswan.org 192.168.0.150 + <Directory "/etc/openssl/sales/ocsp"> + Options +ExecCGI + </Directory> + ErrorLog /var/log/apache2/ocsp/error_log + CustomLog /var/log/apache2/ocsp/access_log combined +</VirtualHost> diff --git a/testing/hosts/winnetou/etc/openssl/index.txt b/testing/hosts/winnetou/etc/openssl/index.txt index 9e744674d..12025d75c 100644 --- a/testing/hosts/winnetou/etc/openssl/index.txt +++ b/testing/hosts/winnetou/etc/openssl/index.txt @@ -16,3 +16,4 @@ V 100620195806Z 0F unknown /C=CH/O=Linux strongSwan/OU=Research/CN=Research CA V 111007105811Z 10 unknown /C=CH/O=Linux strongSwan/OU=SHA-256/CN=moon.strongswan.org V 111007121250Z 11 unknown /C=CH/O=Linux strongSwan/OU=SHA-384/CN=carol@strongswan.org V 111007122112Z 12 unknown /C=CH/O=Linux strongSwan/OU=SHA-512/CN=dave@strongswan.org +V 120224075857Z 13 unknown /C=CH/O=Linux strongSwan/OU=OCSP/CN=carol@strongswan.org diff --git a/testing/hosts/winnetou/etc/openssl/index.txt.old b/testing/hosts/winnetou/etc/openssl/index.txt.old index 4d7201a35..9e744674d 100644 --- a/testing/hosts/winnetou/etc/openssl/index.txt.old +++ b/testing/hosts/winnetou/etc/openssl/index.txt.old @@ -15,3 +15,4 @@ V 100607191714Z 0E unknown /C=CH/O=Linux strongSwan/CN=winnetou.strongswan.org V 100620195806Z 0F unknown /C=CH/O=Linux strongSwan/OU=Research/CN=Research CA V 111007105811Z 10 unknown /C=CH/O=Linux strongSwan/OU=SHA-256/CN=moon.strongswan.org V 111007121250Z 11 unknown /C=CH/O=Linux strongSwan/OU=SHA-384/CN=carol@strongswan.org +V 111007122112Z 12 unknown /C=CH/O=Linux strongSwan/OU=SHA-512/CN=dave@strongswan.org diff --git a/testing/hosts/winnetou/etc/openssl/newcerts/13.pem b/testing/hosts/winnetou/etc/openssl/newcerts/13.pem new file mode 100644 index 000000000..aeca7e1db --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/newcerts/13.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEWzCCA0OgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA3MDIyNTA3NTg1N1oXDTEyMDIyNDA3NTg1N1owVjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDTALBgNVBAsTBE9DU1Ax +HTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5 +vVZX3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8 +G7M2uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J +5rRlvXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+Kdt +kkCRQYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0If +pPr/QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABo4IBQzCCAT8wCQYD +VR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDRTWKccFIi95BslK3U92mIQ +2rWGMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYD +VQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ry +b25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3YW4u +b3JnMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL29jc3Auc3Ry +b25nc3dhbi5vcmc6ODg4MDA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0 +cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAc +1bBYLYcc+js3UsHVk7W17Nr/qoNFzQZJ5Er3RjhNAgzAX1wOTrNgKXztwZde1Alj +o05ZLXUFkB4coQwl7xo7I3EMJPUmSdHoyYyG7c7AgfcL/wwnzz4rWQl74WIZjySc +ON0Ny9vrzbVboktYof/9Yp/+HgeKopfsaIiuNCAwmAWxiYqvDmlxxn16oOXeJFV8 +pFzZMirQ5l7QRD9iuabOdcnBp8ASH+5AbD4KjFQjo5RBVg92LwOkJo3Pf1twI57s +pObrcM4JbHVohDornYQYfr9ymkMxJbqqkEgD8oIip0NFSbziam4ZkwgUlRIMUMU1 +/xsH+BXYZtKJbYjlnyc8 +-----END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..cb585ed08 --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/hosts/winnetou/etc/openssl/ocspCert-self.pem b/testing/hosts/winnetou/etc/openssl/ocspCert-self.pem new file mode 100644 index 000000000..77f5bde52 --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/ocspCert-self.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEbjCCA1agAwIBAgIJALN2wqyLTIzfMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQ +IFNlbGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2Fu +Lm9yZzAeFw0wNzAzMTQxMjM0MDNaFw0xMjAzMTIxMjM0MDNaMGsxCzAJBgNVBAYT +AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQIFNl +bGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2FuLm9y +ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMgSOFeDdWxYKGPUSUhM +BFAELGmHKfg2R25aWlE8ju//I0ByaoIsm8BPapSiiiwTdho/JPP44/nvHcDQu828 +P3uY5XbSPZpiiBgFoo8BC2/Y/rxY/skjEzqoHEXjg/vO1bA0tqjVn5a0jpkai7pD +mUyBrmn1ArOjhR/HAupCHsIb7sAL+IEXByMcZQK6bvNL9PMTYI1T72+t/9cZAAEJ +DfEhyJZMxQKgmT1SNzLwyszy1M1HF95D59gBok4PaRWWsLdwzplfTKh61CeGCYqb +UP3qpMKrJ8Y7uv+e1vVzuYbJg5DR+bF1IGIc9QRyJlTkhZco+zTCQYxpvsNO18yr +4qcCAwEAAaOCARMwggEPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgECMB0GA1UdDgQW +BBQHqEiJbwUSQJDtrfhopkda0nXrLTCBnQYDVR0jBIGVMIGSgBQHqEiJbwUSQJDt +rfhopkda0nXrLaFvpG0wazELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0 +cm9uZ1N3YW4xIzAhBgNVBAsTGk9DU1AgU2VsZi1TaWduZWQgQXV0aG9yaXR5MRww +GgYDVQQDExNvY3NwLnN0cm9uZ3N3YW4ub3JnggkAs3bCrItMjN8wHgYDVR0RBBcw +FYITb2NzcC5zdHJvbmdzd2FuLm9yZzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN +BgkqhkiG9w0BAQUFAAOCAQEAi//I0DOlUXNHxzLuuxyr6k5gO55zMCmHUcVfjVFZ +9e+UpLLFZY+qbxOfzVLpKyDch6dKDIA/H+SzX1GZ+uW4FFQ1wYlHcK1Sio9hOgqI +zeWdY5uHF6iERVYgOU/xp0+0LS5l4ezCvOKVkYJEFWe2eyn9rd4PGLW4/lTQiK1V +14YzPyAhB7n8Sln5LBxAeY7U7Y8jEMLXZ+VF21mjH2sxZzWV/qWZdNWVUNaLZTYL +lTqyzqsk40v5BTrjSvAWHN+c1WzydMvatFDzghlPnvR8dufRN2bnlj10J8sizn+v +1iDtM6uYi8+Yn26yMGjCP+RYW+bwKQ927Gr43UkqqGsbCg== +-----END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/openssl/ocspKey-self.pem b/testing/hosts/winnetou/etc/openssl/ocspKey-self.pem new file mode 100644 index 000000000..1af5ecdb9 --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/ocspKey-self.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEAyBI4V4N1bFgoY9RJSEwEUAQsaYcp+DZHblpaUTyO7/8jQHJq +giybwE9qlKKKLBN2Gj8k8/jj+e8dwNC7zbw/e5jldtI9mmKIGAWijwELb9j+vFj+ +ySMTOqgcReOD+87VsDS2qNWflrSOmRqLukOZTIGuafUCs6OFH8cC6kIewhvuwAv4 +gRcHIxxlArpu80v08xNgjVPvb63/1xkAAQkN8SHIlkzFAqCZPVI3MvDKzPLUzUcX +3kPn2AGiTg9pFZawt3DOmV9MqHrUJ4YJiptQ/eqkwqsnxju6/57W9XO5hsmDkNH5 +sXUgYhz1BHImVOSFlyj7NMJBjGm+w07XzKvipwIDAQABAoIBABXLPk3yKQFjXQr6 +3fy9Ix8gRUI9kgnSx9cyinIc+akVDt7/V7DUcSbyv7ZvOkPw3sWfKURWUWcxb/lI +A502q2eoUR6vajx+DTsoqfuP7pIBfkZAH4kDhB24oFPQo9jzP/3Q0DD2DEtbYck1 +xhDFOlbGLZynLuMopeC/SgcAqt8UAIe5AHoUdkPUZH3MqJppH+PCjhkMzreaY9wc +mEh7tjKuItdGYt0ZmdrnQboyklMhOikn3nKOQWVINtzTLD4AsOcExPmO3m5j4m+n +h0AGDFyxUvY/l/DH2xC1C5qu13yumesJ1irURShdwO05nrWUzqT0BH4VyJCvcZiC +TnLhELkCgYEA6vmBxHXbh58VpJEfnXl8D01ZI7YgXHaNPb43j4GA26pd8JVYkPcQ +TBRZYRGEYL9CT7mfssJ6yie1ZLdGn+vkKyT2LWXxbO8kvfX5lG93sFmE1oauEuug +zau/eEh1k5fzlm6KClvFGnmMHqqxy0YMUVkAdT0Kb7PG36Bd9tDMLjsCgYEA2fkw +p8JVIAwyWF99iubxIL9sNnjJgq2j4Rj4zjtT45ZA1LCe7L1EGhQGsP/0u5u+miX6 +GdMSzwehHVBtTl/Gkg/IjWUQbL/jILeFQM2i6hdo8BCmi8k4f6ZF/Pf+m7ZRcLb/ +opJhvhhelnxfNwxHrshohCvGpGVGvSS8xtXzuoUCgYEAmxeuwHauPNkTFvk27eD2 +sr7x/DFFMOKLHVrFH3JyFAtiT96zg5OfbSftSrWeM6Fp6mdx8jKNi4skHmMeOYYg +px2RY6uq66T5Em0dnAzq6jpcBKEGmrRuAfK/wWvKN24POJajhGzIL05U3xT5n1sP +3E2rkLaGge4ecRJPkw6EBmsCgYBQWhL8lJ/Ku5RHjZP7A106JDag8e/e02HJFeqK +I8at6/KkNSOww6h6MI2y6/fsvOILcxp6MJwLY5WZ988DiDzsFRNqRCpE3Iu+wMhH +dkarIswVSx4KA7hnHgVI1qauAgyNj3g3Ft0fNV6Q/PIgmc9G+CvHJVgJvCfSi9tn +NPGu/QKBgExju7N5hrJUlfylwydp7X7jymHJGAac9J2+VhqWIhveCnTYrlwTcuJ6 +NqQDdBvDT0F+7fMxQ9wRglMadfnrwWh0Y7BGybzhlR4NDAAZk1GoxegWOR7HnacT +bbHir6keeWggJgWHsRew3Yxckzqvi+vn/v3MF/wfRijzXzSAenNl +-----END RSA PRIVATE KEY----- diff --git a/testing/hosts/winnetou/etc/openssl/openssl.cnf b/testing/hosts/winnetou/etc/openssl/openssl.cnf index dbe31abbd..165d8bbeb 100644 --- a/testing/hosts/winnetou/etc/openssl/openssl.cnf +++ b/testing/hosts/winnetou/etc/openssl/openssl.cnf @@ -43,7 +43,7 @@ crl_extensions = crl_ext # The extentions to add to the CRL default_days = 1825 # how long to certify for default_crl_days= 30 # how long before next CRL -default_md = md5 # which md to use. +default_md = sha1 # which md to use. preserve = no # keep passed DN ordering email_in_dn = no # allow/forbid EMail in DN @@ -146,7 +146,7 @@ keyUsage = digitalSignature, keyEncipherment, keyAgreement subjectKeyIdentifier = hash authorityKeyIdentifier = keyid, issuer:always subjectAltName = DNS:$ENV::COMMON_NAME -#extendedKeyUsage = OCSPSigner +#extendedKeyUsage = OCSPSigning crlDistributionPoints = URI:http://crl.strongswan.org/strongswan.crl #################################################################### @@ -158,6 +158,7 @@ keyUsage = digitalSignature, keyEncipherment, keyAgreemen subjectKeyIdentifier = hash authorityKeyIdentifier = keyid, issuer:always subjectAltName = email:$ENV::COMMON_NAME +#authorityInfoAccess = OCSP;URI:http://ocsp.strongswan.org:8880 crlDistributionPoints = URI:http://crl.strongswan.org/strongswan.crl #################################################################### diff --git a/testing/hosts/winnetou/etc/openssl/research/index.txt b/testing/hosts/winnetou/etc/openssl/research/index.txt index 4bd650072..2ccf6489c 100644 --- a/testing/hosts/winnetou/etc/openssl/research/index.txt +++ b/testing/hosts/winnetou/etc/openssl/research/index.txt @@ -1,2 +1,3 @@ V 100322070423Z 01 unknown /C=CH/O=Linux strongSwan/OU=Research/CN=carol@strongswan.org V 100615195710Z 02 unknown /C=CH/O=Linux strongSwan/OU=Sales/CN=Sales CA +V 120323210330Z 03 unknown /C=CH/O=Linux strongSwan/OU=Research OCSP Signing Authority/CN=ocsp.research.strongswan.org diff --git a/testing/hosts/winnetou/etc/openssl/research/index.txt.old b/testing/hosts/winnetou/etc/openssl/research/index.txt.old index 148bab7d6..4bd650072 100644 --- a/testing/hosts/winnetou/etc/openssl/research/index.txt.old +++ b/testing/hosts/winnetou/etc/openssl/research/index.txt.old @@ -1 +1,2 @@ V 100322070423Z 01 unknown /C=CH/O=Linux strongSwan/OU=Research/CN=carol@strongswan.org +V 100615195710Z 02 unknown /C=CH/O=Linux strongSwan/OU=Sales/CN=Sales CA diff --git a/testing/hosts/winnetou/etc/openssl/research/newcerts/03.pem b/testing/hosts/winnetou/etc/openssl/research/newcerts/03.pem new file mode 100644 index 000000000..279b4191d --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/research/newcerts/03.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEaDCCA1CgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjERMA8GA1UECxMIUmVzZWFyY2gxFDAS +BgNVBAMTC1Jlc2VhcmNoIENBMB4XDTA3MDMyNTIxMDMzMFoXDTEyMDMyMzIxMDMz +MFoweTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xKDAm +BgNVBAsTH1Jlc2VhcmNoIE9DU1AgU2lnbmluZyBBdXRob3JpdHkxJTAjBgNVBAMT +HG9jc3AucmVzZWFyY2guc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUA +A4IBDwAwggEKAoIBAQCuXf1wGjBk5wthfyJcNgYu5uVdK9fqB7k5Qswy76M2JjZ2 +ECv8JZMvGDC9ciKwEqL3QkN+E90RusdCqgabAl2K3AvbR4VOpaCdy31pdPaKfRXA +TazIH0GG8T/BImWTuweFt0XmsCl65ShoVul0DHWTli4jOAgHIj6eoYlQpRI6CbZs +qdcGZJRWzZMPa86Q3i2nKAsOiWh7jg04uLFsWu+2uBYmsPSbKqZe76FY5m+PgAwo +h0bFJI9qy4aryvNZiFT1+t3hd/wt/ZXnqYX4WsZcGlPOlKZoiDlmXzU1K1YY71io +HUiH7QOYBYY+8+Mc5kwt/ropYEbfLfAENC7WV+8tAgMBAAGjggEhMIIBHTAJBgNV +HRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU8xU4ukLOgkIafc7zHp5HlANw +5/4wbQYDVR0jBGYwZIAU53XwoPKtIM3NYCPMx8gPKfPdVCChSaRHMEUxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJv +bmdTd2FuIFJvb3QgQ0GCAQ8wJwYDVR0RBCAwHoIcb2NzcC5yZXNlYXJjaC5zdHJv +bmdzd2FuLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDCTA3BgNVHR8EMDAuMCygKqAo +hiZodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3JnL3Jlc2VhcmNoLmNybDANBgkqhkiG +9w0BAQUFAAOCAQEADH13ce0I8nXd5rjnDWck3JdBOgFMu2Wl8zpKIeLVYZnUc/Sn +l0sULX6AIdMzKVsPh78CgsQf4tggdVCdbTURMp3SdLO5TDNlqPVMnjHjajWR+C0D +4TQWnBz/bEg3aXGjjJlu00eXWx8kRLrOP/wMWba+SEwYDqANgmUgxpcBeg8/0Q78 +d7xEJPOPDXlO5Nh3zeVIXaDT+y2ENzgyTx9YGoAURxl5eTpBNI7dJm5fjXdGlbwj +1vO+UprMEU6rB9BDFSfyXaXcQoIgRr0oZqvAUS/cF9LQRf4iUXCpr8Th7Wddqi2r +qiwDZt4o+3EYtCcMEK9zKJK3KMZc9A9HPCE+RA== +-----END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi new file mode 100755 index 000000000..c193e8779 --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl/research + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/hosts/winnetou/etc/openssl/research/ocspCert.pem b/testing/hosts/winnetou/etc/openssl/research/ocspCert.pem new file mode 100644 index 000000000..279b4191d --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/research/ocspCert.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEaDCCA1CgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjERMA8GA1UECxMIUmVzZWFyY2gxFDAS +BgNVBAMTC1Jlc2VhcmNoIENBMB4XDTA3MDMyNTIxMDMzMFoXDTEyMDMyMzIxMDMz +MFoweTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xKDAm +BgNVBAsTH1Jlc2VhcmNoIE9DU1AgU2lnbmluZyBBdXRob3JpdHkxJTAjBgNVBAMT +HG9jc3AucmVzZWFyY2guc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUA +A4IBDwAwggEKAoIBAQCuXf1wGjBk5wthfyJcNgYu5uVdK9fqB7k5Qswy76M2JjZ2 +ECv8JZMvGDC9ciKwEqL3QkN+E90RusdCqgabAl2K3AvbR4VOpaCdy31pdPaKfRXA +TazIH0GG8T/BImWTuweFt0XmsCl65ShoVul0DHWTli4jOAgHIj6eoYlQpRI6CbZs +qdcGZJRWzZMPa86Q3i2nKAsOiWh7jg04uLFsWu+2uBYmsPSbKqZe76FY5m+PgAwo +h0bFJI9qy4aryvNZiFT1+t3hd/wt/ZXnqYX4WsZcGlPOlKZoiDlmXzU1K1YY71io +HUiH7QOYBYY+8+Mc5kwt/ropYEbfLfAENC7WV+8tAgMBAAGjggEhMIIBHTAJBgNV +HRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU8xU4ukLOgkIafc7zHp5HlANw +5/4wbQYDVR0jBGYwZIAU53XwoPKtIM3NYCPMx8gPKfPdVCChSaRHMEUxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJv +bmdTd2FuIFJvb3QgQ0GCAQ8wJwYDVR0RBCAwHoIcb2NzcC5yZXNlYXJjaC5zdHJv +bmdzd2FuLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDCTA3BgNVHR8EMDAuMCygKqAo +hiZodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3JnL3Jlc2VhcmNoLmNybDANBgkqhkiG +9w0BAQUFAAOCAQEADH13ce0I8nXd5rjnDWck3JdBOgFMu2Wl8zpKIeLVYZnUc/Sn +l0sULX6AIdMzKVsPh78CgsQf4tggdVCdbTURMp3SdLO5TDNlqPVMnjHjajWR+C0D +4TQWnBz/bEg3aXGjjJlu00eXWx8kRLrOP/wMWba+SEwYDqANgmUgxpcBeg8/0Q78 +d7xEJPOPDXlO5Nh3zeVIXaDT+y2ENzgyTx9YGoAURxl5eTpBNI7dJm5fjXdGlbwj +1vO+UprMEU6rB9BDFSfyXaXcQoIgRr0oZqvAUS/cF9LQRf4iUXCpr8Th7Wddqi2r +qiwDZt4o+3EYtCcMEK9zKJK3KMZc9A9HPCE+RA== +-----END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/openssl/research/ocspKey.pem b/testing/hosts/winnetou/etc/openssl/research/ocspKey.pem new file mode 100644 index 000000000..adbfe0f92 --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/research/ocspKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEArl39cBowZOcLYX8iXDYGLublXSvX6ge5OULMMu+jNiY2dhAr +/CWTLxgwvXIisBKi90JDfhPdEbrHQqoGmwJditwL20eFTqWgnct9aXT2in0VwE2s +yB9BhvE/wSJlk7sHhbdF5rApeuUoaFbpdAx1k5YuIzgIByI+nqGJUKUSOgm2bKnX +BmSUVs2TD2vOkN4tpygLDoloe44NOLixbFrvtrgWJrD0myqmXu+hWOZvj4AMKIdG +xSSPasuGq8rzWYhU9frd4Xf8Lf2V56mF+FrGXBpTzpSmaIg5Zl81NStWGO9YqB1I +h+0DmAWGPvPjHOZMLf66KWBG3y3wBDQu1lfvLQIDAQABAoIBAEx5LnknE0h9yJEH +GEPG8elKHRhC7VxX7NV/RV2lmjhahBI9v3zD4gyKmH3N/Aaq9cxpxH4cKh3nhBLp +zSHY5LvNDGossPuwSoRKRgOlZ6ePeqWvq3LNuoh7cFG9Sz2CjqcHnWGyq06aCKHS +VGswN7T17eBGZ8bxLvOVt0qmSxsmg2A2tmZQCAhc6IkEe3L4sqtS4N1y+8J1GSuu +KlIuT9NtReDiXXQNxr48QJeddj6RE+5xgInUEUGPUrOnv+lllxN42u0Yrqnnci7M +SNuxiCkYmvUm47zem3mUKrTJnr4uyKSVnzY5wKcbjebnjlaJmWefM6L7wTKYGbbF +KsXXwOUCgYEA5cXCD09Oeb888dwgvOaVgZqfJaCex2wZ2Wgu8dm3y2YcrNHbrj13 +PU+1fBp29AE4cNowUitL0rHPE232WyKPCsvEt4H/ioucWvXUc9rzNlo+2H4J6ZMI +4GQp2WXQZeqEAAI35qdcRwIDMRJdsDlg9fAwKAGJAYLhL4fZewmPb8cCgYEAwkU3 +ynMCj1XMvZzhPNS9bACD1euSLTopdAzlASX9bVnDGJ5/KeWl2PqJjrmV3LCjX/4t +WnGsP5bgv6IGVRpTcjeJSebF2kEA/pwYEZJezwh304JUqsqg4K4QF1ra5v3Wp06e +Y+sMdUphzTQFAvGzWTSQweSVlXHgrW+VWxdIEWsCgYApwL7b01h6TSMA/DRCv0/p +pjRHPSG9MUqdNA5bymlYn6yURuo5hlfVn1dmPtTg0Bv2fd+L/uwfVEpByJicxPHj +T1Xm1sud3HLEIKnDh8TsWofTBUw90ocpZ2onZBXzfyMPcVfBJSZijN4Rm7nEnRie +eE/35ReFW8gZwADoF7ul3wKBgELkXo+BBnKgUn0/lXbCse6MRtjT4mNcUYW6IuhA +UoDilYDWomakwnRx4Aea83UoBTk6ZhdsaKkEpKKXgaKwC+eaI9Wkdp/uHg+NY+Q5 +CBg1jDzx9YFRgA+dH8FK8XD0GoNFWNiCyKliUUa9ELSw0NZ4eReqQ69PpNNTRpQ0 +8gW9AoGBAIUpz52BrP0XcIEE+f9ONKGJq+cr1cRXDZlgHBE90GA/b5hfMiAmvaGm +SVdBXfUzIwEv6fHRqFjXsGqRI1qD6my69khnoObu3H+DR4Dsk/3iwxDMEpK63dfM +p2fp/wc8G/s/5YVQeAOW0NpPY7qyGDoXN5UcHfLjJw23gbkUJD58 +-----END RSA PRIVATE KEY----- diff --git a/testing/hosts/winnetou/etc/openssl/research/openssl.cnf b/testing/hosts/winnetou/etc/openssl/research/openssl.cnf index b5afd3d2e..706a52635 100644 --- a/testing/hosts/winnetou/etc/openssl/research/openssl.cnf +++ b/testing/hosts/winnetou/etc/openssl/research/openssl.cnf @@ -145,7 +145,7 @@ keyUsage = digitalSignature, keyEncipherment, keyAgreement subjectKeyIdentifier = hash authorityKeyIdentifier = keyid, issuer:always subjectAltName = DNS:$ENV::COMMON_NAME -#extendedKeyUsage = OCSPSigner +#extendedKeyUsage = OCSPSigning crlDistributionPoints = URI:http://crl.strongswan.org/research.crl #################################################################### diff --git a/testing/hosts/winnetou/etc/openssl/research/serial b/testing/hosts/winnetou/etc/openssl/research/serial index 75016ea36..64969239d 100644 --- a/testing/hosts/winnetou/etc/openssl/research/serial +++ b/testing/hosts/winnetou/etc/openssl/research/serial @@ -1 +1 @@ -03 +04 diff --git a/testing/hosts/winnetou/etc/openssl/research/serial.old b/testing/hosts/winnetou/etc/openssl/research/serial.old index 9e22bcb8e..75016ea36 100644 --- a/testing/hosts/winnetou/etc/openssl/research/serial.old +++ b/testing/hosts/winnetou/etc/openssl/research/serial.old @@ -1 +1 @@ -02 +03 diff --git a/testing/hosts/winnetou/etc/openssl/sales/index.txt b/testing/hosts/winnetou/etc/openssl/sales/index.txt index 5093b34e9..ab3c06416 100644 --- a/testing/hosts/winnetou/etc/openssl/sales/index.txt +++ b/testing/hosts/winnetou/etc/openssl/sales/index.txt @@ -1,2 +1,3 @@ V 100322071017Z 01 unknown /C=CH/O=Linux strongSwan/OU=Sales/CN=dave@strongswan.org V 100615195536Z 02 unknown /C=CH/O=Linux strongSwan/OU=Research/CN=Research CA +V 120323211811Z 03 unknown /C=CH/O=Linux strongSwan/OU=Sales OCSP Signing Authority/CN=ocsp.sales.strongswan.org diff --git a/testing/hosts/winnetou/etc/openssl/sales/index.txt.old b/testing/hosts/winnetou/etc/openssl/sales/index.txt.old index 7378ebb8a..5093b34e9 100644 --- a/testing/hosts/winnetou/etc/openssl/sales/index.txt.old +++ b/testing/hosts/winnetou/etc/openssl/sales/index.txt.old @@ -1 +1,2 @@ V 100322071017Z 01 unknown /C=CH/O=Linux strongSwan/OU=Sales/CN=dave@strongswan.org +V 100615195536Z 02 unknown /C=CH/O=Linux strongSwan/OU=Research/CN=Research CA diff --git a/testing/hosts/winnetou/etc/openssl/sales/newcerts/03.pem b/testing/hosts/winnetou/etc/openssl/sales/newcerts/03.pem new file mode 100644 index 000000000..ce2ff7b9d --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/sales/newcerts/03.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEVjCCAz6gAwIBAgIBAzANBgkqhkiG9w0BAQUFADBLMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEOMAwGA1UECxMFU2FsZXMxETAPBgNV +BAMTCFNhbGVzIENBMB4XDTA3MDMyNTIxMTgxMVoXDTEyMDMyMzIxMTgxMVowczEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xJTAjBgNVBAsT +HFNhbGVzIE9DU1AgU2lnbmluZyBBdXRob3JpdHkxIjAgBgNVBAMTGW9jc3Auc2Fs +ZXMuc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB +AQDGgB20WTzEVUNGDU/iwxN/eybmYAQ2rUytxoyKUHoN8Q7tATg7bwH3HrMdc5JV +AA4uiWFdrNw7GGu+QJVrYi+7jdt76ffcck6eQjLmmVsGp4T16U900ZzFh6zLnhs9 +K/Sw8yiGMQcYncblST4Sl3Yd6XdiY/fZHscsbFjxVpPGxwebZPPirukeWDFLUwVO +yc5A7pdqNlvmfy5tiO5Ds8hQMQyVqpmlDYwTQz3yZS2+X4In8GrgvBnUZ/etGzq8 +N+309wX/g2WvcKYDpWLqu3KxkwL+QTTYhIM6NvQXtPGCf3M5yBtoNqPzgIqXveuT +oMwJwF+uDZddBWjAeI1G+J8BAgMBAAGjggEbMIIBFzAJBgNVHRMEAjAAMAsGA1Ud +DwQEAwIDqDAdBgNVHQ4EFgQUY33heVHJfDUOz5Va8B1VPepgam4wbQYDVR0jBGYw +ZIAUX5sTRvkgcsgA1Yi1p0wul+oLkyihSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD +VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg +Q0GCAQ0wJAYDVR0RBB0wG4IZb2NzcC5zYWxlcy5zdHJvbmdzd2FuLm9yZzATBgNV +HSUEDDAKBggrBgEFBQcDCTA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnN0 +cm9uZ3N3YW4ub3JnL3NhbGVzLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAXvU0ucW8 +DUgNkNdzIYtL48d44e+vDRuVZ6BmuovHqZuuWXfmxtM0q8zPUgrtXwX50nhVg8Y3 +csLLa4o7WOmDTMftvzuh9+T9CV8WIX6vioI7zS550ZwUwB0V08JTfrCiRaCql7Eg +pDEZDfKXJCaq+I/FAH1Q03vXsDk+wTtJSeqoWCt7IiEYePwFLQ0ANjPhK6BbbcyH +XkqZE2hYmroGele+UGwflRL9CP6F8UTFdg2LefeiZmZiSkgO2a0i4ik0ShQAPyIl +is5KBiKuvsqkbMTCxdk0gdRqcTF0YUHcOCY0gHMiApsNC157fokP0Mg6rBDRCJkH +kiJdzc42Apd8uw== +-----END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi new file mode 100755 index 000000000..c53cb9a76 --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl/sales + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocspCert.pem b/testing/hosts/winnetou/etc/openssl/sales/ocspCert.pem new file mode 100644 index 000000000..ce2ff7b9d --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/sales/ocspCert.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEVjCCAz6gAwIBAgIBAzANBgkqhkiG9w0BAQUFADBLMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEOMAwGA1UECxMFU2FsZXMxETAPBgNV +BAMTCFNhbGVzIENBMB4XDTA3MDMyNTIxMTgxMVoXDTEyMDMyMzIxMTgxMVowczEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xJTAjBgNVBAsT +HFNhbGVzIE9DU1AgU2lnbmluZyBBdXRob3JpdHkxIjAgBgNVBAMTGW9jc3Auc2Fs +ZXMuc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB +AQDGgB20WTzEVUNGDU/iwxN/eybmYAQ2rUytxoyKUHoN8Q7tATg7bwH3HrMdc5JV +AA4uiWFdrNw7GGu+QJVrYi+7jdt76ffcck6eQjLmmVsGp4T16U900ZzFh6zLnhs9 +K/Sw8yiGMQcYncblST4Sl3Yd6XdiY/fZHscsbFjxVpPGxwebZPPirukeWDFLUwVO +yc5A7pdqNlvmfy5tiO5Ds8hQMQyVqpmlDYwTQz3yZS2+X4In8GrgvBnUZ/etGzq8 +N+309wX/g2WvcKYDpWLqu3KxkwL+QTTYhIM6NvQXtPGCf3M5yBtoNqPzgIqXveuT +oMwJwF+uDZddBWjAeI1G+J8BAgMBAAGjggEbMIIBFzAJBgNVHRMEAjAAMAsGA1Ud +DwQEAwIDqDAdBgNVHQ4EFgQUY33heVHJfDUOz5Va8B1VPepgam4wbQYDVR0jBGYw +ZIAUX5sTRvkgcsgA1Yi1p0wul+oLkyihSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD +VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg +Q0GCAQ0wJAYDVR0RBB0wG4IZb2NzcC5zYWxlcy5zdHJvbmdzd2FuLm9yZzATBgNV +HSUEDDAKBggrBgEFBQcDCTA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnN0 +cm9uZ3N3YW4ub3JnL3NhbGVzLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAXvU0ucW8 +DUgNkNdzIYtL48d44e+vDRuVZ6BmuovHqZuuWXfmxtM0q8zPUgrtXwX50nhVg8Y3 +csLLa4o7WOmDTMftvzuh9+T9CV8WIX6vioI7zS550ZwUwB0V08JTfrCiRaCql7Eg +pDEZDfKXJCaq+I/FAH1Q03vXsDk+wTtJSeqoWCt7IiEYePwFLQ0ANjPhK6BbbcyH +XkqZE2hYmroGele+UGwflRL9CP6F8UTFdg2LefeiZmZiSkgO2a0i4ik0ShQAPyIl +is5KBiKuvsqkbMTCxdk0gdRqcTF0YUHcOCY0gHMiApsNC157fokP0Mg6rBDRCJkH +kiJdzc42Apd8uw== +-----END CERTIFICATE----- diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocspKey.pem b/testing/hosts/winnetou/etc/openssl/sales/ocspKey.pem new file mode 100644 index 000000000..5d10a3467 --- /dev/null +++ b/testing/hosts/winnetou/etc/openssl/sales/ocspKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAxoAdtFk8xFVDRg1P4sMTf3sm5mAENq1MrcaMilB6DfEO7QE4 +O28B9x6zHXOSVQAOLolhXazcOxhrvkCVa2Ivu43be+n33HJOnkIy5plbBqeE9elP +dNGcxYesy54bPSv0sPMohjEHGJ3G5Uk+Epd2Hel3YmP32R7HLGxY8VaTxscHm2Tz +4q7pHlgxS1MFTsnOQO6XajZb5n8ubYjuQ7PIUDEMlaqZpQ2ME0M98mUtvl+CJ/Bq +4LwZ1Gf3rRs6vDft9PcF/4Nlr3CmA6Vi6rtysZMC/kE02ISDOjb0F7Txgn9zOcgb +aDaj84CKl73rk6DMCcBfrg2XXQVowHiNRvifAQIDAQABAoIBAQCUOZL02zYfPbPw +mXwvzo++wA16NfSvh5UcpojHt/SMeJc2r5R3/Rqwl8IUmfqJcnMkmP2V38DMeB3s +gXmSKE2QdguRalLl0I2Ya8Jqo9VvEKSepMvqZaP1dKy5l6SrdylPASQfoHi2Dws4 +qAqsA2H2UCIP3Kp0/SCpsXZxML9EzIWtYtvrqJ0p0EI9ZzEn5uFok91qTYqD9c3T +v142OyfmHlwICLy7UlFkmawrV4PIIP2RGTRgr2b16Vis7mAkRC7blsFXUEBb8hwE +SmISdZYXc+NCesonXYGeRhln8PPLI3/T+HHH8G2eFhyQISHgE0CbjK+zvFcAddvD +BbeceDPhAoGBAOkXwIklHvzSj4QoCi572QNkNIkxlIa6PL3I2ygJczeB1vj9kvVc +CV2onhvBL3FGy0BJrQI7UBySW59/GdSs+WJFQWlIwI9QglDS8itAQK6+9zeyg69U +NbGw784NGn5cP3F4P3QCGEUg5Oj8t0iE8gKbljz6rlSjO5uhXYOYf0rtAoGBANoC +E0noRtG4QloEbIiHjLbnNAjabOO9KNm9FLZZFnGvTHQ1690i+GBOXC/cbP3jo6tz +07+Ob/+IKhXhEj9opGu8ZvEfarHmBEWxj6TdvFmlaHEcEFD0LqGu5ssSfW3S3AEB +Z3rBLkEeJYUYQqCU+vgZHEbrLWeBt33AIeB1nN3lAoGAL0LJnwUPy2NGBh24MsSZ +s75ViJus6cRJHJHlHbEM02xYEhQX//exTnQp2qbI38bi3x4RHiq4i5KBUU2MBzsr +NWmlYZuGr4g7Y/fhcjOM6eF+bqSbXqlMWcLuXHD7tjMuCeu/sd3a3elVgIf9AY8z +IqQ5ShPp1O9j3qJRO6Vn6eECgYBIu9KFoOonxArXD4zKTDcFOsPghEc5//0mD/Be +GgDj8vFWADtt7uHg96PIEAmI9y6+4Ajwauww29P2sr2szBO3IgdSQQIO0kfwnJnp +DlVtr0LWId/LsnvwU3MKo2OXhXcDGt3UValB7nXkHsDz5GCK743Al2vxkZSPbs+e +nH62hQKBgQC8AouEwXXXQD8+MnW+qcIbaAzVMirc94sI3fQH1AnfiZHH6aMCOh/4 +xoh/RzylotQlOk1xjCOB4O/Hhd+MAnlH9ZawCnRdvB/4usxd4j2AYr0Np7Q+VUyx +EFejvkdm20j1dh29jfSbiXHd2RCoFimX0Dr3weiRqffqi9aV2tdqLQ== +-----END RSA PRIVATE KEY----- diff --git a/testing/hosts/winnetou/etc/openssl/sales/openssl.cnf b/testing/hosts/winnetou/etc/openssl/sales/openssl.cnf index adb204bc2..687956d60 100644 --- a/testing/hosts/winnetou/etc/openssl/sales/openssl.cnf +++ b/testing/hosts/winnetou/etc/openssl/sales/openssl.cnf @@ -145,7 +145,7 @@ keyUsage = digitalSignature, keyEncipherment, keyAgreement subjectKeyIdentifier = hash authorityKeyIdentifier = keyid, issuer:always subjectAltName = DNS:$ENV::COMMON_NAME -#extendedKeyUsage = OCSPSigner +#extendedKeyUsage = OCSPSigning crlDistributionPoints = URI:http://crl.strongswan.org/sales.crl #################################################################### diff --git a/testing/hosts/winnetou/etc/openssl/sales/serial b/testing/hosts/winnetou/etc/openssl/sales/serial index 75016ea36..64969239d 100644 --- a/testing/hosts/winnetou/etc/openssl/sales/serial +++ b/testing/hosts/winnetou/etc/openssl/sales/serial @@ -1 +1 @@ -03 +04 diff --git a/testing/hosts/winnetou/etc/openssl/sales/serial.old b/testing/hosts/winnetou/etc/openssl/sales/serial.old index 9e22bcb8e..75016ea36 100644 --- a/testing/hosts/winnetou/etc/openssl/sales/serial.old +++ b/testing/hosts/winnetou/etc/openssl/sales/serial.old @@ -1 +1 @@ -02 +03 diff --git a/testing/hosts/winnetou/etc/openssl/serial b/testing/hosts/winnetou/etc/openssl/serial index b1bd38b62..8351c1939 100644 --- a/testing/hosts/winnetou/etc/openssl/serial +++ b/testing/hosts/winnetou/etc/openssl/serial @@ -1 +1 @@ -13 +14 diff --git a/testing/hosts/winnetou/etc/openssl/serial.old b/testing/hosts/winnetou/etc/openssl/serial.old index 48082f72f..b1bd38b62 100644 --- a/testing/hosts/winnetou/etc/openssl/serial.old +++ b/testing/hosts/winnetou/etc/openssl/serial.old @@ -1 +1 @@ -12 +13 diff --git a/testing/hosts/winnetou/etc/openssl/start-ocsp b/testing/hosts/winnetou/etc/openssl/start-ocsp deleted file mode 100755 index bdc5dab38..000000000 --- a/testing/hosts/winnetou/etc/openssl/start-ocsp +++ /dev/null @@ -1,20 +0,0 @@ -#! /bin/sh -# start an OpenSSL-based OCSP server -# -# Copyright (C) 2004 Andreas Steffen -# Zuercher Hochschule Winterthur -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. -# -# RCSID $Id: start-ocsp,v 1.3 2005/01/01 18:12:14 as Exp $ - -cd /etc/openssl -openssl ocsp -index index.txt -CA strongswanCert.pem -port 8880 -rkey ocspKey.pem -rsigner ocspCert.pem -nmin 5 < /dev/null > /dev/null 2>&1 & diff --git a/testing/scripts/build-hostconfig b/testing/scripts/build-hostconfig index 28b321a70..1dd268719 100755 --- a/testing/scripts/build-hostconfig +++ b/testing/scripts/build-hostconfig @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: build-hostconfig,v 1.4 2006/10/19 21:38:45 as Exp $ +# RCSID $Id: build-hostconfig,v 1.3 2005/02/08 10:40:48 as Exp $ DIR=`dirname $0` diff --git a/testing/scripts/build-sshkeys b/testing/scripts/build-sshkeys index 2faa3963d..23f62e005 100755 --- a/testing/scripts/build-sshkeys +++ b/testing/scripts/build-sshkeys @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: build-sshkeys,v 1.3 2006/10/19 21:38:45 as Exp $ +# RCSID $Id: build-sshkeys,v 1.2 2005/02/15 14:12:16 as Exp $ DIR=`dirname $0` diff --git a/testing/scripts/build-umlhostfs b/testing/scripts/build-umlhostfs index e77bfc025..69ad9fe02 100755 --- a/testing/scripts/build-umlhostfs +++ b/testing/scripts/build-umlhostfs @@ -68,6 +68,7 @@ do cp -rfp $BUILDDIR/hosts/${host}/etc $LOOPDIR if [ "$host" = "winnetou" ] then + mkdir $LOOPDIR/var/log/apache2/ocsp cp -rfp $UMLTESTDIR/testing/images $LOOPDIR/var/www/localhost/htdocs chroot $LOOPDIR /etc/openssl/generate-crl >> $LOGFILE 2>&1 fi diff --git a/testing/scripts/build-umlrootfs b/testing/scripts/build-umlrootfs index 1d534c81b..f839e3e8e 100755 --- a/testing/scripts/build-umlrootfs +++ b/testing/scripts/build-umlrootfs @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: build-umlrootfs,v 1.12 2006/10/20 14:26:05 as Exp $ +# RCSID $Id: build-umlrootfs,v 1.11 2006/01/08 22:29:56 as Exp $ DIR=`dirname $0` @@ -89,7 +89,6 @@ mount -o loop gentoo-fs $LOOPDIR >> $LOGFILE 2>&1 tar xjpf $ROOTFS -C $LOOPDIR >> $LOGFILE 2>&1 cecho "done" - ###################################################### # remove /etc/resolv.conf # @@ -102,14 +101,21 @@ rm -f $LOOPDIR/etc/resolv.conf cecho " * Copying '$HOSTCONFIGDIR/default/etc/hosts' to the root filesystem" cp -fp $HOSTCONFIGDIR/default/etc/hosts $LOOPDIR/etc/hosts -# ##################################################### # extracting strongSwan into the root filesystem # - cecho " * Extracting strongSwan into the root filesystem" tar xjf $STRONGSWAN -C $LOOPDIR/root >> $LOGFILE 2>&1 +###################################################### +# setting up mountpoint for shared source tree +# +if [ "${SHAREDTREE+set}" = "set" ]; then + cecho " * setting up shared strongswan tree at '$SHAREDTREE'" + mkdir $LOOPDIR/root/strongswan-shared + echo "" >> $LOOPDIR/etc/fstab + echo "none /root/strongswan-shared hostfs $SHAREDTREE" >> $LOOPDIR/etc/fstab +fi ###################################################### # installing strongSwan and setting the local timezone @@ -120,20 +126,27 @@ INSTALLSHELL=${LOOPDIR}/install.sh cecho " * Preparing strongSwan installation script" echo "ln -sf /usr/share/zoneinfo/${TZUML} /etc/localtime" >> $INSTALLSHELL +echo "cd /root/${STRONGSWANVERSION}" >> $INSTALLSHELL +echo -n "./configure --sysconfdir=/etc" >> $INSTALLSHELL +echo -n " --with-random-device=/dev/urandom" >> $INSTALLSHELL if [ "$USE_LIBCURL" = "yes" ] then - echo "export USE_LIBCURL=true" >> $INSTALLSHELL + echo -n " --enable-http" >> $INSTALLSHELL fi if [ "$USE_LDAP" = "yes" ] then - echo "export USE_LDAP=true" >> $INSTALLSHELL + echo -n " --enable-ldap" >> $INSTALLSHELL fi -echo "export USERCOMPILE=\'-DRANDOM_DEVICE=\\\"/dev/urandom\\\"\'" >> $INSTALLSHELL -echo "cd /root/${STRONGSWANVERSION}" >> $INSTALLSHELL -echo "make programs" >> $INSTALLSHELL +if [ "$USE_LEAK_DETECTIVE" = "yes" ] +then + echo -n " --enable-leak-detective" >> $INSTALLSHELL +fi +echo "" >> $INSTALLSHELL +echo "make" >> $INSTALLSHELL echo "make install" >> $INSTALLSHELL +echo "ldconfig" >> $INSTALLSHELL cecho-n " * Compiling $STRONGSWANVERSION within the root file system as chroot.." chroot $LOOPDIR /bin/bash /install.sh >> $LOGFILE 2>&1 @@ -159,7 +172,7 @@ cp $LOOPDIR/etc/ssh/ssh_host_rsa_key $LOOPDIR/root/.ssh/id_rsa for host in $STRONGSWANHOSTS do - eval ip="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" + eval ip="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F- '{ print $1 }' | awk '{ print $1 }'`" echo "$host,$ip `cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub`" >> $LOOPDIR/root/.ssh/known_hosts echo "`cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub` root@$host" >> $LOOPDIR/root/.ssh/authorized_keys done diff --git a/testing/scripts/install-shared b/testing/scripts/install-shared new file mode 100755 index 000000000..4cfac9e77 --- /dev/null +++ b/testing/scripts/install-shared @@ -0,0 +1,38 @@ +#!/bin/bash +# Install strongSwan from mounted strongswan-shared tree +# +# Copyright (C) 2006 Martin Willi +# Hochschule fuer Technik Rapperswil +# Copyright (C) 2004 Eric Marchionni, Patrik Rayo +# Zuercher Hochschule Winterthur +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. +# + +DIR=`dirname $0` + +source $DIR/function.sh + +[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" + +source $DIR/../testing.conf + +cecho "installing strongSwan from shared tree" +cecho-n " on: " + +for host in $STRONGSWANHOSTS +do + eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" + cecho-n "$host... " + ssh $HOSTLOGIN 'cd ~/strongswan-shared && make install' > /dev/null +done + +cecho diff --git a/testing/scripts/kstart-umls b/testing/scripts/kstart-umls index 21baee52c..8379438c8 100755 --- a/testing/scripts/kstart-umls +++ b/testing/scripts/kstart-umls @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: kstart-umls,v 1.7 2007/01/11 20:32:01 as Exp $ +# RCSID $Id: kstart-umls,v 1.6 2005/08/30 22:13:12 as Exp $ DIR=`dirname $0` diff --git a/testing/scripts/load-testconfig b/testing/scripts/load-testconfig index 9c0477e54..6558018c2 100755 --- a/testing/scripts/load-testconfig +++ b/testing/scripts/load-testconfig @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: load-testconfig,v 1.3 2006/10/19 21:38:45 as Exp $ +# RCSID $Id: load-testconfig,v 1.2 2004/12/13 21:02:42 as Exp $ DIR=`dirname $0` @@ -53,12 +53,12 @@ fi ########################################################################## -# clear the auth.log where IKE messages are logged +# clear auth.log and daemon.log where IKE messages are logged # for host in $IPSECHOSTS do eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - ssh $HOSTLOGIN 'rm -f /var/log/auth.log; \ + ssh $HOSTLOGIN 'rm -f /var/log/auth.log /var/log/daemon.log; \ kill -SIGHUP `cat /var/run/syslogd.pid`' > /dev/null 2>&1 done diff --git a/testing/scripts/restore-defaults b/testing/scripts/restore-defaults index 03f723e82..b1dae1ea2 100755 --- a/testing/scripts/restore-defaults +++ b/testing/scripts/restore-defaults @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: restore-defaults,v 1.3 2006/10/19 21:40:27 as Exp $ +# RCSID $Id: restore-defaults,v 1.2 2004/12/20 07:56:33 as Exp $ DIR=`dirname $0` diff --git a/testing/scripts/shutdown-umls b/testing/scripts/shutdown-umls new file mode 100755 index 000000000..e71e46602 --- /dev/null +++ b/testing/scripts/shutdown-umls @@ -0,0 +1,38 @@ +#!/bin/bash +# Install strongSwan from mounted strongswan-shared tree +# +# Copyright (C) 2006 Martin Willi +# Hochschule fuer Technik Rapperswil +# Copyright (C) 2004 Eric Marchionni, Patrik Rayo +# Zuercher Hochschule Winterthur +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. +# + +DIR=`dirname $0` + +source $DIR/function.sh + +[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found" + +source $DIR/../testing.conf + +cecho "shutting down" +cecho-n " " + +for host in $STRONGSWANHOSTS +do + eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" + cecho-n "$host... " + ssh $HOSTLOGIN 'shutdown now -h' > /dev/null +done + +cecho diff --git a/testing/scripts/start-switches b/testing/scripts/start-switches index c90c9f86d..82433babe 100755 --- a/testing/scripts/start-switches +++ b/testing/scripts/start-switches @@ -31,7 +31,7 @@ do cecho " * Great, umlswitch$n is already running!" else cecho-n " * Starting umlswitch$n.." - uml_switch -tap tap$n -unix /tmp/umlswitch$n >/dev/null </dev/null & + uml_switch -hub -tap tap$n -unix /tmp/umlswitch$n >/dev/null </dev/null & sleep 2 eval ifconfig "tap$n \$IFCONFIG_$n up" cecho "done" diff --git a/testing/scripts/start-umls b/testing/scripts/start-umls index 89d9e0d81..1b875a696 100755 --- a/testing/scripts/start-umls +++ b/testing/scripts/start-umls @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: start-umls,v 1.6 2007/01/11 20:32:01 as Exp $ +# RCSID $Id: start-umls,v 1.5 2005/08/30 22:13:12 as Exp $ DIR=`dirname $0` diff --git a/testing/scripts/xstart-umls b/testing/scripts/xstart-umls index 5983d405f..9efbd1497 100755 --- a/testing/scripts/xstart-umls +++ b/testing/scripts/xstart-umls @@ -14,7 +14,7 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: xstart-umls,v 1.7 2007/01/11 20:32:01 as Exp $ +# RCSID $Id: xstart-umls,v 1.6 2005/08/30 22:13:12 as Exp $ DIR=`dirname $0` diff --git a/testing/start-testing b/testing/start-testing index 375a82be5..28f9c3bf5 100755 --- a/testing/start-testing +++ b/testing/start-testing @@ -47,6 +47,10 @@ case $UMLSTARTMODE in cecho "Start the uml instances (scripts/kstart-umls)" $DIR/scripts/kstart-umls $HOSTS ;; + gnome-terminal) + cecho "Start the uml instances (scripts/gstart-umls)" + $DIR/scripts/gstart-umls $HOSTS + ;; xterm) cecho "Start the uml instances (scripts/xstart-umls)" $DIR/scripts/xstart-umls $HOSTS diff --git a/testing/testing.conf b/testing/testing.conf index 32169d985..d4d6767c9 100755 --- a/testing/testing.conf +++ b/testing/testing.conf @@ -14,14 +14,14 @@ # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # -# RCSID $Id: testing.conf,v 1.60 2007/02/21 22:17:52 as Exp $ +# RCSID $Id: testing.conf,v 1.52 2006/04/24 16:58:03 as Exp $ # Root directory of testing -UMLTESTDIR=~/strongswan-testing +UMLTESTDIR=/home/strongswan-testing # Bzipped kernel sources # (file extension .tar.bz2 required) -KERNEL=$UMLTESTDIR/linux-2.6.20.1.tar.bz2 +KERNEL=$UMLTESTDIR/linux-2.6.20.3.tar.bz2 # Extract kernel version KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'` @@ -30,15 +30,15 @@ KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'` KERNELCONFIG=$UMLTESTDIR/.config-2.6.20 # Bzipped uml patch for kernel -# (not needed anymore for 2.6.9 kernel or higher) UMLPATCH=$UMLTESTDIR/uml_jmpbuf-2.6.18.patch.bz2 # Bzipped source of strongSwan -STRONGSWAN=$UMLTESTDIR/strongswan-2.8.3.tar.bz2 +STRONGSWAN=$UMLTESTDIR/strongswan-4.1.0.tar.bz2 # strongSwan compile options (use "yes" or "no") USE_LIBCURL="yes" USE_LDAP="yes" +USE_LEAK_DETECTIVE="no" # Gentoo linux root filesystem ROOTFS=$UMLTESTDIR/gentoo-fs-20061006.tar.bz2 @@ -49,17 +49,22 @@ ROOTFSSIZE=544 # Amount of Memory to use per UML [MB]. # If "auto" is stated 1/12 of total host ram will be used. # Examples: MEM=64, MEM="128", MEM="auto" -MEM=64 +MEM=96 # Directory where the UML kernels and file system will be built BUILDDIR=$UMLTESTDIR/umlbuild # Filename of the built UML Kernel -UMLKERNEL=$BUILDDIR/linux-uml-$KERNELVERSION +UMLKERNEL=$UMLTESTDIR/linux # Directory where test results will be stored TESTRESULTSDIR=$UMLTESTDIR/testresults +# Path to a full strongswan tree on the host system, which is +# mounted into /root/strongswan-shared. This gives us an easy +# way to apply and test changes instantly. +SHAREDTREE=/home/martin/strongswan/trunk + # Timezone for the UMLs, look in /usr/share/zoneinfo! TZUML="Europe/Zurich" @@ -67,22 +72,22 @@ TZUML="Europe/Zurich" # Enable particular steps in the make-testing and # start-testing scripts # -ENABLE_BUILD_UMLKERNEL="yes" +ENABLE_BUILD_UMLKERNEL="no" ENABLE_BUILD_SSHKEYS="yes" ENABLE_BUILD_HOSTCONFIG="yes" ENABLE_BUILD_UMLROOTFS="yes" ENABLE_BUILD_UMLHOSTFS="yes" -ENABLE_START_TESTING="yes" -ENABLE_DO_TESTS="yes" +ENABLE_START_TESTING="no" +ENABLE_DO_TESTS="no" ENABLE_STOP_TESTING="no" ############################################################## # How to start the UMLs? # # Start the UML instance in KDE konsole (requires KDE) -UMLSTARTMODE="konsole" +#UMLSTARTMODE="gnome-terminal" # Start the UML instance in an xterm (requires X11R6) -# UMLSTARTMODE="xterm" +UMLSTARTMODE="xterm" # Start the UML instance without a terminal window # but screen -r <host> can open a window anytime # UMLSTARTMODE="screen" @@ -95,7 +100,7 @@ SELECTEDTESTSONLY="no" # Tests to do if $SELECTEDTESTSONLY is set "yes". # -SELECTEDTESTS="net2net-cert" +SELECTEDTESTS="ikev2-net2net ikev2-rw" ############################################################## # hostname and corresponding IPv4 and IPv6 addresses @@ -158,3 +163,7 @@ SWITCH_dave="eth0=daemon,fe:fd:c0:a8:00:c8,unix,/tmp/umlswitch0" SWITCH_sun="eth0=daemon,fe:fd:c0:a8:00:02,unix,/tmp/umlswitch0 \ eth1=daemon,fe:fd:0a:02:00:01,unix,/tmp/umlswitch2" SWITCH_bob="eth0=daemon,fe:fd:0a:02:00:0a,unix,/tmp/umlswitch2" + + + + diff --git a/testing/tests/compress/hosts/carol/etc/ipsec.conf b/testing/tests/compress/hosts/carol/etc/ipsec.conf deleted file mode 100755 index 9462ba5e6..000000000 --- a/testing/tests/compress/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,25 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug="control crypt" - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - compress=yes - -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add diff --git a/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf deleted file mode 100755 index ae8d2b772..000000000 --- a/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,25 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - ike=3des-sha - esp=3des-sha1 -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add diff --git a/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf deleted file mode 100755 index ae8d2b772..000000000 --- a/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,25 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - ike=3des-sha - esp=3des-sha1 -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add diff --git a/testing/tests/ike/rw-cert/description.txt b/testing/tests/ike/rw-cert/description.txt new file mode 100644 index 000000000..b48a89026 --- /dev/null +++ b/testing/tests/ike/rw-cert/description.txt @@ -0,0 +1,5 @@ +Roadwarrior <b>carol</b> sets up an IKEv1 connection and roadwarrior <b>dave</b> +an IKEv2 tunnel, respectively, to the gateway <b>moon</b>. +In order to test the established tunnels, both roadwarriors ping the client <b>alice</b> +in the subnet behind gateway <b>moon</b>. +. diff --git a/testing/tests/ike/rw-cert/evaltest.dat b/testing/tests/ike/rw-cert/evaltest.dat new file mode 100644 index 000000000..71496d2f2 --- /dev/null +++ b/testing/tests/ike/rw-cert/evaltest.dat @@ -0,0 +1,11 @@ +moon::ipsec statusall::rw.*STATE_QUICK_R2.*IPsec SA established::YES +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*STATE_QUICK_I2.*IPsec SA established::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..5d78605e9 --- /dev/null +++ b/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..841a67491 --- /dev/null +++ b/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ike/rw-cert/posttest.dat index ed530f6d9..ed530f6d9 100644 --- a/testing/tests/rw-psk-rsa-mixed/posttest.dat +++ b/testing/tests/ike/rw-cert/posttest.dat diff --git a/testing/tests/ike/rw-cert/pretest.dat b/testing/tests/ike/rw-cert/pretest.dat new file mode 100644 index 000000000..587b6aeed --- /dev/null +++ b/testing/tests/ike/rw-cert/pretest.dat @@ -0,0 +1,8 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home +dave::sleep 1 diff --git a/testing/tests/ike/rw-cert/test.conf b/testing/tests/ike/rw-cert/test.conf new file mode 100644 index 000000000..845a6dcd7 --- /dev/null +++ b/testing/tests/ike/rw-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ike/rw_v1-net_v2/description.txt b/testing/tests/ike/rw_v1-net_v2/description.txt new file mode 100644 index 000000000..292e09d40 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/description.txt @@ -0,0 +1,7 @@ +A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> +is set up using the IKEv2 key exchange protocol whereas the roadwarrior <b>carol</b> +negotiates the connection via the IKEv1 protocol. +In order to test the established tunnels, client <b>alice</b> behind gateway <b>moon</b> +pings client <b>bob</b> located behind gateway <b>sun</b> and roadwarrior <b>carol</b> +pings the client <b>alice</b> behind <b>moon</b>. +. diff --git a/testing/tests/ike/rw_v1-net_v2/evaltest.dat b/testing/tests/ike/rw_v1-net_v2/evaltest.dat new file mode 100644 index 000000000..4eace50b7 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::net-net.*ESTABLISHED::YES +sun::ipsec statusall::net-net.*ESTABLISHED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES +moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf b/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..b72a3e939 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + +conn %default + ikelifetime=60m + keylife=20m + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + +conn net-net + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + keyexchange=ikev2 + auto=add + +conn rw + right=%any + rightid=carol@strongswan.org + keyexchange=ikev1 + auto=add + diff --git a/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf b/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..e5a9fe396 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf @@ -0,0 +1,15 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ocsp-strict/posttest.dat b/testing/tests/ike/rw_v1-net_v2/posttest.dat index 117f625f6..0980371a5 100644 --- a/testing/tests/ocsp-strict/posttest.dat +++ b/testing/tests/ike/rw_v1-net_v2/posttest.dat @@ -1,3 +1,3 @@ -moon::ipsec stop carol::ipsec stop -winnetou::killall openssl +moon::ipsec stop +sun::ipsec stop diff --git a/testing/tests/ike/rw_v1-net_v2/pretest.dat b/testing/tests/ike/rw_v1-net_v2/pretest.dat new file mode 100644 index 000000000..03b8dc218 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/pretest.dat @@ -0,0 +1,9 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::ipsec start +sun::ipsec start +carol::ipsec start +moon::sleep 1 +moon::ipsec up net-net +carol::ipsec up home +moon::sleep 1 diff --git a/testing/tests/ike/rw_v1-net_v2/test.conf b/testing/tests/ike/rw_v1-net_v2/test.conf new file mode 100644 index 000000000..983881e5d --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="carol moon sun" diff --git a/testing/tests/alg-blowfish/description.txt b/testing/tests/ikev1/alg-blowfish/description.txt index cff0a1915..cff0a1915 100644 --- a/testing/tests/alg-blowfish/description.txt +++ b/testing/tests/ikev1/alg-blowfish/description.txt diff --git a/testing/tests/alg-blowfish/evaltest.dat b/testing/tests/ikev1/alg-blowfish/evaltest.dat index a9c9b803a..a9c9b803a 100644 --- a/testing/tests/alg-blowfish/evaltest.dat +++ b/testing/tests/ikev1/alg-blowfish/evaltest.dat diff --git a/testing/tests/alg-blowfish/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-blowfish/hosts/carol/etc/ipsec.conf index fa68c9d3d..04d5b977b 100755 --- a/testing/tests/alg-blowfish/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-blowfish/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-blowfish/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-blowfish/hosts/moon/etc/ipsec.conf index 39916a7ba..80163ffcd 100755 --- a/testing/tests/alg-blowfish/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-blowfish/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-blowfish/posttest.dat b/testing/tests/ikev1/alg-blowfish/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-blowfish/posttest.dat +++ b/testing/tests/ikev1/alg-blowfish/posttest.dat diff --git a/testing/tests/alg-blowfish/pretest.dat b/testing/tests/ikev1/alg-blowfish/pretest.dat index 6d2eeb5f9..6d2eeb5f9 100644 --- a/testing/tests/alg-blowfish/pretest.dat +++ b/testing/tests/ikev1/alg-blowfish/pretest.dat diff --git a/testing/tests/alg-blowfish/test.conf b/testing/tests/ikev1/alg-blowfish/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-blowfish/test.conf +++ b/testing/tests/ikev1/alg-blowfish/test.conf diff --git a/testing/tests/alg-serpent/description.txt b/testing/tests/ikev1/alg-serpent/description.txt index f49c0a1c0..f49c0a1c0 100644 --- a/testing/tests/alg-serpent/description.txt +++ b/testing/tests/ikev1/alg-serpent/description.txt diff --git a/testing/tests/alg-serpent/evaltest.dat b/testing/tests/ikev1/alg-serpent/evaltest.dat index 6b792538b..6b792538b 100644 --- a/testing/tests/alg-serpent/evaltest.dat +++ b/testing/tests/ikev1/alg-serpent/evaltest.dat diff --git a/testing/tests/alg-serpent/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-serpent/hosts/carol/etc/ipsec.conf index 5d2369924..09cd583b4 100755 --- a/testing/tests/alg-serpent/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-serpent/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-serpent/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-serpent/hosts/moon/etc/ipsec.conf index 7bdddf008..ca1eb7b19 100755 --- a/testing/tests/alg-serpent/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-serpent/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no - + charonstart=no + conn %default ikelifetime=60m keylife=20m diff --git a/testing/tests/alg-serpent/posttest.dat b/testing/tests/ikev1/alg-serpent/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-serpent/posttest.dat +++ b/testing/tests/ikev1/alg-serpent/posttest.dat diff --git a/testing/tests/alg-serpent/pretest.dat b/testing/tests/ikev1/alg-serpent/pretest.dat index 6d2eeb5f9..6d2eeb5f9 100644 --- a/testing/tests/alg-serpent/pretest.dat +++ b/testing/tests/ikev1/alg-serpent/pretest.dat diff --git a/testing/tests/alg-serpent/test.conf b/testing/tests/ikev1/alg-serpent/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-serpent/test.conf +++ b/testing/tests/ikev1/alg-serpent/test.conf diff --git a/testing/tests/alg-sha-equals-sha1/description.txt b/testing/tests/ikev1/alg-sha-equals-sha1/description.txt index aeb2e1a88..aeb2e1a88 100644 --- a/testing/tests/alg-sha-equals-sha1/description.txt +++ b/testing/tests/ikev1/alg-sha-equals-sha1/description.txt diff --git a/testing/tests/alg-sha-equals-sha1/evaltest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/evaltest.dat index c3656c690..c3656c690 100644 --- a/testing/tests/alg-sha-equals-sha1/evaltest.dat +++ b/testing/tests/ikev1/alg-sha-equals-sha1/evaltest.dat diff --git a/testing/tests/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf index c7328faae..7c1ee3bb5 100755 --- a/testing/tests/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -24,3 +23,4 @@ conn home rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add + diff --git a/testing/tests/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf index 398c07fa9..7d00b538f 100755 --- a/testing/tests/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -24,3 +23,4 @@ conn rw right=%any rightid=carol@strongswan.org auto=add + diff --git a/testing/tests/alg-sha-equals-sha1/posttest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-sha-equals-sha1/posttest.dat +++ b/testing/tests/ikev1/alg-sha-equals-sha1/posttest.dat diff --git a/testing/tests/alg-sha-equals-sha1/pretest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/alg-sha-equals-sha1/pretest.dat +++ b/testing/tests/ikev1/alg-sha-equals-sha1/pretest.dat diff --git a/testing/tests/alg-sha-equals-sha1/test.conf b/testing/tests/ikev1/alg-sha-equals-sha1/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-sha-equals-sha1/test.conf +++ b/testing/tests/ikev1/alg-sha-equals-sha1/test.conf diff --git a/testing/tests/alg-sha2_256/description.txt b/testing/tests/ikev1/alg-sha2_256/description.txt index 900fcf017..900fcf017 100644 --- a/testing/tests/alg-sha2_256/description.txt +++ b/testing/tests/ikev1/alg-sha2_256/description.txt diff --git a/testing/tests/alg-sha2_256/evaltest.dat b/testing/tests/ikev1/alg-sha2_256/evaltest.dat index 9b4caa278..9b4caa278 100644 --- a/testing/tests/alg-sha2_256/evaltest.dat +++ b/testing/tests/ikev1/alg-sha2_256/evaltest.dat diff --git a/testing/tests/alg-sha2_256/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-sha2_256/hosts/carol/etc/ipsec.conf index c55ae8ab1..b10fb08b9 100755 --- a/testing/tests/alg-sha2_256/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-sha2_256/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-sha2_256/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-sha2_256/hosts/moon/etc/ipsec.conf index 748b1b85c..de832729b 100755 --- a/testing/tests/alg-sha2_256/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-sha2_256/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-sha2_256/posttest.dat b/testing/tests/ikev1/alg-sha2_256/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-sha2_256/posttest.dat +++ b/testing/tests/ikev1/alg-sha2_256/posttest.dat diff --git a/testing/tests/alg-sha2_256/pretest.dat b/testing/tests/ikev1/alg-sha2_256/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/alg-sha2_256/pretest.dat +++ b/testing/tests/ikev1/alg-sha2_256/pretest.dat diff --git a/testing/tests/alg-sha2_256/test.conf b/testing/tests/ikev1/alg-sha2_256/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-sha2_256/test.conf +++ b/testing/tests/ikev1/alg-sha2_256/test.conf diff --git a/testing/tests/alg-twofish/description.txt b/testing/tests/ikev1/alg-twofish/description.txt index 0015561ee..0015561ee 100644 --- a/testing/tests/alg-twofish/description.txt +++ b/testing/tests/ikev1/alg-twofish/description.txt diff --git a/testing/tests/alg-twofish/evaltest.dat b/testing/tests/ikev1/alg-twofish/evaltest.dat index 0568eec6e..0568eec6e 100644 --- a/testing/tests/alg-twofish/evaltest.dat +++ b/testing/tests/ikev1/alg-twofish/evaltest.dat diff --git a/testing/tests/alg-twofish/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-twofish/hosts/carol/etc/ipsec.conf index 8e3037a3b..95ddeb2b8 100755 --- a/testing/tests/alg-twofish/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-twofish/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-twofish/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-twofish/hosts/moon/etc/ipsec.conf index 01004e94e..2d7904563 100755 --- a/testing/tests/alg-twofish/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-twofish/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-twofish/posttest.dat b/testing/tests/ikev1/alg-twofish/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-twofish/posttest.dat +++ b/testing/tests/ikev1/alg-twofish/posttest.dat diff --git a/testing/tests/alg-twofish/pretest.dat b/testing/tests/ikev1/alg-twofish/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/alg-twofish/pretest.dat +++ b/testing/tests/ikev1/alg-twofish/pretest.dat diff --git a/testing/tests/alg-twofish/test.conf b/testing/tests/ikev1/alg-twofish/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-twofish/test.conf +++ b/testing/tests/ikev1/alg-twofish/test.conf diff --git a/testing/tests/attr-cert/description.txt b/testing/tests/ikev1/attr-cert/description.txt index b7f809c36..b7f809c36 100644 --- a/testing/tests/attr-cert/description.txt +++ b/testing/tests/ikev1/attr-cert/description.txt diff --git a/testing/tests/attr-cert/evaltest.dat b/testing/tests/ikev1/attr-cert/evaltest.dat index 59f6eb76a..59f6eb76a 100644 --- a/testing/tests/attr-cert/evaltest.dat +++ b/testing/tests/ikev1/attr-cert/evaltest.dat diff --git a/testing/tests/attr-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/carol/etc/ipsec.conf index 62fc49868..eae669641 100755 --- a/testing/tests/attr-cert/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/attr-cert/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/attr-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/dave/etc/ipsec.conf index 9d932dc54..989784124 100755 --- a/testing/tests/attr-cert/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/attr-cert/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/attr-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.conf index bd72715ff..6c16db587 100755 --- a/testing/tests/attr-cert/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem index 3c5c5d91d..3c5c5d91d 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/aaKey.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/aaKey.pem index 209b48f3a..209b48f3a 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/openac/aaKey.pem +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/aaKey.pem diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/carolCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/carolCert.pem index 8492fbd45..8492fbd45 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/openac/carolCert.pem +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/carolCert.pem diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/daveCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/daveCert.pem index abd1554e5..abd1554e5 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/openac/daveCert.pem +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/daveCert.pem diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/default.conf b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/default.conf index 134218eec..134218eec 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/openac/default.conf +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/default.conf diff --git a/testing/tests/attr-cert/posttest.dat b/testing/tests/ikev1/attr-cert/posttest.dat index a59c3ff63..a59c3ff63 100644 --- a/testing/tests/attr-cert/posttest.dat +++ b/testing/tests/ikev1/attr-cert/posttest.dat diff --git a/testing/tests/attr-cert/pretest.dat b/testing/tests/ikev1/attr-cert/pretest.dat index b3fecaf3c..b3fecaf3c 100644 --- a/testing/tests/attr-cert/pretest.dat +++ b/testing/tests/ikev1/attr-cert/pretest.dat diff --git a/testing/tests/attr-cert/test.conf b/testing/tests/ikev1/attr-cert/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/attr-cert/test.conf +++ b/testing/tests/ikev1/attr-cert/test.conf diff --git a/testing/tests/compress/description.txt b/testing/tests/ikev1/compress/description.txt index 47829839d..47829839d 100644 --- a/testing/tests/compress/description.txt +++ b/testing/tests/ikev1/compress/description.txt diff --git a/testing/tests/compress/evaltest.dat b/testing/tests/ikev1/compress/evaltest.dat index ff72e1762..ff72e1762 100644 --- a/testing/tests/compress/evaltest.dat +++ b/testing/tests/ikev1/compress/evaltest.dat diff --git a/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..abf3049d8 --- /dev/null +++ b/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug="control crypt" + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + compress=yes + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/compress/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/compress/hosts/moon/etc/ipsec.conf index b8dfae646..855718f5d 100755 --- a/testing/tests/compress/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/compress/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/compress/posttest.dat b/testing/tests/ikev1/compress/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/compress/posttest.dat +++ b/testing/tests/ikev1/compress/posttest.dat diff --git a/testing/tests/compress/pretest.dat b/testing/tests/ikev1/compress/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/compress/pretest.dat +++ b/testing/tests/ikev1/compress/pretest.dat diff --git a/testing/tests/compress/test.conf b/testing/tests/ikev1/compress/test.conf index fd33cfb57..fd33cfb57 100644 --- a/testing/tests/compress/test.conf +++ b/testing/tests/ikev1/compress/test.conf diff --git a/testing/tests/crl-from-cache/description.txt b/testing/tests/ikev1/crl-from-cache/description.txt index 17866f572..17866f572 100644 --- a/testing/tests/crl-from-cache/description.txt +++ b/testing/tests/ikev1/crl-from-cache/description.txt diff --git a/testing/tests/crl-from-cache/evaltest.dat b/testing/tests/ikev1/crl-from-cache/evaltest.dat index dd200c8ef..dd200c8ef 100644 --- a/testing/tests/crl-from-cache/evaltest.dat +++ b/testing/tests/ikev1/crl-from-cache/evaltest.dat diff --git a/testing/tests/crl-from-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-from-cache/hosts/carol/etc/ipsec.conf index 93c4d7956..59cbe67ba 100755 --- a/testing/tests/crl-from-cache/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-from-cache/hosts/carol/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes cachecrls=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-from-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-from-cache/hosts/moon/etc/ipsec.conf index ef9237518..9a2efb73d 100755 --- a/testing/tests/crl-from-cache/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-from-cache/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes cachecrls=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-from-cache/posttest.dat b/testing/tests/ikev1/crl-from-cache/posttest.dat index be17847c1..be17847c1 100644 --- a/testing/tests/crl-from-cache/posttest.dat +++ b/testing/tests/ikev1/crl-from-cache/posttest.dat diff --git a/testing/tests/crl-from-cache/pretest.dat b/testing/tests/ikev1/crl-from-cache/pretest.dat index acdb265ed..acdb265ed 100644 --- a/testing/tests/crl-from-cache/pretest.dat +++ b/testing/tests/ikev1/crl-from-cache/pretest.dat diff --git a/testing/tests/crl-from-cache/test.conf b/testing/tests/ikev1/crl-from-cache/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-from-cache/test.conf +++ b/testing/tests/ikev1/crl-from-cache/test.conf diff --git a/testing/tests/crl-ldap/description.txt b/testing/tests/ikev1/crl-ldap/description.txt index 02dc0cbbe..02dc0cbbe 100644 --- a/testing/tests/crl-ldap/description.txt +++ b/testing/tests/ikev1/crl-ldap/description.txt diff --git a/testing/tests/crl-ldap/evaltest.dat b/testing/tests/ikev1/crl-ldap/evaltest.dat index 2b98e086a..2b98e086a 100644 --- a/testing/tests/crl-ldap/evaltest.dat +++ b/testing/tests/ikev1/crl-ldap/evaltest.dat diff --git a/testing/tests/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/init.d/iptables index 571459bae..571459bae 100755 --- a/testing/tests/crl-ldap/hosts/carol/etc/init.d/iptables +++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/init.d/iptables diff --git a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.conf index 669a47d06..40e32f14a 100755 --- a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes cachecrls=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl Binary files differindex 75e8b0959..75e8b0959 100644 --- a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl +++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl diff --git a/testing/tests/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/init.d/iptables index 8de514a2e..8de514a2e 100755 --- a/testing/tests/crl-ldap/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.conf index d5c0dd163..eaaaa3f42 100755 --- a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes cachecrls=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl Binary files differindex 75e8b0959..75e8b0959 100644 --- a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl +++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl diff --git a/testing/tests/crl-ldap/posttest.dat b/testing/tests/ikev1/crl-ldap/posttest.dat index 04f762331..bddd87424 100644 --- a/testing/tests/crl-ldap/posttest.dat +++ b/testing/tests/ikev1/crl-ldap/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop winnetou::/etc/init.d/slapd stop diff --git a/testing/tests/crl-ldap/pretest.dat b/testing/tests/ikev1/crl-ldap/pretest.dat index 64fa8116b..64fa8116b 100644 --- a/testing/tests/crl-ldap/pretest.dat +++ b/testing/tests/ikev1/crl-ldap/pretest.dat diff --git a/testing/tests/crl-ldap/test.conf b/testing/tests/ikev1/crl-ldap/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-ldap/test.conf +++ b/testing/tests/ikev1/crl-ldap/test.conf diff --git a/testing/tests/crl-revoked/description.txt b/testing/tests/ikev1/crl-revoked/description.txt index 780068ce6..780068ce6 100644 --- a/testing/tests/crl-revoked/description.txt +++ b/testing/tests/ikev1/crl-revoked/description.txt diff --git a/testing/tests/crl-revoked/evaltest.dat b/testing/tests/ikev1/crl-revoked/evaltest.dat index 0fd1cae8c..0fd1cae8c 100644 --- a/testing/tests/crl-revoked/evaltest.dat +++ b/testing/tests/ikev1/crl-revoked/evaltest.dat diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.conf index 5a1d246a6..6b4650fb8 100755 --- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem index 5b742fc9e..5b742fc9e 100644 --- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem +++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem index 8aefcc5a6..8aefcc5a6 100644 --- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem +++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.secrets index 8e31be4cb..8e31be4cb 100644 --- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/crl-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-revoked/hosts/moon/etc/ipsec.conf index a8953f557..143bace9a 100755 --- a/testing/tests/crl-revoked/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-revoked/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-revoked/posttest.dat b/testing/tests/ikev1/crl-revoked/posttest.dat index d742e8410..d742e8410 100644 --- a/testing/tests/crl-revoked/posttest.dat +++ b/testing/tests/ikev1/crl-revoked/posttest.dat diff --git a/testing/tests/crl-revoked/pretest.dat b/testing/tests/ikev1/crl-revoked/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/crl-revoked/pretest.dat +++ b/testing/tests/ikev1/crl-revoked/pretest.dat diff --git a/testing/tests/crl-revoked/test.conf b/testing/tests/ikev1/crl-revoked/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-revoked/test.conf +++ b/testing/tests/ikev1/crl-revoked/test.conf diff --git a/testing/tests/crl-strict/description.txt b/testing/tests/ikev1/crl-strict/description.txt index 97011482e..97011482e 100644 --- a/testing/tests/crl-strict/description.txt +++ b/testing/tests/ikev1/crl-strict/description.txt diff --git a/testing/tests/crl-strict/evaltest.dat b/testing/tests/ikev1/crl-strict/evaltest.dat index 1d7adb05e..1d7adb05e 100644 --- a/testing/tests/crl-strict/evaltest.dat +++ b/testing/tests/ikev1/crl-strict/evaltest.dat diff --git a/testing/tests/crl-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-strict/hosts/carol/etc/ipsec.conf index 6d0aee86a..93bd80758 100755 --- a/testing/tests/crl-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-strict/hosts/moon/etc/ipsec.conf index a8953f557..143bace9a 100755 --- a/testing/tests/crl-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-strict/posttest.dat b/testing/tests/ikev1/crl-strict/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/crl-strict/posttest.dat +++ b/testing/tests/ikev1/crl-strict/posttest.dat diff --git a/testing/tests/crl-strict/pretest.dat b/testing/tests/ikev1/crl-strict/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/crl-strict/pretest.dat +++ b/testing/tests/ikev1/crl-strict/pretest.dat diff --git a/testing/tests/crl-strict/test.conf b/testing/tests/ikev1/crl-strict/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-strict/test.conf +++ b/testing/tests/ikev1/crl-strict/test.conf diff --git a/testing/tests/crl-to-cache/description.txt b/testing/tests/ikev1/crl-to-cache/description.txt index 9f542e73d..9f542e73d 100644 --- a/testing/tests/crl-to-cache/description.txt +++ b/testing/tests/ikev1/crl-to-cache/description.txt diff --git a/testing/tests/crl-to-cache/evaltest.dat b/testing/tests/ikev1/crl-to-cache/evaltest.dat index be7737185..be7737185 100644 --- a/testing/tests/crl-to-cache/evaltest.dat +++ b/testing/tests/ikev1/crl-to-cache/evaltest.dat diff --git a/testing/tests/crl-to-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-to-cache/hosts/carol/etc/ipsec.conf index 955f08b1f..e64a8fb5a 100755 --- a/testing/tests/crl-to-cache/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-to-cache/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 cachecrls=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-to-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-to-cache/hosts/moon/etc/ipsec.conf index 885354ab5..666fc0698 100755 --- a/testing/tests/crl-to-cache/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-to-cache/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 cachecrls=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-to-cache/posttest.dat b/testing/tests/ikev1/crl-to-cache/posttest.dat index be17847c1..be17847c1 100644 --- a/testing/tests/crl-to-cache/posttest.dat +++ b/testing/tests/ikev1/crl-to-cache/posttest.dat diff --git a/testing/tests/crl-to-cache/pretest.dat b/testing/tests/ikev1/crl-to-cache/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/crl-to-cache/pretest.dat +++ b/testing/tests/ikev1/crl-to-cache/pretest.dat diff --git a/testing/tests/crl-to-cache/test.conf b/testing/tests/ikev1/crl-to-cache/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-to-cache/test.conf +++ b/testing/tests/ikev1/crl-to-cache/test.conf diff --git a/testing/tests/default-keys/description.txt b/testing/tests/ikev1/default-keys/description.txt index 639e909da..639e909da 100644 --- a/testing/tests/default-keys/description.txt +++ b/testing/tests/ikev1/default-keys/description.txt diff --git a/testing/tests/self-signed/evaltest.dat b/testing/tests/ikev1/default-keys/evaltest.dat index f190d7066..a18e3997e 100644 --- a/testing/tests/self-signed/evaltest.dat +++ b/testing/tests/ikev1/default-keys/evaltest.dat @@ -1,3 +1,5 @@ +carol::cat /var/log/auth.log::scepclient::YES +moon::cat /var/log/auth.log::scepclient::YES carol::cat /var/log/auth.log::we have a cert but are not sending it::YES moon::cat /var/log/auth.log::we have a cert but are not sending it::YES carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES diff --git a/testing/tests/default-keys/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/default-keys/hosts/carol/etc/ipsec.conf index c4bb10a65..0ec9d47ed 100755 --- a/testing/tests/default-keys/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/default-keys/hosts/carol/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=0 strictcrlpolicy=no nocrsend=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/default-keys/hosts/moon/etc/init.d/iptables index 13ad3063f..13ad3063f 100755 --- a/testing/tests/default-keys/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/default-keys/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/default-keys/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/default-keys/hosts/moon/etc/ipsec.conf index eeeec645b..ed1b40549 100755 --- a/testing/tests/default-keys/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/default-keys/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=0 strictcrlpolicy=no nocrsend=yes + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default keyingtries=1 conn carol - left=192.168.0.1 + left=PH_IP_MOON leftnexthop=%direct leftcert=selfCert.der leftsendcert=never diff --git a/testing/tests/default-keys/posttest.dat b/testing/tests/ikev1/default-keys/posttest.dat index 52b48b9ef..8cada5e7e 100644 --- a/testing/tests/default-keys/posttest.dat +++ b/testing/tests/ikev1/default-keys/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/default-keys/pretest.dat b/testing/tests/ikev1/default-keys/pretest.dat index 54f70cbe9..88f9a2ca9 100644 --- a/testing/tests/default-keys/pretest.dat +++ b/testing/tests/ikev1/default-keys/pretest.dat @@ -10,7 +10,7 @@ moon::rm /etc/ipsec.d/private/* moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/cacerts/* moon::ipsec start -moon::sleep 4 +moon::sleep 5 moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der moon::ipsec reload diff --git a/testing/tests/default-keys/test.conf b/testing/tests/ikev1/default-keys/test.conf index 0baa48d90..0baa48d90 100644 --- a/testing/tests/default-keys/test.conf +++ b/testing/tests/ikev1/default-keys/test.conf diff --git a/testing/tests/double-nat-net/description.txt b/testing/tests/ikev1/double-nat-net/description.txt index ff09155f6..ff09155f6 100644 --- a/testing/tests/double-nat-net/description.txt +++ b/testing/tests/ikev1/double-nat-net/description.txt diff --git a/testing/tests/double-nat-net/evaltest.dat b/testing/tests/ikev1/double-nat-net/evaltest.dat index 41eba6501..d00613c07 100644 --- a/testing/tests/double-nat-net/evaltest.dat +++ b/testing/tests/ikev1/double-nat-net/evaltest.dat @@ -1,5 +1,5 @@ alice::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES bob::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES -alice::ping -c 1 PH_IP1_SUN::64 bytes from PH_IP1_SUN: icmp_seq=1::YES +alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/double-nat-net/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/double-nat-net/hosts/alice/etc/ipsec.conf index 395e62e7c..5c0763734 100755 --- a/testing/tests/double-nat-net/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev1/double-nat-net/hosts/alice/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/double-nat-net/hosts/bob/etc/ipsec.conf b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/ipsec.conf index 6927a5ce4..e79b2ca35 100755 --- a/testing/tests/double-nat-net/hosts/bob/etc/ipsec.conf +++ b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/double-nat-net/posttest.dat b/testing/tests/ikev1/double-nat-net/posttest.dat index 0eb2c0d6c..484297418 100644 --- a/testing/tests/double-nat-net/posttest.dat +++ b/testing/tests/ikev1/double-nat-net/posttest.dat @@ -1,9 +1,9 @@ -alice::iptables -v -n -L -bob::iptables -v -n -L bob::ipsec stop alice::ipsec stop alice::/etc/init.d/iptables stop 2> /dev/null bob::/etc/init.d/iptables stop 2> /dev/null moon::iptables -t nat -F sun::iptables -t nat -F +moon::conntrack -F +sun::conntrack -F sun::ip route del 10.1.0.0/16 via PH_IP_BOB diff --git a/testing/tests/double-nat-net/pretest.dat b/testing/tests/ikev1/double-nat-net/pretest.dat index 84bc15092..84bc15092 100644 --- a/testing/tests/double-nat-net/pretest.dat +++ b/testing/tests/ikev1/double-nat-net/pretest.dat diff --git a/testing/tests/double-nat-net/test.conf b/testing/tests/ikev1/double-nat-net/test.conf index 1ca2ffe5a..1ca2ffe5a 100644 --- a/testing/tests/double-nat-net/test.conf +++ b/testing/tests/ikev1/double-nat-net/test.conf diff --git a/testing/tests/double-nat/description.txt b/testing/tests/ikev1/double-nat/description.txt index ce7de0e56..ce7de0e56 100644 --- a/testing/tests/double-nat/description.txt +++ b/testing/tests/ikev1/double-nat/description.txt diff --git a/testing/tests/double-nat/evaltest.dat b/testing/tests/ikev1/double-nat/evaltest.dat index 05e751422..05e751422 100644 --- a/testing/tests/double-nat/evaltest.dat +++ b/testing/tests/ikev1/double-nat/evaltest.dat diff --git a/testing/tests/double-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/double-nat/hosts/alice/etc/ipsec.conf index 5b3cddb63..3533c3f8b 100755 --- a/testing/tests/double-nat/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev1/double-nat/hosts/alice/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/double-nat/posttest.dat b/testing/tests/ikev1/double-nat/posttest.dat index 07f22d07d..5d39e406d 100644 --- a/testing/tests/double-nat/posttest.dat +++ b/testing/tests/ikev1/double-nat/posttest.dat @@ -1,8 +1,8 @@ -alice::iptables -v -n -L -bob::iptables -v -n -L bob::ipsec stop alice::ipsec stop alice::/etc/init.d/iptables stop 2> /dev/null bob::/etc/init.d/iptables stop 2> /dev/null moon::iptables -t nat -F sun::iptables -t nat -F +moon::conntrack -F +sun::conntrack -F diff --git a/testing/tests/double-nat/pretest.dat b/testing/tests/ikev1/double-nat/pretest.dat index cf495b778..cf495b778 100644 --- a/testing/tests/double-nat/pretest.dat +++ b/testing/tests/ikev1/double-nat/pretest.dat diff --git a/testing/tests/double-nat/test.conf b/testing/tests/ikev1/double-nat/test.conf index 1ca2ffe5a..1ca2ffe5a 100644 --- a/testing/tests/double-nat/test.conf +++ b/testing/tests/ikev1/double-nat/test.conf diff --git a/testing/tests/dpd-clear/description.txt b/testing/tests/ikev1/dpd-clear/description.txt index f76b2d741..f76b2d741 100644 --- a/testing/tests/dpd-clear/description.txt +++ b/testing/tests/ikev1/dpd-clear/description.txt diff --git a/testing/tests/dpd-clear/evaltest.dat b/testing/tests/ikev1/dpd-clear/evaltest.dat index da3567d3e..98d5b146b 100644 --- a/testing/tests/dpd-clear/evaltest.dat +++ b/testing/tests/ikev1/dpd-clear/evaltest.dat @@ -1,6 +1,5 @@ carol::ipsec status::STATE_MAIN_I4 (ISAKMP SA established)::YES carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO -moon::ipsec statusall::DPD active::YES moon::sleep 50::no output expected::NO moon::cat /var/log/auth.log::inserting event EVENT_DPD::YES moon::cat /var/log/auth.log::DPD: No response from peer - declaring peer dead::YES diff --git a/testing/tests/dpd-clear/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/dpd-clear/hosts/moon/etc/ipsec.conf index cac521c8f..281293545 100755 --- a/testing/tests/dpd-clear/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/dpd-clear/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/dpd-clear/posttest.dat b/testing/tests/ikev1/dpd-clear/posttest.dat index 931db4272..931db4272 100644 --- a/testing/tests/dpd-clear/posttest.dat +++ b/testing/tests/ikev1/dpd-clear/posttest.dat diff --git a/testing/tests/dpd-clear/pretest.dat b/testing/tests/ikev1/dpd-clear/pretest.dat index 14ed95322..14ed95322 100644 --- a/testing/tests/dpd-clear/pretest.dat +++ b/testing/tests/ikev1/dpd-clear/pretest.dat diff --git a/testing/tests/dpd-clear/test.conf b/testing/tests/ikev1/dpd-clear/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/dpd-clear/test.conf +++ b/testing/tests/ikev1/dpd-clear/test.conf diff --git a/testing/tests/esp-ah-transport/description.txt b/testing/tests/ikev1/esp-ah-transport/description.txt index c7918fa38..c7918fa38 100644 --- a/testing/tests/esp-ah-transport/description.txt +++ b/testing/tests/ikev1/esp-ah-transport/description.txt diff --git a/testing/tests/esp-ah-transport/evaltest.dat b/testing/tests/ikev1/esp-ah-transport/evaltest.dat index 7c498ad83..7c498ad83 100644 --- a/testing/tests/esp-ah-transport/evaltest.dat +++ b/testing/tests/ikev1/esp-ah-transport/evaltest.dat diff --git a/testing/tests/esp-ah-transport/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/init.d/iptables index 8c8817539..8c8817539 100755 --- a/testing/tests/esp-ah-transport/hosts/carol/etc/init.d/iptables +++ b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/init.d/iptables diff --git a/testing/tests/esp-ah-transport/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/ipsec.conf index 13ab3e07f..21f56705c 100755 --- a/testing/tests/esp-ah-transport/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-ah-transport/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/init.d/iptables index 3e8922581..3e8922581 100755 --- a/testing/tests/esp-ah-transport/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/esp-ah-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/ipsec.conf index 809f3c74b..274a1aa18 100755 --- a/testing/tests/esp-ah-transport/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-ah-transport/posttest.dat b/testing/tests/ikev1/esp-ah-transport/posttest.dat index 26848212b..94a400606 100644 --- a/testing/tests/esp-ah-transport/posttest.dat +++ b/testing/tests/ikev1/esp-ah-transport/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/esp-ah-transport/pretest.dat b/testing/tests/ikev1/esp-ah-transport/pretest.dat index bd68efb0b..bd68efb0b 100644 --- a/testing/tests/esp-ah-transport/pretest.dat +++ b/testing/tests/ikev1/esp-ah-transport/pretest.dat diff --git a/testing/tests/esp-ah-transport/test.conf b/testing/tests/ikev1/esp-ah-transport/test.conf index fd33cfb57..fd33cfb57 100644 --- a/testing/tests/esp-ah-transport/test.conf +++ b/testing/tests/ikev1/esp-ah-transport/test.conf diff --git a/testing/tests/esp-ah-tunnel/description.txt b/testing/tests/ikev1/esp-ah-tunnel/description.txt index 809f28c57..809f28c57 100644 --- a/testing/tests/esp-ah-tunnel/description.txt +++ b/testing/tests/ikev1/esp-ah-tunnel/description.txt diff --git a/testing/tests/esp-ah-tunnel/evaltest.dat b/testing/tests/ikev1/esp-ah-tunnel/evaltest.dat index 8f4a99641..8f4a99641 100644 --- a/testing/tests/esp-ah-tunnel/evaltest.dat +++ b/testing/tests/ikev1/esp-ah-tunnel/evaltest.dat diff --git a/testing/tests/esp-ah-tunnel/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/init.d/iptables index 8c8817539..8c8817539 100755 --- a/testing/tests/esp-ah-tunnel/hosts/carol/etc/init.d/iptables +++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/init.d/iptables diff --git a/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..8c72a7b7f --- /dev/null +++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + auth=ah + ike=aes128-sha + esp=aes128-sha1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/esp-ah-tunnel/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/init.d/iptables index 3e8922581..3e8922581 100755 --- a/testing/tests/esp-ah-tunnel/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/esp-ah-tunnel/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/ipsec.conf index 7f976376d..ccf8e91fa 100755 --- a/testing/tests/esp-ah-tunnel/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-ah-tunnel/posttest.dat b/testing/tests/ikev1/esp-ah-tunnel/posttest.dat index 26848212b..94a400606 100644 --- a/testing/tests/esp-ah-tunnel/posttest.dat +++ b/testing/tests/ikev1/esp-ah-tunnel/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/esp-ah-tunnel/pretest.dat b/testing/tests/ikev1/esp-ah-tunnel/pretest.dat index bd68efb0b..bd68efb0b 100644 --- a/testing/tests/esp-ah-tunnel/pretest.dat +++ b/testing/tests/ikev1/esp-ah-tunnel/pretest.dat diff --git a/testing/tests/esp-ah-tunnel/test.conf b/testing/tests/ikev1/esp-ah-tunnel/test.conf index fd33cfb57..fd33cfb57 100644 --- a/testing/tests/esp-ah-tunnel/test.conf +++ b/testing/tests/ikev1/esp-ah-tunnel/test.conf diff --git a/testing/tests/esp-alg-des/description.txt b/testing/tests/ikev1/esp-alg-des/description.txt index 9546569dd..9546569dd 100644 --- a/testing/tests/esp-alg-des/description.txt +++ b/testing/tests/ikev1/esp-alg-des/description.txt diff --git a/testing/tests/esp-alg-des/evaltest.dat b/testing/tests/ikev1/esp-alg-des/evaltest.dat index 8e06392f1..8e06392f1 100644 --- a/testing/tests/esp-alg-des/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-des/evaltest.dat diff --git a/testing/tests/esp-alg-des/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-des/hosts/carol/etc/ipsec.conf index b4f067b6d..b8ef03cfe 100755 --- a/testing/tests/esp-alg-des/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-des/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-des/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-des/hosts/moon/etc/ipsec.conf index 9513f810d..3ac0bf4cf 100755 --- a/testing/tests/esp-alg-des/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-des/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-des/posttest.dat b/testing/tests/ikev1/esp-alg-des/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-des/posttest.dat +++ b/testing/tests/ikev1/esp-alg-des/posttest.dat diff --git a/testing/tests/esp-alg-des/pretest.dat b/testing/tests/ikev1/esp-alg-des/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/esp-alg-des/pretest.dat +++ b/testing/tests/ikev1/esp-alg-des/pretest.dat diff --git a/testing/tests/esp-alg-des/test.conf b/testing/tests/ikev1/esp-alg-des/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/esp-alg-des/test.conf +++ b/testing/tests/ikev1/esp-alg-des/test.conf diff --git a/testing/tests/esp-alg-null/description.txt b/testing/tests/ikev1/esp-alg-null/description.txt index 7880a799c..7880a799c 100644 --- a/testing/tests/esp-alg-null/description.txt +++ b/testing/tests/ikev1/esp-alg-null/description.txt diff --git a/testing/tests/esp-alg-null/evaltest.dat b/testing/tests/ikev1/esp-alg-null/evaltest.dat index de2f2a571..de2f2a571 100644 --- a/testing/tests/esp-alg-null/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-null/evaltest.dat diff --git a/testing/tests/esp-alg-null/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-null/hosts/carol/etc/ipsec.conf index b732eba93..7a8ae37c9 100755 --- a/testing/tests/esp-alg-null/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-null/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-null/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-null/hosts/moon/etc/ipsec.conf index af11591a1..187a3fb17 100755 --- a/testing/tests/esp-alg-null/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-null/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-null/posttest.dat b/testing/tests/ikev1/esp-alg-null/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-null/posttest.dat +++ b/testing/tests/ikev1/esp-alg-null/posttest.dat diff --git a/testing/tests/esp-alg-weak/pretest.dat b/testing/tests/ikev1/esp-alg-null/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/esp-alg-weak/pretest.dat +++ b/testing/tests/ikev1/esp-alg-null/pretest.dat diff --git a/testing/tests/esp-alg-null/test.conf b/testing/tests/ikev1/esp-alg-null/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/esp-alg-null/test.conf +++ b/testing/tests/ikev1/esp-alg-null/test.conf diff --git a/testing/tests/esp-alg-strict-fail/description.txt b/testing/tests/ikev1/esp-alg-strict-fail/description.txt index 03c655480..03c655480 100644 --- a/testing/tests/esp-alg-strict-fail/description.txt +++ b/testing/tests/ikev1/esp-alg-strict-fail/description.txt diff --git a/testing/tests/esp-alg-strict-fail/evaltest.dat b/testing/tests/ikev1/esp-alg-strict-fail/evaltest.dat index 6f2024ff9..6f2024ff9 100644 --- a/testing/tests/esp-alg-strict-fail/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-strict-fail/evaltest.dat diff --git a/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..4ed2fb645 --- /dev/null +++ b/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + ike=3des-sha + esp=3des-sha1 +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf index 2dd1c763a..f8c27ad7c 100755 --- a/testing/tests/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-strict-fail/posttest.dat b/testing/tests/ikev1/esp-alg-strict-fail/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-strict-fail/posttest.dat +++ b/testing/tests/ikev1/esp-alg-strict-fail/posttest.dat diff --git a/testing/tests/esp-alg-null/pretest.dat b/testing/tests/ikev1/esp-alg-strict-fail/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/esp-alg-null/pretest.dat +++ b/testing/tests/ikev1/esp-alg-strict-fail/pretest.dat diff --git a/testing/tests/esp-alg-strict-fail/test.conf b/testing/tests/ikev1/esp-alg-strict-fail/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/esp-alg-strict-fail/test.conf +++ b/testing/tests/ikev1/esp-alg-strict-fail/test.conf diff --git a/testing/tests/esp-alg-strict/description.txt b/testing/tests/ikev1/esp-alg-strict/description.txt index b4fc08253..b4fc08253 100644 --- a/testing/tests/esp-alg-strict/description.txt +++ b/testing/tests/ikev1/esp-alg-strict/description.txt diff --git a/testing/tests/esp-alg-strict/evaltest.dat b/testing/tests/ikev1/esp-alg-strict/evaltest.dat index d5dd12d4e..d5dd12d4e 100644 --- a/testing/tests/esp-alg-strict/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-strict/evaltest.dat diff --git a/testing/tests/esp-alg-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict/hosts/carol/etc/ipsec.conf index 5a14de070..da86d14df 100755 --- a/testing/tests/esp-alg-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict/hosts/moon/etc/ipsec.conf index 2dd1c763a..f8c27ad7c 100755 --- a/testing/tests/esp-alg-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-strict/posttest.dat b/testing/tests/ikev1/esp-alg-strict/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-strict/posttest.dat +++ b/testing/tests/ikev1/esp-alg-strict/posttest.dat diff --git a/testing/tests/esp-alg-strict-fail/pretest.dat b/testing/tests/ikev1/esp-alg-strict/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/esp-alg-strict-fail/pretest.dat +++ b/testing/tests/ikev1/esp-alg-strict/pretest.dat diff --git a/testing/tests/esp-alg-strict/test.conf b/testing/tests/ikev1/esp-alg-strict/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/esp-alg-strict/test.conf +++ b/testing/tests/ikev1/esp-alg-strict/test.conf diff --git a/testing/tests/esp-alg-weak/description.txt b/testing/tests/ikev1/esp-alg-weak/description.txt index ffb6882f5..ffb6882f5 100644 --- a/testing/tests/esp-alg-weak/description.txt +++ b/testing/tests/ikev1/esp-alg-weak/description.txt diff --git a/testing/tests/esp-alg-weak/evaltest.dat b/testing/tests/ikev1/esp-alg-weak/evaltest.dat index 72b14e805..72b14e805 100644 --- a/testing/tests/esp-alg-weak/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-weak/evaltest.dat diff --git a/testing/tests/esp-alg-weak/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-weak/hosts/carol/etc/ipsec.conf index b4f067b6d..b8ef03cfe 100755 --- a/testing/tests/esp-alg-weak/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-weak/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-weak/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-weak/hosts/moon/etc/ipsec.conf index 3f07213ae..691b6b74f 100755 --- a/testing/tests/esp-alg-weak/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-weak/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-weak/posttest.dat b/testing/tests/ikev1/esp-alg-weak/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-weak/posttest.dat +++ b/testing/tests/ikev1/esp-alg-weak/posttest.dat diff --git a/testing/tests/ike-alg-sha2_512/pretest.dat b/testing/tests/ikev1/esp-alg-weak/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/ike-alg-sha2_512/pretest.dat +++ b/testing/tests/ikev1/esp-alg-weak/pretest.dat diff --git a/testing/tests/esp-alg-weak/test.conf b/testing/tests/ikev1/esp-alg-weak/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/esp-alg-weak/test.conf +++ b/testing/tests/ikev1/esp-alg-weak/test.conf diff --git a/testing/tests/host2host-cert/description.txt b/testing/tests/ikev1/host2host-cert/description.txt index 6be21bf8f..6be21bf8f 100644 --- a/testing/tests/host2host-cert/description.txt +++ b/testing/tests/ikev1/host2host-cert/description.txt diff --git a/testing/tests/host2host-cert/evaltest.dat b/testing/tests/ikev1/host2host-cert/evaltest.dat index d19f970f2..d19f970f2 100644 --- a/testing/tests/host2host-cert/evaltest.dat +++ b/testing/tests/ikev1/host2host-cert/evaltest.dat diff --git a/testing/tests/host2host-transport/posttest.dat b/testing/tests/ikev1/host2host-cert/posttest.dat index 52979508d..5a9150bc8 100644 --- a/testing/tests/host2host-transport/posttest.dat +++ b/testing/tests/ikev1/host2host-cert/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/host2host-cert/pretest.dat b/testing/tests/ikev1/host2host-cert/pretest.dat index 3536fd886..3536fd886 100644 --- a/testing/tests/host2host-cert/pretest.dat +++ b/testing/tests/ikev1/host2host-cert/pretest.dat diff --git a/testing/tests/host2host-cert/test.conf b/testing/tests/ikev1/host2host-cert/test.conf index cf2e704fd..cf2e704fd 100644 --- a/testing/tests/host2host-cert/test.conf +++ b/testing/tests/ikev1/host2host-cert/test.conf diff --git a/testing/tests/host2host-swapped/description.txt b/testing/tests/ikev1/host2host-swapped/description.txt index 34cfe43cc..34cfe43cc 100644 --- a/testing/tests/host2host-swapped/description.txt +++ b/testing/tests/ikev1/host2host-swapped/description.txt diff --git a/testing/tests/host2host-swapped/evaltest.dat b/testing/tests/ikev1/host2host-swapped/evaltest.dat index d19f970f2..d19f970f2 100644 --- a/testing/tests/host2host-swapped/evaltest.dat +++ b/testing/tests/ikev1/host2host-swapped/evaltest.dat diff --git a/testing/tests/host2host-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/host2host-swapped/hosts/moon/etc/ipsec.conf index 4b66a5ecb..10597bc58 100755 --- a/testing/tests/host2host-swapped/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/host2host-swapped/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/host2host-swapped/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/host2host-swapped/hosts/sun/etc/ipsec.conf index a58894b33..45121d967 100755 --- a/testing/tests/host2host-swapped/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/host2host-swapped/hosts/sun/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-cert/posttest.dat b/testing/tests/ikev1/host2host-swapped/posttest.dat index 52979508d..5a9150bc8 100644 --- a/testing/tests/net2net-cert/posttest.dat +++ b/testing/tests/ikev1/host2host-swapped/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/host2host-swapped/pretest.dat b/testing/tests/ikev1/host2host-swapped/pretest.dat index e2d98f2eb..e2d98f2eb 100644 --- a/testing/tests/host2host-swapped/pretest.dat +++ b/testing/tests/ikev1/host2host-swapped/pretest.dat diff --git a/testing/tests/host2host-swapped/test.conf b/testing/tests/ikev1/host2host-swapped/test.conf index cf2e704fd..cf2e704fd 100644 --- a/testing/tests/host2host-swapped/test.conf +++ b/testing/tests/ikev1/host2host-swapped/test.conf diff --git a/testing/tests/host2host-transport/description.txt b/testing/tests/ikev1/host2host-transport/description.txt index fe3482c96..fe3482c96 100644 --- a/testing/tests/host2host-transport/description.txt +++ b/testing/tests/ikev1/host2host-transport/description.txt diff --git a/testing/tests/host2host-transport/evaltest.dat b/testing/tests/ikev1/host2host-transport/evaltest.dat index d19f970f2..d19f970f2 100644 --- a/testing/tests/host2host-transport/evaltest.dat +++ b/testing/tests/ikev1/host2host-transport/evaltest.dat diff --git a/testing/tests/host2host-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/host2host-transport/hosts/moon/etc/ipsec.conf index af5000fa8..44ac885ce 100755 --- a/testing/tests/host2host-transport/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/host2host-transport/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/host2host-transport/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/host2host-transport/hosts/sun/etc/ipsec.conf index 10bea9847..a89e799bd 100755 --- a/testing/tests/host2host-transport/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/host2host-transport/hosts/sun/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/host2host-cert/posttest.dat b/testing/tests/ikev1/host2host-transport/posttest.dat index 52979508d..5a9150bc8 100644 --- a/testing/tests/host2host-cert/posttest.dat +++ b/testing/tests/ikev1/host2host-transport/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/host2host-transport/pretest.dat b/testing/tests/ikev1/host2host-transport/pretest.dat index e2d98f2eb..e2d98f2eb 100644 --- a/testing/tests/host2host-transport/pretest.dat +++ b/testing/tests/ikev1/host2host-transport/pretest.dat diff --git a/testing/tests/host2host-transport/test.conf b/testing/tests/ikev1/host2host-transport/test.conf index cf2e704fd..cf2e704fd 100644 --- a/testing/tests/host2host-transport/test.conf +++ b/testing/tests/ikev1/host2host-transport/test.conf diff --git a/testing/tests/ike-alg-sha2_384/description.txt b/testing/tests/ikev1/ike-alg-sha2_384/description.txt index a347a3fed..a347a3fed 100644 --- a/testing/tests/ike-alg-sha2_384/description.txt +++ b/testing/tests/ikev1/ike-alg-sha2_384/description.txt diff --git a/testing/tests/ike-alg-sha2_384/evaltest.dat b/testing/tests/ikev1/ike-alg-sha2_384/evaltest.dat index 31959f53a..31959f53a 100644 --- a/testing/tests/ike-alg-sha2_384/evaltest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_384/evaltest.dat diff --git a/testing/tests/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf index 027ad4fd2..2bf2f8740 100755 --- a/testing/tests/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf index 46742d8fb..5baf8f1d9 100755 --- a/testing/tests/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-sha2_384/posttest.dat b/testing/tests/ikev1/ike-alg-sha2_384/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/ike-alg-sha2_384/posttest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_384/posttest.dat diff --git a/testing/tests/ike-alg-sha2_384/pretest.dat b/testing/tests/ikev1/ike-alg-sha2_384/pretest.dat index 87e219e73..7d077c126 100644 --- a/testing/tests/ike-alg-sha2_384/pretest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_384/pretest.dat @@ -1,5 +1,5 @@ moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start -carol::sleep 3 +carol::sleep 2 carol::ipsec up home diff --git a/testing/tests/ike-alg-sha2_384/test.conf b/testing/tests/ikev1/ike-alg-sha2_384/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/ike-alg-sha2_384/test.conf +++ b/testing/tests/ikev1/ike-alg-sha2_384/test.conf diff --git a/testing/tests/ike-alg-sha2_512/description.txt b/testing/tests/ikev1/ike-alg-sha2_512/description.txt index 1bec4b8c6..1bec4b8c6 100644 --- a/testing/tests/ike-alg-sha2_512/description.txt +++ b/testing/tests/ikev1/ike-alg-sha2_512/description.txt diff --git a/testing/tests/ike-alg-sha2_512/evaltest.dat b/testing/tests/ikev1/ike-alg-sha2_512/evaltest.dat index dbd35429c..dbd35429c 100644 --- a/testing/tests/ike-alg-sha2_512/evaltest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_512/evaltest.dat diff --git a/testing/tests/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf index 1f73cdc21..8b1052f91 100755 --- a/testing/tests/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf index 90911997e..62b93c428 100755 --- a/testing/tests/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-sha2_512/posttest.dat b/testing/tests/ikev1/ike-alg-sha2_512/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/ike-alg-sha2_512/posttest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_512/posttest.dat diff --git a/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat b/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat new file mode 100644 index 000000000..7d077c126 --- /dev/null +++ b/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat @@ -0,0 +1,5 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +carol::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ike-alg-sha2_512/test.conf b/testing/tests/ikev1/ike-alg-sha2_512/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/ike-alg-sha2_512/test.conf +++ b/testing/tests/ikev1/ike-alg-sha2_512/test.conf diff --git a/testing/tests/ike-alg-strict-fail/description.txt b/testing/tests/ikev1/ike-alg-strict-fail/description.txt index 03c655480..03c655480 100644 --- a/testing/tests/ike-alg-strict-fail/description.txt +++ b/testing/tests/ikev1/ike-alg-strict-fail/description.txt diff --git a/testing/tests/ike-alg-strict-fail/evaltest.dat b/testing/tests/ikev1/ike-alg-strict-fail/evaltest.dat index 931b8855a..931b8855a 100644 --- a/testing/tests/ike-alg-strict-fail/evaltest.dat +++ b/testing/tests/ikev1/ike-alg-strict-fail/evaltest.dat diff --git a/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..4ed2fb645 --- /dev/null +++ b/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + ike=3des-sha + esp=3des-sha1 +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf index 85cd235dc..1a8b0b966 100755 --- a/testing/tests/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-strict-fail/posttest.dat b/testing/tests/ikev1/ike-alg-strict-fail/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/ike-alg-strict-fail/posttest.dat +++ b/testing/tests/ikev1/ike-alg-strict-fail/posttest.dat diff --git a/testing/tests/esp-alg-strict/pretest.dat b/testing/tests/ikev1/ike-alg-strict-fail/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/esp-alg-strict/pretest.dat +++ b/testing/tests/ikev1/ike-alg-strict-fail/pretest.dat diff --git a/testing/tests/ike-alg-strict-fail/test.conf b/testing/tests/ikev1/ike-alg-strict-fail/test.conf index 7e7848831..7e7848831 100644 --- a/testing/tests/ike-alg-strict-fail/test.conf +++ b/testing/tests/ikev1/ike-alg-strict-fail/test.conf diff --git a/testing/tests/ike-alg-strict/description.txt b/testing/tests/ikev1/ike-alg-strict/description.txt index 35d266e20..35d266e20 100644 --- a/testing/tests/ike-alg-strict/description.txt +++ b/testing/tests/ikev1/ike-alg-strict/description.txt diff --git a/testing/tests/ike-alg-strict/evaltest.dat b/testing/tests/ikev1/ike-alg-strict/evaltest.dat index 46140be8a..46140be8a 100644 --- a/testing/tests/ike-alg-strict/evaltest.dat +++ b/testing/tests/ikev1/ike-alg-strict/evaltest.dat diff --git a/testing/tests/ike-alg-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict/hosts/carol/etc/ipsec.conf index 5a14de070..da86d14df 100755 --- a/testing/tests/ike-alg-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict/hosts/moon/etc/ipsec.conf index 85cd235dc..1a8b0b966 100755 --- a/testing/tests/ike-alg-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-strict/posttest.dat b/testing/tests/ikev1/ike-alg-strict/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/ike-alg-strict/posttest.dat +++ b/testing/tests/ikev1/ike-alg-strict/posttest.dat diff --git a/testing/tests/ike-alg-strict-fail/pretest.dat b/testing/tests/ikev1/ike-alg-strict/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/ike-alg-strict-fail/pretest.dat +++ b/testing/tests/ikev1/ike-alg-strict/pretest.dat diff --git a/testing/tests/ike-alg-strict/test.conf b/testing/tests/ikev1/ike-alg-strict/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/ike-alg-strict/test.conf +++ b/testing/tests/ikev1/ike-alg-strict/test.conf diff --git a/testing/tests/mode-config-push/description.txt b/testing/tests/ikev1/mode-config-push/description.txt index 387c3b409..387c3b409 100644 --- a/testing/tests/mode-config-push/description.txt +++ b/testing/tests/ikev1/mode-config-push/description.txt diff --git a/testing/tests/mode-config-push/evaltest.dat b/testing/tests/ikev1/mode-config-push/evaltest.dat index 7de32d681..7de32d681 100644 --- a/testing/tests/mode-config-push/evaltest.dat +++ b/testing/tests/ikev1/mode-config-push/evaltest.dat diff --git a/testing/tests/mode-config-push/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/carol/etc/ipsec.conf index d66c4d329..db8cfd5c4 100755 --- a/testing/tests/mode-config-push/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-push/hosts/carol/etc/ipsec.conf @@ -1,18 +1,16 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 - modeconfig=push conn home left=PH_IP_CAROL @@ -24,6 +22,7 @@ conn home right=PH_IP_MOON rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org + modeconfig=push auto=add diff --git a/testing/tests/mode-config-push/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/dave/etc/ipsec.conf index bf2625148..cc330b47f 100755 --- a/testing/tests/mode-config-push/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-push/hosts/dave/etc/ipsec.conf @@ -1,18 +1,16 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 - modeconfig=push conn home left=PH_IP_DAVE @@ -24,6 +22,7 @@ conn home right=PH_IP_MOON rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org + modeconfig=push auto=add diff --git a/testing/tests/mode-config-push/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/moon/etc/ipsec.conf index 3416c5d68..3de856642 100755 --- a/testing/tests/mode-config-push/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-push/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default modeconfig=push left=PH_IP_MOON leftsubnet=10.1.0.0/16 - leftsourceip=PH_IP1_MOON + leftsourceip=PH_IP_MOON1 leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org @@ -24,11 +23,11 @@ conn %default conn rw-carol right=%any rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 auto=add conn rw-dave right=%any rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/ikev1/mode-config-push/posttest.dat b/testing/tests/ikev1/mode-config-push/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/mode-config-push/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/mode-config-swapped/pretest.dat b/testing/tests/ikev1/mode-config-push/pretest.dat index 1e45f00fd..bb222992e 100644 --- a/testing/tests/mode-config-swapped/pretest.dat +++ b/testing/tests/ikev1/mode-config-push/pretest.dat @@ -7,3 +7,4 @@ moon::ipsec start carol::sleep 2 carol::ipsec up home dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/mode-config-push/test.conf b/testing/tests/ikev1/mode-config-push/test.conf index 1a8f2a4e0..1a8f2a4e0 100644 --- a/testing/tests/mode-config-push/test.conf +++ b/testing/tests/ikev1/mode-config-push/test.conf diff --git a/testing/tests/mode-config-swapped/description.txt b/testing/tests/ikev1/mode-config-swapped/description.txt index e29e6f654..e29e6f654 100644 --- a/testing/tests/mode-config-swapped/description.txt +++ b/testing/tests/ikev1/mode-config-swapped/description.txt diff --git a/testing/tests/starter-includes/evaltest.dat b/testing/tests/ikev1/mode-config-swapped/evaltest.dat index 7de32d681..9d60cf7b0 100644 --- a/testing/tests/starter-includes/evaltest.dat +++ b/testing/tests/ikev1/mode-config-swapped/evaltest.dat @@ -1,7 +1,7 @@ -carol::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.1::YES +carol::cat /var/log/auth.log::setting virtual IP source address to PH_IP_CAROL1::YES carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.2::YES +dave::cat /var/log/auth.log::setting virtual IP source address to PH_IP_DAVE1::YES dave::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::ipsec status::rw-carol.*STATE_QUICK_R2.*IPsec SA established::YES diff --git a/testing/tests/mode-config-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/carol/etc/ipsec.conf index bee23f4df..3bcc0ff25 100755 --- a/testing/tests/mode-config-swapped/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-swapped/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/mode-config-swapped/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/dave/etc/ipsec.conf index 698cd9673..7933ef15a 100755 --- a/testing/tests/mode-config-swapped/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-swapped/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/mode-config-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/moon/etc/ipsec.conf index b9e401080..53b81a534 100755 --- a/testing/tests/mode-config-swapped/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-swapped/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -14,7 +13,7 @@ conn %default keyingtries=1 right=PH_IP_MOON rightsubnet=10.1.0.0/16 - rightsourceip=PH_IP1_MOON + rightsourceip=PH_IP_MOON1 rightnexthop=%direct rightcert=moonCert.pem rightid=@moon.strongswan.org @@ -23,11 +22,11 @@ conn %default conn rw-carol left=%any leftid=carol@strongswan.org - leftsourceip=PH_IP1_CAROL + leftsourceip=PH_IP_CAROL1 auto=add conn rw-dave left=%any leftid=dave@strongswan.org - leftsourceip=PH_IP1_DAVE + leftsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/ikev1/mode-config-swapped/posttest.dat b/testing/tests/ikev1/mode-config-swapped/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/mode-config-swapped/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/mode-config-push/pretest.dat b/testing/tests/ikev1/mode-config-swapped/pretest.dat index 1e45f00fd..1e45f00fd 100644 --- a/testing/tests/mode-config-push/pretest.dat +++ b/testing/tests/ikev1/mode-config-swapped/pretest.dat diff --git a/testing/tests/mode-config-swapped/test.conf b/testing/tests/ikev1/mode-config-swapped/test.conf index 1a8f2a4e0..1a8f2a4e0 100644 --- a/testing/tests/mode-config-swapped/test.conf +++ b/testing/tests/ikev1/mode-config-swapped/test.conf diff --git a/testing/tests/mode-config/description.txt b/testing/tests/ikev1/mode-config/description.txt index 3e67f83f1..3e67f83f1 100644 --- a/testing/tests/mode-config/description.txt +++ b/testing/tests/ikev1/mode-config/description.txt diff --git a/testing/tests/mode-config/evaltest.dat b/testing/tests/ikev1/mode-config/evaltest.dat index 7de32d681..9d60cf7b0 100644 --- a/testing/tests/mode-config/evaltest.dat +++ b/testing/tests/ikev1/mode-config/evaltest.dat @@ -1,7 +1,7 @@ -carol::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.1::YES +carol::cat /var/log/auth.log::setting virtual IP source address to PH_IP_CAROL1::YES carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.2::YES +dave::cat /var/log/auth.log::setting virtual IP source address to PH_IP_DAVE1::YES dave::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::ipsec status::rw-carol.*STATE_QUICK_R2.*IPsec SA established::YES diff --git a/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..2fd734579 --- /dev/null +++ b/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftsourceip=%modeconfig + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/starter-includes/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/dave/etc/ipsec.conf index da601389c..128c4aa29 100755 --- a/testing/tests/starter-includes/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/moon/etc/ipsec.conf index 49333e217..3367544eb 100755 --- a/testing/tests/mode-config/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -14,7 +13,7 @@ conn %default keyingtries=1 left=PH_IP_MOON leftsubnet=10.1.0.0/16 - leftsourceip=PH_IP1_MOON + leftsourceip=PH_IP_MOON1 leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org @@ -23,11 +22,11 @@ conn %default conn rw-carol right=%any rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 auto=add conn rw-dave right=%any rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/ikev1/mode-config/posttest.dat b/testing/tests/ikev1/mode-config/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/mode-config/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/mode-config/pretest.dat b/testing/tests/ikev1/mode-config/pretest.dat index 1e45f00fd..bb222992e 100644 --- a/testing/tests/mode-config/pretest.dat +++ b/testing/tests/ikev1/mode-config/pretest.dat @@ -7,3 +7,4 @@ moon::ipsec start carol::sleep 2 carol::ipsec up home dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/mode-config/test.conf b/testing/tests/ikev1/mode-config/test.conf index 1a8f2a4e0..1a8f2a4e0 100644 --- a/testing/tests/mode-config/test.conf +++ b/testing/tests/ikev1/mode-config/test.conf diff --git a/testing/tests/multi-level-ca-ldap/description.txt b/testing/tests/ikev1/multi-level-ca-ldap/description.txt index 18fb88840..18fb88840 100644 --- a/testing/tests/multi-level-ca-ldap/description.txt +++ b/testing/tests/ikev1/multi-level-ca-ldap/description.txt diff --git a/testing/tests/multi-level-ca-ldap/evaltest.dat b/testing/tests/ikev1/multi-level-ca-ldap/evaltest.dat index f504706e2..f504706e2 100644 --- a/testing/tests/multi-level-ca-ldap/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca-ldap/evaltest.dat diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf index 222c3cf67..2917edd8a 100755 --- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf index bfa0ebba3..3c8227f19 100755 --- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem index b76032480..b76032480 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem index 022436de4..022436de4 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables index 8de514a2e..8de514a2e 100755 --- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf index e2b60589b..9b1d03320 100755 --- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem index 154cff654..154cff654 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem index e50477872..e50477872 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem diff --git a/testing/tests/multi-level-ca-ldap/posttest.dat b/testing/tests/ikev1/multi-level-ca-ldap/posttest.dat index e618fc419..ec4ba6e10 100644 --- a/testing/tests/multi-level-ca-ldap/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca-ldap/posttest.dat @@ -1,4 +1,3 @@ -moon::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/multi-level-ca-ldap/pretest.dat b/testing/tests/ikev1/multi-level-ca-ldap/pretest.dat index 322f42102..322f42102 100644 --- a/testing/tests/multi-level-ca-ldap/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-ldap/pretest.dat diff --git a/testing/tests/multi-level-ca-ldap/test.conf b/testing/tests/ikev1/multi-level-ca-ldap/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/multi-level-ca-ldap/test.conf +++ b/testing/tests/ikev1/multi-level-ca-ldap/test.conf diff --git a/testing/tests/multi-level-ca-loop/description.txt b/testing/tests/ikev1/multi-level-ca-loop/description.txt index 9b63c2c66..9b63c2c66 100644 --- a/testing/tests/multi-level-ca-loop/description.txt +++ b/testing/tests/ikev1/multi-level-ca-loop/description.txt diff --git a/testing/tests/multi-level-ca-loop/evaltest.dat b/testing/tests/ikev1/multi-level-ca-loop/evaltest.dat index 781a7b4ac..781a7b4ac 100644 --- a/testing/tests/multi-level-ca-loop/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca-loop/evaltest.dat diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.conf index c56678b59..2c645ead6 100755 --- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.conf index 343042f15..dcf3c94c7 100755 --- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem index efb939e3a..efb939e3a 100644 --- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem index 90e207c4b..90e207c4b 100644 --- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem diff --git a/testing/tests/multi-level-ca-loop/posttest.dat b/testing/tests/ikev1/multi-level-ca-loop/posttest.dat index 076f51f4d..076f51f4d 100644 --- a/testing/tests/multi-level-ca-loop/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca-loop/posttest.dat diff --git a/testing/tests/multi-level-ca-loop/pretest.dat b/testing/tests/ikev1/multi-level-ca-loop/pretest.dat index 0a0ec22bf..0a0ec22bf 100644 --- a/testing/tests/multi-level-ca-loop/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-loop/pretest.dat diff --git a/testing/tests/multi-level-ca-loop/test.conf b/testing/tests/ikev1/multi-level-ca-loop/test.conf index 3189fdfc7..3189fdfc7 100644 --- a/testing/tests/multi-level-ca-loop/test.conf +++ b/testing/tests/ikev1/multi-level-ca-loop/test.conf diff --git a/testing/tests/multi-level-ca-revoked/description.txt b/testing/tests/ikev1/multi-level-ca-revoked/description.txt index c91ac285b..c91ac285b 100644 --- a/testing/tests/multi-level-ca-revoked/description.txt +++ b/testing/tests/ikev1/multi-level-ca-revoked/description.txt diff --git a/testing/tests/multi-level-ca-revoked/evaltest.dat b/testing/tests/ikev1/multi-level-ca-revoked/evaltest.dat index 0fd1cae8c..0fd1cae8c 100644 --- a/testing/tests/multi-level-ca-revoked/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca-revoked/evaltest.dat diff --git a/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..93bd80758 --- /dev/null +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf index 39a298de9..ab336c3c8 100755 --- a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem index c380a5110..c380a5110 100644 --- a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem diff --git a/testing/tests/multi-level-ca-revoked/posttest.dat b/testing/tests/ikev1/multi-level-ca-revoked/posttest.dat index f84b7e37b..f84b7e37b 100644 --- a/testing/tests/multi-level-ca-revoked/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca-revoked/posttest.dat diff --git a/testing/tests/multi-level-ca-revoked/pretest.dat b/testing/tests/ikev1/multi-level-ca-revoked/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/multi-level-ca-revoked/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-revoked/pretest.dat diff --git a/testing/tests/multi-level-ca-revoked/test.conf b/testing/tests/ikev1/multi-level-ca-revoked/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/multi-level-ca-revoked/test.conf +++ b/testing/tests/ikev1/multi-level-ca-revoked/test.conf diff --git a/testing/tests/multi-level-ca-strict/description.txt b/testing/tests/ikev1/multi-level-ca-strict/description.txt index 32413e3de..32413e3de 100644 --- a/testing/tests/multi-level-ca-strict/description.txt +++ b/testing/tests/ikev1/multi-level-ca-strict/description.txt diff --git a/testing/tests/multi-level-ca-strict/evaltest.dat b/testing/tests/ikev1/multi-level-ca-strict/evaltest.dat index 5a181a62d..5a181a62d 100644 --- a/testing/tests/multi-level-ca-strict/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca-strict/evaltest.dat diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.conf index de179c565..d6d32a39d 100755 --- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.conf index 2fb6a301e..6156fadba 100755 --- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem index b76032480..b76032480 100644 --- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem index 022436de4..022436de4 100644 --- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.conf index 6ed262d20..6b4e37b35 100755 --- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem index 154cff654..154cff654 100644 --- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem index e50477872..e50477872 100644 --- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem diff --git a/testing/tests/multi-level-ca-strict/posttest.dat b/testing/tests/ikev1/multi-level-ca-strict/posttest.dat index 1646d5ed2..1646d5ed2 100644 --- a/testing/tests/multi-level-ca-strict/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca-strict/posttest.dat diff --git a/testing/tests/multi-level-ca-strict/pretest.dat b/testing/tests/ikev1/multi-level-ca-strict/pretest.dat index 67c50c2ef..67c50c2ef 100644 --- a/testing/tests/multi-level-ca-strict/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-strict/pretest.dat diff --git a/testing/tests/multi-level-ca-strict/test.conf b/testing/tests/ikev1/multi-level-ca-strict/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/multi-level-ca-strict/test.conf +++ b/testing/tests/ikev1/multi-level-ca-strict/test.conf diff --git a/testing/tests/multi-level-ca/description.txt b/testing/tests/ikev1/multi-level-ca/description.txt index 64825cb30..64825cb30 100644 --- a/testing/tests/multi-level-ca/description.txt +++ b/testing/tests/ikev1/multi-level-ca/description.txt diff --git a/testing/tests/multi-level-ca/evaltest.dat b/testing/tests/ikev1/multi-level-ca/evaltest.dat index 72f620b8e..72f620b8e 100644 --- a/testing/tests/multi-level-ca/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca/evaltest.dat diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.conf index e851a82f0..316cdaecc 100755 --- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.conf index 458a4ca5e..5838f5f2f 100755 --- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem index b76032480..b76032480 100644 --- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem index 022436de4..022436de4 100644 --- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.conf index e60bbc016..e47d453e4 100755 --- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem index 154cff654..154cff654 100644 --- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem index e50477872..e50477872 100644 --- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem diff --git a/testing/tests/multi-level-ca/posttest.dat b/testing/tests/ikev1/multi-level-ca/posttest.dat index 1646d5ed2..1646d5ed2 100644 --- a/testing/tests/multi-level-ca/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca/posttest.dat diff --git a/testing/tests/multi-level-ca/pretest.dat b/testing/tests/ikev1/multi-level-ca/pretest.dat index 67c50c2ef..67c50c2ef 100644 --- a/testing/tests/multi-level-ca/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca/pretest.dat diff --git a/testing/tests/multi-level-ca/test.conf b/testing/tests/ikev1/multi-level-ca/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/multi-level-ca/test.conf +++ b/testing/tests/ikev1/multi-level-ca/test.conf diff --git a/testing/tests/ikev1/nat-before-esp/description.txt b/testing/tests/ikev1/nat-before-esp/description.txt new file mode 100644 index 000000000..e42ace476 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/description.txt @@ -0,0 +1,6 @@ +An IPsec tunnel connecting the gateway <b>moon</b> with the subnet behind +gateway <b>sun</b> is set up. This host-to-net connection can also be +used by the clients <b>alice</b> and <b>venus</b> via the trick of NAT-ing +them to the outer IP address of gateway <b>moon</b> prior to tunnelling. +The IPsec tunnel is first tested by <b>moon</b> pinging <b>bob</b> and vice versa, +followed by the NAT-ed clients <b>alice</b> and <b>venus</b> pinging <b>bob</b>. diff --git a/testing/tests/ikev1/nat-before-esp/evaltest.dat b/testing/tests/ikev1/nat-before-esp/evaltest.dat new file mode 100644 index 000000000..d466038ed --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/evaltest.dat @@ -0,0 +1,9 @@ +moon::ipsec status::host-net.*STATE_QUICK_I2.*IPsec SA established::YES +sun::ipsec status::host-net.*STATE_QUICK_R2.*IPsec SA established::YES +moon::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +bob::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +bob::tcpdump::ICMP::YES diff --git a/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables new file mode 100755 index 000000000..f87ec0e58 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables @@ -0,0 +1,83 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +opts="start stop reload" + +depend() { + before net + need logger +} + +start() { + ebegin "Starting firewall" + + # enable IP forwarding + echo 1 > /proc/sys/net/ipv4/ip_forward + + # default policy is DROP + /sbin/iptables -P INPUT DROP + /sbin/iptables -P OUTPUT DROP + /sbin/iptables -P FORWARD DROP + + # NAT traffic from 10.1.0.0/16 + iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -j MASQUERADE + + # forward traffic from 10.1.0.0/16 to POSTROUTING chain + iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -d 10.2.0.0/16 -j ACCEPT + iptables -A FORWARD -o eth1 -i eth0 -d 10.1.0.0/16 -s 10.2.0.0/16 -j ACCEPT + + # allow esp + iptables -A INPUT -i eth0 -p 50 -j ACCEPT + iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT + + # allow IKE + iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT + iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + + # allow crl fetch from winnetou + iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT + iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + + # allow ssh + iptables -A INPUT -p tcp --dport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + + eend $? +} + +stop() { + ebegin "Stopping firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + + if [ $a == nat ]; then + /sbin/iptables -t nat -P PREROUTING ACCEPT + /sbin/iptables -t nat -P POSTROUTING ACCEPT + /sbin/iptables -t nat -P OUTPUT ACCEPT + elif [ $a == mangle ]; then + /sbin/iptables -t mangle -P PREROUTING ACCEPT + /sbin/iptables -t mangle -P INPUT ACCEPT + /sbin/iptables -t mangle -P FORWARD ACCEPT + /sbin/iptables -t mangle -P OUTPUT ACCEPT + /sbin/iptables -t mangle -P POSTROUTING ACCEPT + elif [ $a == filter ]; then + /sbin/iptables -t filter -P INPUT ACCEPT + /sbin/iptables -t filter -P FORWARD ACCEPT + /sbin/iptables -t filter -P OUTPUT ACCEPT + fi + done + eend $? +} + +reload() { + ebegin "Flushing firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + done; + eend $? + start +} + diff --git a/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..9637dcf06 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn host-net + left=192.168.0.1 + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=192.168.0.2 + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=add diff --git a/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..506417867 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + nat_traversal=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn host-net + left=192.168.0.2 + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + leftsubnet=10.2.0.0/16 + right=%any + auto=add diff --git a/testing/tests/host2host-swapped/posttest.dat b/testing/tests/ikev1/nat-before-esp/posttest.dat index 52979508d..307b96888 100644 --- a/testing/tests/host2host-swapped/posttest.dat +++ b/testing/tests/ikev1/nat-before-esp/posttest.dat @@ -1,5 +1,4 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L +moon::iptables -t nat -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev1/nat-before-esp/pretest.dat b/testing/tests/ikev1/nat-before-esp/pretest.dat new file mode 100644 index 000000000..75565540a --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 2 +moon::ipsec up host-net diff --git a/testing/tests/ikev1/nat-before-esp/test.conf b/testing/tests/ikev1/nat-before-esp/test.conf new file mode 100644 index 000000000..4234eaf63 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun bob" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/nat-one-rw/description.txt b/testing/tests/ikev1/nat-one-rw/description.txt index c3b9bb820..c3b9bb820 100644 --- a/testing/tests/nat-one-rw/description.txt +++ b/testing/tests/ikev1/nat-one-rw/description.txt diff --git a/testing/tests/nat-one-rw/evaltest.dat b/testing/tests/ikev1/nat-one-rw/evaltest.dat index bc193963d..bc193963d 100644 --- a/testing/tests/nat-one-rw/evaltest.dat +++ b/testing/tests/ikev1/nat-one-rw/evaltest.dat diff --git a/testing/tests/nat-one-rw/posttest.dat b/testing/tests/ikev1/nat-one-rw/posttest.dat index af8e00575..cd0d4df25 100644 --- a/testing/tests/nat-one-rw/posttest.dat +++ b/testing/tests/ikev1/nat-one-rw/posttest.dat @@ -1,8 +1,6 @@ -alice::iptables -v -n -L -sun::iptables -v -n -L alice::ipsec stop sun::ipsec stop alice::/etc/init.d/iptables stop 2> /dev/null sun::/etc/init.d/iptables stop 2> /dev/null moon::iptables -t nat -F - +moon::conntrack -F diff --git a/testing/tests/nat-one-rw/pretest.dat b/testing/tests/ikev1/nat-one-rw/pretest.dat index 9dacc672c..9dacc672c 100644 --- a/testing/tests/nat-one-rw/pretest.dat +++ b/testing/tests/ikev1/nat-one-rw/pretest.dat diff --git a/testing/tests/nat-one-rw/test.conf b/testing/tests/ikev1/nat-one-rw/test.conf index d84149aaf..d84149aaf 100644 --- a/testing/tests/nat-one-rw/test.conf +++ b/testing/tests/ikev1/nat-one-rw/test.conf diff --git a/testing/tests/ikev1/nat-two-rw-psk/description.txt b/testing/tests/ikev1/nat-two-rw-psk/description.txt new file mode 100644 index 000000000..c74897d9a --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up +tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +Both roadwarriors share the same Pre-Shared Key (PSK) with the gateway <b>sun</b>. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b> +ping the client <b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat b/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat new file mode 100644 index 000000000..e8aaf0b5f --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat @@ -0,0 +1,9 @@ +alice::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES +venus::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES +sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES +sun::ipsec status::nat-t.*\[PH_IP_ALICE\]::YES +sun::ipsec status::nat-t.*\[PH_IP_VENUS\]::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..e8576f0e7 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + nat_traversal=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + +conn nat-t + left=%defaultroute + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets index e8c151f05..e8c151f05 100644 --- a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..573069f75 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + nat_traversal=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + leftnexthop=%direct + +conn nat-t + left=PH_IP_SUN + leftsubnet=10.2.0.0/16 + leftfirewall=yes + right=%any + rightsubnetwithin=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets new file mode 100644 index 000000000..e8c151f05 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf new file mode 100755 index 000000000..e8576f0e7 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + nat_traversal=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + +conn nat-t + left=%defaultroute + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets new file mode 100644 index 000000000..e8c151f05 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL diff --git a/testing/tests/nat-two-rw/posttest.dat b/testing/tests/ikev1/nat-two-rw-psk/posttest.dat index f019842ed..52572ece8 100644 --- a/testing/tests/nat-two-rw/posttest.dat +++ b/testing/tests/ikev1/nat-two-rw-psk/posttest.dat @@ -1,6 +1,3 @@ -alice::iptables -v -n -L -venus::iptables -v -n -L -sun::iptables -v -n -L sun::ipsec stop alice::ipsec stop venus::ipsec stop @@ -8,4 +5,4 @@ alice::/etc/init.d/iptables stop 2> /dev/null venus::/etc/init.d/iptables stop 2> /dev/null sun::/etc/init.d/iptables stop 2> /dev/null moon::iptables -t nat -F - +moon::conntrack -F diff --git a/testing/tests/ikev1/nat-two-rw-psk/pretest.dat b/testing/tests/ikev1/nat-two-rw-psk/pretest.dat new file mode 100644 index 000000000..6172bd088 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/pretest.dat @@ -0,0 +1,16 @@ +alice::/etc/init.d/iptables start 2> /dev/null +venus::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +alice::rm /etc/ipsec.d/cacerts/* +venus::rm /etc/ipsec.d/cacerts/* +sun::rm /etc/ipsec.d/cacerts/* +alice::ipsec start +venus::ipsec start +sun::ipsec start +alice::sleep 5 +alice::ipsec up nat-t +venus::sleep 5 +venus::ipsec up nat-t diff --git a/testing/tests/nat-two-rw/test.conf b/testing/tests/ikev1/nat-two-rw-psk/test.conf index 84317fd70..84317fd70 100644 --- a/testing/tests/nat-two-rw/test.conf +++ b/testing/tests/ikev1/nat-two-rw-psk/test.conf diff --git a/testing/tests/nat-two-rw/description.txt b/testing/tests/ikev1/nat-two-rw/description.txt index dcf4b94bd..dcf4b94bd 100644 --- a/testing/tests/nat-two-rw/description.txt +++ b/testing/tests/ikev1/nat-two-rw/description.txt diff --git a/testing/tests/nat-two-rw/evaltest.dat b/testing/tests/ikev1/nat-two-rw/evaltest.dat index b1a7d59ee..b1a7d59ee 100644 --- a/testing/tests/nat-two-rw/evaltest.dat +++ b/testing/tests/ikev1/nat-two-rw/evaltest.dat diff --git a/testing/tests/ikev1/nat-two-rw/posttest.dat b/testing/tests/ikev1/nat-two-rw/posttest.dat new file mode 100644 index 000000000..52572ece8 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw/posttest.dat @@ -0,0 +1,8 @@ +sun::ipsec stop +alice::ipsec stop +venus::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/nat-two-rw/pretest.dat b/testing/tests/ikev1/nat-two-rw/pretest.dat index dd5259936..dd5259936 100644 --- a/testing/tests/nat-two-rw/pretest.dat +++ b/testing/tests/ikev1/nat-two-rw/pretest.dat diff --git a/testing/tests/ikev1/nat-two-rw/test.conf b/testing/tests/ikev1/nat-two-rw/test.conf new file mode 100644 index 000000000..84317fd70 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice venus sun" diff --git a/testing/tests/net2net-cert/description.txt b/testing/tests/ikev1/net2net-cert/description.txt index 7eea9192f..7eea9192f 100644 --- a/testing/tests/net2net-cert/description.txt +++ b/testing/tests/ikev1/net2net-cert/description.txt diff --git a/testing/tests/net2net-cert/evaltest.dat b/testing/tests/ikev1/net2net-cert/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-cert/evaltest.dat +++ b/testing/tests/ikev1/net2net-cert/evaltest.dat diff --git a/testing/tests/ikev1/net2net-cert/posttest.dat b/testing/tests/ikev1/net2net-cert/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-cert/pretest.dat b/testing/tests/ikev1/net2net-cert/pretest.dat index 9f60760c6..9f60760c6 100644 --- a/testing/tests/net2net-cert/pretest.dat +++ b/testing/tests/ikev1/net2net-cert/pretest.dat diff --git a/testing/tests/net2net-cert/test.conf b/testing/tests/ikev1/net2net-cert/test.conf index d9a61590f..d9a61590f 100644 --- a/testing/tests/net2net-cert/test.conf +++ b/testing/tests/ikev1/net2net-cert/test.conf diff --git a/testing/tests/net2net-pgp/description.txt b/testing/tests/ikev1/net2net-pgp/description.txt index c85f2e5d0..c85f2e5d0 100644 --- a/testing/tests/net2net-pgp/description.txt +++ b/testing/tests/ikev1/net2net-pgp/description.txt diff --git a/testing/tests/net2net-pgp/evaltest.dat b/testing/tests/ikev1/net2net-pgp/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-pgp/evaltest.dat +++ b/testing/tests/ikev1/net2net-pgp/evaltest.dat diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.conf index e7de6cf0b..eb72ed85f 100755 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.conf @@ -1,10 +1,9 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control nocrsend=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc index 135cfaec0..135cfaec0 100644 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc index 32f204b10..32f204b10 100644 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc index 6524773e0..6524773e0 100644 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.secrets index afb1ff927..afb1ff927 100644 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.conf index 5dd8a8587..205f235c8 100755 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.conf @@ -1,10 +1,9 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control nocrsend=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc index 135cfaec0..135cfaec0 100644 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc index 32f204b10..32f204b10 100644 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc index de2393649..de2393649 100644 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.secrets index ee98b1611..ee98b1611 100644 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.secrets diff --git a/testing/tests/net2net-pgp/posttest.dat b/testing/tests/ikev1/net2net-pgp/posttest.dat index 80e765dfc..fafcde975 100644 --- a/testing/tests/net2net-pgp/posttest.dat +++ b/testing/tests/ikev1/net2net-pgp/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-pgp/pretest.dat b/testing/tests/ikev1/net2net-pgp/pretest.dat index 9e40684ab..9e40684ab 100644 --- a/testing/tests/net2net-pgp/pretest.dat +++ b/testing/tests/ikev1/net2net-pgp/pretest.dat diff --git a/testing/tests/net2net-pgp/test.conf b/testing/tests/ikev1/net2net-pgp/test.conf index f74d0f7d6..f74d0f7d6 100644 --- a/testing/tests/net2net-pgp/test.conf +++ b/testing/tests/ikev1/net2net-pgp/test.conf diff --git a/testing/tests/net2net-psk-fail/description.txt b/testing/tests/ikev1/net2net-psk-fail/description.txt index 5a794bd17..5a794bd17 100644 --- a/testing/tests/net2net-psk-fail/description.txt +++ b/testing/tests/ikev1/net2net-psk-fail/description.txt diff --git a/testing/tests/net2net-psk-fail/evaltest.dat b/testing/tests/ikev1/net2net-psk-fail/evaltest.dat index 7f7cb9726..7f7cb9726 100644 --- a/testing/tests/net2net-psk-fail/evaltest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/evaltest.dat diff --git a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.conf index 87396e455..e095c0b7b 100755 --- a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.secrets index be95c4d99..be95c4d99 100644 --- a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.conf index 7e102b25c..b21f863f5 100755 --- a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.secrets index b53577e1d..b53577e1d 100644 --- a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.secrets diff --git a/testing/tests/net2net-psk-fail/posttest.dat b/testing/tests/ikev1/net2net-psk-fail/posttest.dat index dff181797..dff181797 100644 --- a/testing/tests/net2net-psk-fail/posttest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/posttest.dat diff --git a/testing/tests/net2net-psk-fail/pretest.dat b/testing/tests/ikev1/net2net-psk-fail/pretest.dat index aa8e332e0..aa8e332e0 100644 --- a/testing/tests/net2net-psk-fail/pretest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/pretest.dat diff --git a/testing/tests/net2net-psk-fail/test.conf b/testing/tests/ikev1/net2net-psk-fail/test.conf index f6e064e7d..f6e064e7d 100644 --- a/testing/tests/net2net-psk-fail/test.conf +++ b/testing/tests/ikev1/net2net-psk-fail/test.conf diff --git a/testing/tests/net2net-psk/description.txt b/testing/tests/ikev1/net2net-psk/description.txt index 02cddbb83..02cddbb83 100644 --- a/testing/tests/net2net-psk/description.txt +++ b/testing/tests/ikev1/net2net-psk/description.txt diff --git a/testing/tests/net2net-psk/evaltest.dat b/testing/tests/ikev1/net2net-psk/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-psk/evaltest.dat +++ b/testing/tests/ikev1/net2net-psk/evaltest.dat diff --git a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.conf index 51c53a505..a3536e2b2 100755 --- a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.secrets index be95c4d99..be95c4d99 100644 --- a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.conf index 9c3695178..12e38962e 100755 --- a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.secrets index be95c4d99..be95c4d99 100644 --- a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.secrets diff --git a/testing/tests/ikev1/net2net-psk/posttest.dat b/testing/tests/ikev1/net2net-psk/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-psk/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-psk/pretest.dat b/testing/tests/ikev1/net2net-psk/pretest.dat index 9e40684ab..9e40684ab 100644 --- a/testing/tests/net2net-psk/pretest.dat +++ b/testing/tests/ikev1/net2net-psk/pretest.dat diff --git a/testing/tests/net2net-psk/test.conf b/testing/tests/ikev1/net2net-psk/test.conf index f74d0f7d6..f74d0f7d6 100644 --- a/testing/tests/net2net-psk/test.conf +++ b/testing/tests/ikev1/net2net-psk/test.conf diff --git a/testing/tests/net2net-route/description.txt b/testing/tests/ikev1/net2net-route/description.txt index 323f09555..323f09555 100644 --- a/testing/tests/net2net-route/description.txt +++ b/testing/tests/ikev1/net2net-route/description.txt diff --git a/testing/tests/net2net-route/evaltest.dat b/testing/tests/ikev1/net2net-route/evaltest.dat index 38d589e5a..38d589e5a 100644 --- a/testing/tests/net2net-route/evaltest.dat +++ b/testing/tests/ikev1/net2net-route/evaltest.dat diff --git a/testing/tests/net2net-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-route/hosts/moon/etc/ipsec.conf index 4063ae05f..466235099 100755 --- a/testing/tests/net2net-route/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-route/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ikev1/net2net-route/posttest.dat b/testing/tests/ikev1/net2net-route/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-route/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-route/pretest.dat b/testing/tests/ikev1/net2net-route/pretest.dat index 2eef7de19..2eef7de19 100644 --- a/testing/tests/net2net-route/pretest.dat +++ b/testing/tests/ikev1/net2net-route/pretest.dat diff --git a/testing/tests/net2net-route/test.conf b/testing/tests/ikev1/net2net-route/test.conf index d9a61590f..d9a61590f 100644 --- a/testing/tests/net2net-route/test.conf +++ b/testing/tests/ikev1/net2net-route/test.conf diff --git a/testing/tests/net2net-rsa/description.txt b/testing/tests/ikev1/net2net-rsa/description.txt index a23fae8c3..a23fae8c3 100644 --- a/testing/tests/net2net-rsa/description.txt +++ b/testing/tests/ikev1/net2net-rsa/description.txt diff --git a/testing/tests/net2net-rsa/evaltest.dat b/testing/tests/ikev1/net2net-rsa/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-rsa/evaltest.dat +++ b/testing/tests/ikev1/net2net-rsa/evaltest.dat diff --git a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.conf index 772762321..e4c0614a1 100755 --- a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.secrets index 9859ae8ed..9859ae8ed 100644 --- a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.conf index 9626ef168..d0c8752a3 100755 --- a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.secrets index bf976a8d3..bf976a8d3 100644 --- a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.secrets diff --git a/testing/tests/ikev1/net2net-rsa/posttest.dat b/testing/tests/ikev1/net2net-rsa/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-rsa/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-rsa/pretest.dat b/testing/tests/ikev1/net2net-rsa/pretest.dat index 9e40684ab..9e40684ab 100644 --- a/testing/tests/net2net-rsa/pretest.dat +++ b/testing/tests/ikev1/net2net-rsa/pretest.dat diff --git a/testing/tests/net2net-rsa/test.conf b/testing/tests/ikev1/net2net-rsa/test.conf index f74d0f7d6..f74d0f7d6 100644 --- a/testing/tests/net2net-rsa/test.conf +++ b/testing/tests/ikev1/net2net-rsa/test.conf diff --git a/testing/tests/net2net-start/description.txt b/testing/tests/ikev1/net2net-start/description.txt index f5320685e..f5320685e 100644 --- a/testing/tests/net2net-start/description.txt +++ b/testing/tests/ikev1/net2net-start/description.txt diff --git a/testing/tests/net2net-start/evaltest.dat b/testing/tests/ikev1/net2net-start/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-start/evaltest.dat +++ b/testing/tests/ikev1/net2net-start/evaltest.dat diff --git a/testing/tests/net2net-start/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-start/hosts/moon/etc/ipsec.conf index 677955bc1..95abd046a 100755 --- a/testing/tests/net2net-start/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-start/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ikev1/net2net-start/posttest.dat b/testing/tests/ikev1/net2net-start/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-start/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-start/pretest.dat b/testing/tests/ikev1/net2net-start/pretest.dat index ed8f39316..ed8f39316 100644 --- a/testing/tests/net2net-start/pretest.dat +++ b/testing/tests/ikev1/net2net-start/pretest.dat diff --git a/testing/tests/net2net-start/test.conf b/testing/tests/ikev1/net2net-start/test.conf index d9a61590f..d9a61590f 100644 --- a/testing/tests/net2net-start/test.conf +++ b/testing/tests/ikev1/net2net-start/test.conf diff --git a/testing/tests/no-priv-key/description.txt b/testing/tests/ikev1/no-priv-key/description.txt index 21b8eccb1..21b8eccb1 100644 --- a/testing/tests/no-priv-key/description.txt +++ b/testing/tests/ikev1/no-priv-key/description.txt diff --git a/testing/tests/no-priv-key/evaltest.dat b/testing/tests/ikev1/no-priv-key/evaltest.dat index 9bd85ba12..9bd85ba12 100644 --- a/testing/tests/no-priv-key/evaltest.dat +++ b/testing/tests/ikev1/no-priv-key/evaltest.dat diff --git a/testing/tests/no-priv-key/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/no-priv-key/hosts/carol/etc/ipsec.secrets index 23b311aa6..23b311aa6 100644 --- a/testing/tests/no-priv-key/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/no-priv-key/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/no-priv-key/posttest.dat b/testing/tests/ikev1/no-priv-key/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/no-priv-key/posttest.dat +++ b/testing/tests/ikev1/no-priv-key/posttest.dat diff --git a/testing/tests/no-priv-key/pretest.dat b/testing/tests/ikev1/no-priv-key/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/no-priv-key/pretest.dat +++ b/testing/tests/ikev1/no-priv-key/pretest.dat diff --git a/testing/tests/no-priv-key/test.conf b/testing/tests/ikev1/no-priv-key/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/no-priv-key/test.conf +++ b/testing/tests/ikev1/no-priv-key/test.conf diff --git a/testing/tests/ocsp-revoked/description.txt b/testing/tests/ikev1/ocsp-revoked/description.txt index cbdd1305a..cbdd1305a 100644 --- a/testing/tests/ocsp-revoked/description.txt +++ b/testing/tests/ikev1/ocsp-revoked/description.txt diff --git a/testing/tests/ocsp-revoked/evaltest.dat b/testing/tests/ikev1/ocsp-revoked/evaltest.dat index f5286cb61..f5286cb61 100644 --- a/testing/tests/ocsp-revoked/evaltest.dat +++ b/testing/tests/ikev1/ocsp-revoked/evaltest.dat diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.conf index 7d4384767..5b32ef007 100755 --- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem index 5b742fc9e..5b742fc9e 100644 --- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem +++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem index 8aefcc5a6..8aefcc5a6 100644 --- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem +++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.secrets index 8e31be4cb..8e31be4cb 100644 --- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/ocsp-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ocsp-revoked/hosts/moon/etc/ipsec.conf index 7134b6ee9..d9da3f78a 100755 --- a/testing/tests/ocsp-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ocsp-revoked/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/ocsp-revoked/posttest.dat b/testing/tests/ikev1/ocsp-revoked/posttest.dat index d883459e7..d742e8410 100644 --- a/testing/tests/ocsp-revoked/posttest.dat +++ b/testing/tests/ikev1/ocsp-revoked/posttest.dat @@ -1,5 +1,4 @@ moon::ipsec stop carol::ipsec stop -winnetou::killall openssl carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/xauth-rsa-nosecret/pretest.dat b/testing/tests/ikev1/ocsp-revoked/pretest.dat index f5aa989fe..d92333d86 100644 --- a/testing/tests/xauth-rsa-nosecret/pretest.dat +++ b/testing/tests/ikev1/ocsp-revoked/pretest.dat @@ -1,4 +1,4 @@ -carol::ipsec start moon::ipsec start +carol::ipsec start carol::sleep 2 carol::ipsec up home diff --git a/testing/tests/ocsp-revoked/test.conf b/testing/tests/ikev1/ocsp-revoked/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/ocsp-revoked/test.conf +++ b/testing/tests/ikev1/ocsp-revoked/test.conf diff --git a/testing/tests/ocsp-strict/description.txt b/testing/tests/ikev1/ocsp-strict/description.txt index 7cb983140..7cb983140 100644 --- a/testing/tests/ocsp-strict/description.txt +++ b/testing/tests/ikev1/ocsp-strict/description.txt diff --git a/testing/tests/ocsp-strict/evaltest.dat b/testing/tests/ikev1/ocsp-strict/evaltest.dat index 66b27aaac..66b27aaac 100644 --- a/testing/tests/ocsp-strict/evaltest.dat +++ b/testing/tests/ikev1/ocsp-strict/evaltest.dat diff --git a/testing/tests/ocsp-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ocsp-strict/hosts/carol/etc/ipsec.conf index b34719401..fd950ecd5 100755 --- a/testing/tests/ocsp-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ocsp-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/ocsp-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ocsp-strict/hosts/moon/etc/ipsec.conf index 7134b6ee9..d9da3f78a 100755 --- a/testing/tests/ocsp-revoked/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ocsp-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/rw-psk-no-policy/posttest.dat b/testing/tests/ikev1/ocsp-strict/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/rw-psk-no-policy/posttest.dat +++ b/testing/tests/ikev1/ocsp-strict/posttest.dat diff --git a/testing/tests/ocsp-revoked/pretest.dat b/testing/tests/ikev1/ocsp-strict/pretest.dat index d5516fd3b..d92333d86 100644 --- a/testing/tests/ocsp-revoked/pretest.dat +++ b/testing/tests/ikev1/ocsp-strict/pretest.dat @@ -1,4 +1,3 @@ -winnetou::/etc/openssl/start-ocsp moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ocsp-strict/test.conf b/testing/tests/ikev1/ocsp-strict/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/ocsp-strict/test.conf +++ b/testing/tests/ikev1/ocsp-strict/test.conf diff --git a/testing/tests/protoport-dual/description.txt b/testing/tests/ikev1/protoport-dual/description.txt index 7bed8b959..7bed8b959 100644 --- a/testing/tests/protoport-dual/description.txt +++ b/testing/tests/ikev1/protoport-dual/description.txt diff --git a/testing/tests/protoport-pass/evaltest.dat b/testing/tests/ikev1/protoport-dual/evaltest.dat index 625c8c54c..11c34929f 100644 --- a/testing/tests/protoport-pass/evaltest.dat +++ b/testing/tests/ikev1/protoport-dual/evaltest.dat @@ -1,7 +1,7 @@ carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/protoport-dual/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-dual/hosts/carol/etc/ipsec.conf index 9e05ecf61..0dc25b7bb 100755 --- a/testing/tests/protoport-dual/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-dual/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-dual/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-dual/hosts/moon/etc/ipsec.conf index 84b9b0ba3..3b01128c2 100755 --- a/testing/tests/protoport-dual/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-dual/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-pass/posttest.dat b/testing/tests/ikev1/protoport-dual/posttest.dat index 26848212b..94a400606 100644 --- a/testing/tests/protoport-pass/posttest.dat +++ b/testing/tests/ikev1/protoport-dual/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/protoport-dual/pretest.dat b/testing/tests/ikev1/protoport-dual/pretest.dat index d3d0061c3..d3d0061c3 100644 --- a/testing/tests/protoport-dual/pretest.dat +++ b/testing/tests/ikev1/protoport-dual/pretest.dat diff --git a/testing/tests/protoport-dual/test.conf b/testing/tests/ikev1/protoport-dual/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/protoport-dual/test.conf +++ b/testing/tests/ikev1/protoport-dual/test.conf diff --git a/testing/tests/protoport-pass/description.txt b/testing/tests/ikev1/protoport-pass/description.txt index 63744fa47..63744fa47 100644 --- a/testing/tests/protoport-pass/description.txt +++ b/testing/tests/ikev1/protoport-pass/description.txt diff --git a/testing/tests/protoport-dual/evaltest.dat b/testing/tests/ikev1/protoport-pass/evaltest.dat index 625c8c54c..11c34929f 100644 --- a/testing/tests/protoport-dual/evaltest.dat +++ b/testing/tests/ikev1/protoport-pass/evaltest.dat @@ -1,7 +1,7 @@ carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/protoport-pass/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-pass/hosts/carol/etc/ipsec.conf index ade7308f6..093f9b1fc 100755 --- a/testing/tests/protoport-pass/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-pass/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-pass/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-pass/hosts/moon/etc/ipsec.conf index fd67e2b4b..e64b3be7a 100755 --- a/testing/tests/protoport-pass/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-pass/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-dual/posttest.dat b/testing/tests/ikev1/protoport-pass/posttest.dat index 26848212b..94a400606 100644 --- a/testing/tests/protoport-dual/posttest.dat +++ b/testing/tests/ikev1/protoport-pass/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/protoport-pass/pretest.dat b/testing/tests/ikev1/protoport-pass/pretest.dat index 13b4ad4a0..13b4ad4a0 100644 --- a/testing/tests/protoport-pass/pretest.dat +++ b/testing/tests/ikev1/protoport-pass/pretest.dat diff --git a/testing/tests/protoport-pass/test.conf b/testing/tests/ikev1/protoport-pass/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/protoport-pass/test.conf +++ b/testing/tests/ikev1/protoport-pass/test.conf diff --git a/testing/tests/protoport-route/description.txt b/testing/tests/ikev1/protoport-route/description.txt index ec7ec69b0..ec7ec69b0 100644 --- a/testing/tests/protoport-route/description.txt +++ b/testing/tests/ikev1/protoport-route/description.txt diff --git a/testing/tests/protoport-route/evaltest.dat b/testing/tests/ikev1/protoport-route/evaltest.dat index 8f3eb208f..759295675 100644 --- a/testing/tests/protoport-route/evaltest.dat +++ b/testing/tests/ikev1/protoport-route/evaltest.dat @@ -1,5 +1,5 @@ carol::ping -c 2 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES -carol::ping -c 2 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq::YES +carol::ping -c 2 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES carol::ssh PH_IP_ALICE hostname::alice::YES carol::cat /var/log/auth.log::initiate on demand::YES carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES diff --git a/testing/tests/protoport-route/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-route/hosts/carol/etc/ipsec.conf index 31c25c12f..99b410c32 100755 --- a/testing/tests/protoport-route/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-route/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-route/hosts/moon/etc/ipsec.conf index 84b9b0ba3..3b01128c2 100755 --- a/testing/tests/protoport-route/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-route/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ikev1/protoport-route/posttest.dat b/testing/tests/ikev1/protoport-route/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/protoport-route/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/protoport-route/pretest.dat b/testing/tests/ikev1/protoport-route/pretest.dat index f233ad48f..f233ad48f 100644 --- a/testing/tests/protoport-route/pretest.dat +++ b/testing/tests/ikev1/protoport-route/pretest.dat diff --git a/testing/tests/protoport-route/test.conf b/testing/tests/ikev1/protoport-route/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/protoport-route/test.conf +++ b/testing/tests/ikev1/protoport-route/test.conf diff --git a/testing/tests/req-pkcs10/description.txt b/testing/tests/ikev1/req-pkcs10/description.txt index a958cb8e8..a958cb8e8 100644 --- a/testing/tests/req-pkcs10/description.txt +++ b/testing/tests/ikev1/req-pkcs10/description.txt diff --git a/testing/tests/req-pkcs10/evaltest.dat b/testing/tests/ikev1/req-pkcs10/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/req-pkcs10/evaltest.dat +++ b/testing/tests/ikev1/req-pkcs10/evaltest.dat diff --git a/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..e32aca0b9 --- /dev/null +++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=myCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.secrets index 167d743df..167d743df 100644 --- a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/scepclient.conf b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/scepclient.conf index 6afd3fa11..6afd3fa11 100644 --- a/testing/tests/req-pkcs10/hosts/carol/etc/scepclient.conf +++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/scepclient.conf diff --git a/testing/tests/req-pkcs10/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/ipsec.secrets index b9ec17dbc..b9ec17dbc 100644 --- a/testing/tests/req-pkcs10/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/req-pkcs10/hosts/moon/etc/scepclient.conf b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/scepclient.conf index da8177348..da8177348 100644 --- a/testing/tests/req-pkcs10/hosts/moon/etc/scepclient.conf +++ b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/scepclient.conf diff --git a/testing/tests/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt b/testing/tests/ikev1/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt index 9b48ee4cf..9b48ee4cf 100644 --- a/testing/tests/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt +++ b/testing/tests/ikev1/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt diff --git a/testing/tests/req-pkcs10/posttest.dat b/testing/tests/ikev1/req-pkcs10/posttest.dat index 534e3af20..933b4b6c4 100644 --- a/testing/tests/req-pkcs10/posttest.dat +++ b/testing/tests/ikev1/req-pkcs10/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/req-pkcs10/pretest.dat b/testing/tests/ikev1/req-pkcs10/pretest.dat index 18b8b16e6..18b8b16e6 100644 --- a/testing/tests/req-pkcs10/pretest.dat +++ b/testing/tests/ikev1/req-pkcs10/pretest.dat diff --git a/testing/tests/req-pkcs10/test.conf b/testing/tests/ikev1/req-pkcs10/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/req-pkcs10/test.conf +++ b/testing/tests/ikev1/req-pkcs10/test.conf diff --git a/testing/tests/rw-cert/description.txt b/testing/tests/ikev1/rw-cert/description.txt index 8df6b1c0d..8df6b1c0d 100644 --- a/testing/tests/rw-cert/description.txt +++ b/testing/tests/ikev1/rw-cert/description.txt diff --git a/testing/tests/rw-cert/evaltest.dat b/testing/tests/ikev1/rw-cert/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/rw-cert/evaltest.dat +++ b/testing/tests/ikev1/rw-cert/evaltest.dat diff --git a/testing/tests/ikev1/rw-cert/posttest.dat b/testing/tests/ikev1/rw-cert/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/rw-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/virtual-ip-swapped/pretest.dat b/testing/tests/ikev1/rw-cert/pretest.dat index 4fe0ee90b..4fe0ee90b 100644 --- a/testing/tests/virtual-ip-swapped/pretest.dat +++ b/testing/tests/ikev1/rw-cert/pretest.dat diff --git a/testing/tests/rw-cert/test.conf b/testing/tests/ikev1/rw-cert/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/rw-cert/test.conf +++ b/testing/tests/ikev1/rw-cert/test.conf diff --git a/testing/tests/rw-psk-fqdn-named/description.txt b/testing/tests/ikev1/rw-psk-fqdn-named/description.txt index adfab2f4d..adfab2f4d 100644 --- a/testing/tests/rw-psk-fqdn-named/description.txt +++ b/testing/tests/ikev1/rw-psk-fqdn-named/description.txt diff --git a/testing/tests/rw-psk-fqdn-named/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/rw-psk-fqdn-named/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn-named/evaltest.dat diff --git a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf index da5e198a8..1e9a27129 100755 --- a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets index db3884e57..db3884e57 100644 --- a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf index c32dfaf9b..05d209c44 100755 --- a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets index 6281340ae..6281340ae 100644 --- a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-fqdn-named/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/pretest.dat index dbf03f552..dbf03f552 100644 --- a/testing/tests/rw-psk-fqdn-named/pretest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn-named/pretest.dat diff --git a/testing/tests/rw-psk-fqdn-named/test.conf b/testing/tests/ikev1/rw-psk-fqdn-named/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/rw-psk-fqdn-named/test.conf +++ b/testing/tests/ikev1/rw-psk-fqdn-named/test.conf diff --git a/testing/tests/rw-psk-fqdn/description.txt b/testing/tests/ikev1/rw-psk-fqdn/description.txt index d6c79afb2..d6c79afb2 100644 --- a/testing/tests/rw-psk-fqdn/description.txt +++ b/testing/tests/ikev1/rw-psk-fqdn/description.txt diff --git a/testing/tests/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/rw-psk-fqdn/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat diff --git a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.conf index da5e198a8..1e9a27129 100755 --- a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets index db3884e57..db3884e57 100644 --- a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.conf index 9a894806c..beda12b3c 100755 --- a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets index 6281340ae..661168fb5 100644 --- a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets @@ -1,7 +1,3 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file @moon.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL - - - - diff --git a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-fqdn/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat index dbf03f552..dbf03f552 100644 --- a/testing/tests/rw-psk-fqdn/pretest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat diff --git a/testing/tests/rw-psk-fqdn/test.conf b/testing/tests/ikev1/rw-psk-fqdn/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/rw-psk-fqdn/test.conf +++ b/testing/tests/ikev1/rw-psk-fqdn/test.conf diff --git a/testing/tests/rw-psk-ipv4/description.txt b/testing/tests/ikev1/rw-psk-ipv4/description.txt index b3a0bc192..b3a0bc192 100644 --- a/testing/tests/rw-psk-ipv4/description.txt +++ b/testing/tests/ikev1/rw-psk-ipv4/description.txt diff --git a/testing/tests/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/rw-psk-ipv4/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat diff --git a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.conf index 2c0227b7a..8e27a9ecd 100755 --- a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets index 69313b289..69313b289 100644 --- a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.conf index a75d4e222..f8ce5569c 100755 --- a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets index a8e367950..a8e367950 100644 --- a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-ipv4/pretest.dat b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat index dbf03f552..dbf03f552 100644 --- a/testing/tests/rw-psk-ipv4/pretest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat diff --git a/testing/tests/rw-psk-ipv4/test.conf b/testing/tests/ikev1/rw-psk-ipv4/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/rw-psk-ipv4/test.conf +++ b/testing/tests/ikev1/rw-psk-ipv4/test.conf diff --git a/testing/tests/rw-psk-no-policy/description.txt b/testing/tests/ikev1/rw-psk-no-policy/description.txt index 0e359414f..0e359414f 100644 --- a/testing/tests/rw-psk-no-policy/description.txt +++ b/testing/tests/ikev1/rw-psk-no-policy/description.txt diff --git a/testing/tests/rw-psk-no-policy/evaltest.dat b/testing/tests/ikev1/rw-psk-no-policy/evaltest.dat index a28377dbd..a28377dbd 100644 --- a/testing/tests/rw-psk-no-policy/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-no-policy/evaltest.dat diff --git a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.conf index 413eff762..c62605bd0 100755 --- a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets index 1b721dc58..1b721dc58 100644 --- a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-no-policy/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-no-policy/hosts/moon/etc/ipsec.conf index ac63abdc9..4584e1408 100755 --- a/testing/tests/rw-psk-no-policy/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-rsa-no-policy/posttest.dat b/testing/tests/ikev1/rw-psk-no-policy/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/rw-rsa-no-policy/posttest.dat +++ b/testing/tests/ikev1/rw-psk-no-policy/posttest.dat diff --git a/testing/tests/rw-psk-no-policy/pretest.dat b/testing/tests/ikev1/rw-psk-no-policy/pretest.dat index 3a7804ddd..3a7804ddd 100644 --- a/testing/tests/rw-psk-no-policy/pretest.dat +++ b/testing/tests/ikev1/rw-psk-no-policy/pretest.dat diff --git a/testing/tests/rw-psk-no-policy/test.conf b/testing/tests/ikev1/rw-psk-no-policy/test.conf index f622c18b7..f622c18b7 100644 --- a/testing/tests/rw-psk-no-policy/test.conf +++ b/testing/tests/ikev1/rw-psk-no-policy/test.conf diff --git a/testing/tests/rw-psk-rsa-mixed/description.txt b/testing/tests/ikev1/rw-psk-rsa-mixed/description.txt index b99a8e5b3..b99a8e5b3 100644 --- a/testing/tests/rw-psk-rsa-mixed/description.txt +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/description.txt diff --git a/testing/tests/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/evaltest.dat index 9e1354121..9e1354121 100644 --- a/testing/tests/rw-psk-rsa-mixed/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/evaltest.dat diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf index 69e13b538..b142c75bb 100755 --- a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets index 1b721dc58..1b721dc58 100644 --- a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf index b23248b5b..5916d8fd8 100755 --- a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets index fd33507a7..fd33507a7 100644 --- a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/wildcards/posttest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/posttest.dat index ed530f6d9..ed530f6d9 100644 --- a/testing/tests/wildcards/posttest.dat +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/posttest.dat diff --git a/testing/tests/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/pretest.dat index 35797b589..35797b589 100644 --- a/testing/tests/rw-psk-rsa-mixed/pretest.dat +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/pretest.dat diff --git a/testing/tests/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/test.conf index 699b88e88..699b88e88 100644 --- a/testing/tests/rw-psk-rsa-mixed/test.conf +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/test.conf diff --git a/testing/tests/rw-rsa-no-policy/description.txt b/testing/tests/ikev1/rw-rsa-no-policy/description.txt index c3336b769..c3336b769 100644 --- a/testing/tests/rw-rsa-no-policy/description.txt +++ b/testing/tests/ikev1/rw-rsa-no-policy/description.txt diff --git a/testing/tests/rw-rsa-no-policy/evaltest.dat b/testing/tests/ikev1/rw-rsa-no-policy/evaltest.dat index 188b7bbb5..188b7bbb5 100644 --- a/testing/tests/rw-rsa-no-policy/evaltest.dat +++ b/testing/tests/ikev1/rw-rsa-no-policy/evaltest.dat diff --git a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf index b9318c058..2abe3c147 100755 --- a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf @@ -1,7 +1,5 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control diff --git a/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..e8c151f05 --- /dev/null +++ b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL diff --git a/testing/tests/xauth-rsa-fail/posttest.dat b/testing/tests/ikev1/rw-rsa-no-policy/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/xauth-rsa-fail/posttest.dat +++ b/testing/tests/ikev1/rw-rsa-no-policy/posttest.dat diff --git a/testing/tests/rw-rsa-no-policy/pretest.dat b/testing/tests/ikev1/rw-rsa-no-policy/pretest.dat index 0d2a0dd1f..0d2a0dd1f 100644 --- a/testing/tests/rw-rsa-no-policy/pretest.dat +++ b/testing/tests/ikev1/rw-rsa-no-policy/pretest.dat diff --git a/testing/tests/rw-rsa-no-policy/test.conf b/testing/tests/ikev1/rw-rsa-no-policy/test.conf index f622c18b7..f622c18b7 100644 --- a/testing/tests/rw-rsa-no-policy/test.conf +++ b/testing/tests/ikev1/rw-rsa-no-policy/test.conf diff --git a/testing/tests/self-signed/description.txt b/testing/tests/ikev1/self-signed/description.txt index 2d7bfc2bf..2d7bfc2bf 100644 --- a/testing/tests/self-signed/description.txt +++ b/testing/tests/ikev1/self-signed/description.txt diff --git a/testing/tests/default-keys/evaltest.dat b/testing/tests/ikev1/self-signed/evaltest.dat index f190d7066..f190d7066 100644 --- a/testing/tests/default-keys/evaltest.dat +++ b/testing/tests/ikev1/self-signed/evaltest.dat diff --git a/testing/tests/self-signed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.conf index fcf7a1754..93ea3a80e 100755 --- a/testing/tests/self-signed/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=0 strictcrlpolicy=no nocrsend=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/self-signed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.secrets index 167d743df..167d743df 100644 --- a/testing/tests/self-signed/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/self-signed/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/self-signed/hosts/moon/etc/init.d/iptables index 13ad3063f..13ad3063f 100755 --- a/testing/tests/self-signed/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/self-signed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.conf index 7d7f42b06..98b0030d8 100755 --- a/testing/tests/self-signed/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=0 strictcrlpolicy=no nocrsend=yes + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default keyingtries=1 conn carol - left=192.168.0.1 + left=PH_IP_MOON leftnexthop=%direct leftcert=moonCert.der leftid=@moon.strongswan.org diff --git a/testing/tests/self-signed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.secrets index b9ec17dbc..b9ec17dbc 100644 --- a/testing/tests/self-signed/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/self-signed/hosts/moon/etc/scepclient.conf b/testing/tests/ikev1/self-signed/hosts/moon/etc/scepclient.conf index b84f3e131..b84f3e131 100644 --- a/testing/tests/self-signed/hosts/moon/etc/scepclient.conf +++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/scepclient.conf diff --git a/testing/tests/self-signed/posttest.dat b/testing/tests/ikev1/self-signed/posttest.dat index 52b48b9ef..8cada5e7e 100644 --- a/testing/tests/self-signed/posttest.dat +++ b/testing/tests/ikev1/self-signed/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/self-signed/pretest.dat b/testing/tests/ikev1/self-signed/pretest.dat index a7cddf677..a7cddf677 100644 --- a/testing/tests/self-signed/pretest.dat +++ b/testing/tests/ikev1/self-signed/pretest.dat diff --git a/testing/tests/self-signed/test.conf b/testing/tests/ikev1/self-signed/test.conf index 0baa48d90..0baa48d90 100644 --- a/testing/tests/self-signed/test.conf +++ b/testing/tests/ikev1/self-signed/test.conf diff --git a/testing/tests/starter-also-loop/description.txt b/testing/tests/ikev1/starter-also-loop/description.txt index 7451f4e12..7451f4e12 100644 --- a/testing/tests/starter-also-loop/description.txt +++ b/testing/tests/ikev1/starter-also-loop/description.txt diff --git a/testing/tests/starter-also-loop/evaltest.dat b/testing/tests/ikev1/starter-also-loop/evaltest.dat index 161772f8e..161772f8e 100644 --- a/testing/tests/starter-also-loop/evaltest.dat +++ b/testing/tests/ikev1/starter-also-loop/evaltest.dat diff --git a/testing/tests/starter-also-loop/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-also-loop/hosts/moon/etc/ipsec.conf index e1d210253..b58d1deb7 100755 --- a/testing/tests/starter-also-loop/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/starter-also-loop/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -30,7 +29,7 @@ conn rw auto=add conn moon - left=192.168.0.1 + left=PH_IP_MOON leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org @@ -41,7 +40,7 @@ conn moon-net leftsubnet=10.1.0.0/16 conn sun - right=192.168.0.2 + right=PH_IP_SUN rightid=@sun.strongswan.org conn sun-net diff --git a/testing/tests/starter-also-loop/posttest.dat b/testing/tests/ikev1/starter-also-loop/posttest.dat index e69de29bb..e69de29bb 100644 --- a/testing/tests/starter-also-loop/posttest.dat +++ b/testing/tests/ikev1/starter-also-loop/posttest.dat diff --git a/testing/tests/starter-also-loop/pretest.dat b/testing/tests/ikev1/starter-also-loop/pretest.dat index b135b12c3..b135b12c3 100644 --- a/testing/tests/starter-also-loop/pretest.dat +++ b/testing/tests/ikev1/starter-also-loop/pretest.dat diff --git a/testing/tests/starter-also-loop/test.conf b/testing/tests/ikev1/starter-also-loop/test.conf index e7735308f..e7735308f 100644 --- a/testing/tests/starter-also-loop/test.conf +++ b/testing/tests/ikev1/starter-also-loop/test.conf diff --git a/testing/tests/starter-also/description.txt b/testing/tests/ikev1/starter-also/description.txt index 3d4ff7dbf..3d4ff7dbf 100644 --- a/testing/tests/starter-also/description.txt +++ b/testing/tests/ikev1/starter-also/description.txt diff --git a/testing/tests/starter-also/evaltest.dat b/testing/tests/ikev1/starter-also/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/starter-also/evaltest.dat +++ b/testing/tests/ikev1/starter-also/evaltest.dat diff --git a/testing/tests/starter-also/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-also/hosts/moon/etc/ipsec.conf index 74d009cfa..09f3bb94d 100755 --- a/testing/tests/starter-also/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/starter-also/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -30,7 +29,7 @@ conn rw auto=add conn moon - left=192.168.0.1 + left=PH_IP_MOON leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org @@ -40,7 +39,7 @@ conn moon-net leftsubnet=10.1.0.0/16 conn sun - right=192.168.0.2 + right=PH_IP_SUN rightid=@sun.strongswan.org conn sun-net diff --git a/testing/tests/ikev1/starter-also/posttest.dat b/testing/tests/ikev1/starter-also/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/starter-also/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/starter-also/pretest.dat b/testing/tests/ikev1/starter-also/pretest.dat index 4f96e61df..4f96e61df 100644 --- a/testing/tests/starter-also/pretest.dat +++ b/testing/tests/ikev1/starter-also/pretest.dat diff --git a/testing/tests/starter-also/test.conf b/testing/tests/ikev1/starter-also/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/starter-also/test.conf +++ b/testing/tests/ikev1/starter-also/test.conf diff --git a/testing/tests/starter-includes/description.txt b/testing/tests/ikev1/starter-includes/description.txt index 6a05c0cca..6a05c0cca 100644 --- a/testing/tests/starter-includes/description.txt +++ b/testing/tests/ikev1/starter-includes/description.txt diff --git a/testing/tests/mode-config-swapped/evaltest.dat b/testing/tests/ikev1/starter-includes/evaltest.dat index 7de32d681..7de32d681 100644 --- a/testing/tests/mode-config-swapped/evaltest.dat +++ b/testing/tests/ikev1/starter-includes/evaltest.dat diff --git a/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..2fd734579 --- /dev/null +++ b/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftsourceip=%modeconfig + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..128c4aa29 --- /dev/null +++ b/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_DAVE + leftsourceip=%modeconfig + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.conf index aa9116252..4e7bfc1b4 100755 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.conf @@ -1,10 +1,9 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no include /etc/ipsec.connections diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.connections b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.connections index 7cd938628..7cd938628 100644 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.connections +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.connections diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.host b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.host index e84e5cdc6..acf753cc0 100755 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.host +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.host @@ -3,7 +3,7 @@ conn %default left=PH_IP_MOON leftsubnet=10.1.0.0/16 - leftsourceip=PH_IP1_MOON + leftsourceip=PH_IP_MOON1 leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol index 9212a9e96..84bedfef6 100644 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol @@ -3,6 +3,6 @@ conn rw-carol right=%any rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 auto=add diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave index 482d15a21..ee021c9be 100644 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave @@ -3,6 +3,6 @@ conn rw-dave right=%any rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/starter-includes/posttest.dat b/testing/tests/ikev1/starter-includes/posttest.dat index 121aa8aea..ebf7525ef 100644 --- a/testing/tests/starter-includes/posttest.dat +++ b/testing/tests/ikev1/starter-includes/posttest.dat @@ -1,13 +1,10 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null carol::/etc/init.d/iptables stop 2> /dev/null dave::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 -dave::ip addr del PH_IP1_DAVE/32 dev eth0 +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 moon::rm /etc/ipsec.connections /etc/ipsec.host moon::rm -r /etc/ipsec.peers diff --git a/testing/tests/starter-includes/pretest.dat b/testing/tests/ikev1/starter-includes/pretest.dat index 0af79a6d2..b034a0c03 100644 --- a/testing/tests/starter-includes/pretest.dat +++ b/testing/tests/ikev1/starter-includes/pretest.dat @@ -8,3 +8,4 @@ moon::ipsec start --debug-all carol::sleep 2 carol::ipsec up home dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/starter-includes/test.conf b/testing/tests/ikev1/starter-includes/test.conf index 1a8f2a4e0..1a8f2a4e0 100644 --- a/testing/tests/starter-includes/test.conf +++ b/testing/tests/ikev1/starter-includes/test.conf diff --git a/testing/tests/strong-certs/description.txt b/testing/tests/ikev1/strong-certs/description.txt index 22b58668d..22b58668d 100644 --- a/testing/tests/strong-certs/description.txt +++ b/testing/tests/ikev1/strong-certs/description.txt diff --git a/testing/tests/strong-certs/evaltest.dat b/testing/tests/ikev1/strong-certs/evaltest.dat index 2fe4de76f..2fe4de76f 100644 --- a/testing/tests/strong-certs/evaltest.dat +++ b/testing/tests/ikev1/strong-certs/evaltest.dat diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.conf index 6ab379636..81d1ae8b6 100755 --- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control strictcrlpolicy=no crlcheckinterval=180 + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem index d4b532323..d4b532323 100644 --- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem +++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem index f719e4455..f719e4455 100644 --- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.conf index 90cee47c2..468be8afb 100755 --- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control strictcrlpolicy=no crlcheckinterval=180 + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem index 73088cd1d..73088cd1d 100644 --- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem +++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem index a4a8a4f22..a4a8a4f22 100644 --- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem +++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.secrets index 9031f323a..9031f323a 100644 --- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.conf index 76c89aa6b..7aed142a4 100755 --- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control strictcrlpolicy=no crlcheckinterval=180 + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem index 307f4953e..307f4953e 100644 --- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem +++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem index 58ddc1525..58ddc1525 100644 --- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem +++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.secrets index e86d6aa5c..e86d6aa5c 100644 --- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/strong-certs/posttest.dat b/testing/tests/ikev1/strong-certs/posttest.dat index 12b540b53..fc0fbeb38 100644 --- a/testing/tests/strong-certs/posttest.dat +++ b/testing/tests/ikev1/strong-certs/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/strong-certs/pretest.dat b/testing/tests/ikev1/strong-certs/pretest.dat index de51ccdfa..de51ccdfa 100644 --- a/testing/tests/strong-certs/pretest.dat +++ b/testing/tests/ikev1/strong-certs/pretest.dat diff --git a/testing/tests/strong-certs/test.conf b/testing/tests/ikev1/strong-certs/test.conf index 70416826e..70416826e 100644 --- a/testing/tests/strong-certs/test.conf +++ b/testing/tests/ikev1/strong-certs/test.conf diff --git a/testing/tests/virtual-ip-swapped/description.txt b/testing/tests/ikev1/virtual-ip-swapped/description.txt index 230906c5d..230906c5d 100644 --- a/testing/tests/virtual-ip-swapped/description.txt +++ b/testing/tests/ikev1/virtual-ip-swapped/description.txt diff --git a/testing/tests/virtual-ip-swapped/evaltest.dat b/testing/tests/ikev1/virtual-ip-swapped/evaltest.dat index bf3965727..23e109838 100644 --- a/testing/tests/virtual-ip-swapped/evaltest.dat +++ b/testing/tests/ikev1/virtual-ip-swapped/evaltest.dat @@ -1,8 +1,8 @@ carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES -moon::ping -c 1 PH_IP1_CAROL::64 bytes from PH_IP1_CAROL: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +moon::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/virtual-ip-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip-swapped/hosts/carol/etc/ipsec.conf index 0e239b707..f4f2dedd0 100755 --- a/testing/tests/virtual-ip-swapped/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/virtual-ip-swapped/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default conn home right=PH_IP_CAROL - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 rightnexthop=%direct rightcert=carolCert.pem rightid=carol@strongswan.org diff --git a/testing/tests/virtual-ip-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip-swapped/hosts/moon/etc/ipsec.conf index db6effbac..de7f07eb9 100755 --- a/testing/tests/virtual-ip-swapped/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/virtual-ip-swapped/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default conn rw right=PH_IP_MOON - rightsourceip=PH_IP1_MOON + rightsourceip=PH_IP_MOON1 rightnexthop=%direct rightcert=moonCert.pem rightid=@moon.strongswan.org diff --git a/testing/tests/ikev1/virtual-ip-swapped/posttest.dat b/testing/tests/ikev1/virtual-ip-swapped/posttest.dat new file mode 100644 index 000000000..2116e86e0 --- /dev/null +++ b/testing/tests/ikev1/virtual-ip-swapped/posttest.dat @@ -0,0 +1,5 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 diff --git a/testing/tests/virtual-ip/pretest.dat b/testing/tests/ikev1/virtual-ip-swapped/pretest.dat index 4fe0ee90b..4fe0ee90b 100644 --- a/testing/tests/virtual-ip/pretest.dat +++ b/testing/tests/ikev1/virtual-ip-swapped/pretest.dat diff --git a/testing/tests/virtual-ip-swapped/test.conf b/testing/tests/ikev1/virtual-ip-swapped/test.conf index f106524e2..f106524e2 100644 --- a/testing/tests/virtual-ip-swapped/test.conf +++ b/testing/tests/ikev1/virtual-ip-swapped/test.conf diff --git a/testing/tests/virtual-ip/description.txt b/testing/tests/ikev1/virtual-ip/description.txt index 4ec6021ea..4ec6021ea 100644 --- a/testing/tests/virtual-ip/description.txt +++ b/testing/tests/ikev1/virtual-ip/description.txt diff --git a/testing/tests/virtual-ip/evaltest.dat b/testing/tests/ikev1/virtual-ip/evaltest.dat index bf3965727..23e109838 100644 --- a/testing/tests/virtual-ip/evaltest.dat +++ b/testing/tests/ikev1/virtual-ip/evaltest.dat @@ -1,8 +1,8 @@ carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES -moon::ping -c 1 PH_IP1_CAROL::64 bytes from PH_IP1_CAROL: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +moon::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..a863df33e --- /dev/null +++ b/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftsourceip=PH_IP_CAROL1 + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/virtual-ip/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip/hosts/moon/etc/ipsec.conf index 1cd8aab25..c0310692a 100755 --- a/testing/tests/virtual-ip/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/virtual-ip/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default conn rw left=PH_IP_MOON - leftsourceip=PH_IP1_MOON + leftsourceip=PH_IP_MOON1 leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org diff --git a/testing/tests/ikev1/virtual-ip/posttest.dat b/testing/tests/ikev1/virtual-ip/posttest.dat new file mode 100644 index 000000000..2116e86e0 --- /dev/null +++ b/testing/tests/ikev1/virtual-ip/posttest.dat @@ -0,0 +1,5 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 diff --git a/testing/tests/rw-cert/pretest.dat b/testing/tests/ikev1/virtual-ip/pretest.dat index bd68efb0b..0b2ae8d2b 100644 --- a/testing/tests/rw-cert/pretest.dat +++ b/testing/tests/ikev1/virtual-ip/pretest.dat @@ -2,5 +2,6 @@ moon::/etc/init.d/iptables start 2> /dev/null carol::/etc/init.d/iptables start 2> /dev/null carol::ipsec start moon::ipsec start -sleep 2 +carol::sleep 2 carol::ipsec up home +carol::sleep 1 diff --git a/testing/tests/virtual-ip/test.conf b/testing/tests/ikev1/virtual-ip/test.conf index f106524e2..f106524e2 100644 --- a/testing/tests/virtual-ip/test.conf +++ b/testing/tests/ikev1/virtual-ip/test.conf diff --git a/testing/tests/wildcards/description.txt b/testing/tests/ikev1/wildcards/description.txt index e485f7066..e485f7066 100644 --- a/testing/tests/wildcards/description.txt +++ b/testing/tests/ikev1/wildcards/description.txt diff --git a/testing/tests/wildcards/evaltest.dat b/testing/tests/ikev1/wildcards/evaltest.dat index cbc94b75a..cbc94b75a 100644 --- a/testing/tests/wildcards/evaltest.dat +++ b/testing/tests/ikev1/wildcards/evaltest.dat diff --git a/testing/tests/wildcards/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/carol/etc/ipsec.conf index de179c565..d6d32a39d 100755 --- a/testing/tests/wildcards/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/wildcards/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/wildcards/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/dave/etc/ipsec.conf index 2fb6a301e..6156fadba 100755 --- a/testing/tests/wildcards/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/wildcards/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/wildcards/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/moon/etc/ipsec.conf index ee7bc8115..162e22c43 100755 --- a/testing/tests/wildcards/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/wildcards/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -22,10 +21,9 @@ conn alice right=%any rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*" auto=add - + conn venus leftsubnet=PH_IP_VENUS/32 right=%any rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*" auto=add - diff --git a/testing/tests/ikev1/wildcards/posttest.dat b/testing/tests/ikev1/wildcards/posttest.dat new file mode 100644 index 000000000..ed530f6d9 --- /dev/null +++ b/testing/tests/ikev1/wildcards/posttest.dat @@ -0,0 +1,3 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop diff --git a/testing/tests/wildcards/pretest.dat b/testing/tests/ikev1/wildcards/pretest.dat index 67c50c2ef..67c50c2ef 100644 --- a/testing/tests/wildcards/pretest.dat +++ b/testing/tests/ikev1/wildcards/pretest.dat diff --git a/testing/tests/wildcards/test.conf b/testing/tests/ikev1/wildcards/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/wildcards/test.conf +++ b/testing/tests/ikev1/wildcards/test.conf diff --git a/testing/tests/wlan/description.txt b/testing/tests/ikev1/wlan/description.txt index e018148bd..e018148bd 100644 --- a/testing/tests/wlan/description.txt +++ b/testing/tests/ikev1/wlan/description.txt diff --git a/testing/tests/wlan/evaltest.dat b/testing/tests/ikev1/wlan/evaltest.dat index 1936c93a3..079ac4429 100644 --- a/testing/tests/wlan/evaltest.dat +++ b/testing/tests/ikev1/wlan/evaltest.dat @@ -3,7 +3,7 @@ venus::ipsec status::wlan.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::alice.*STATE_QUICK_R2.*IPsec SA established::YES moon::ipsec status::venus.*STATE_QUICK_R2.*IPsec SA established::YES alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -alice::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES alice::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES alice::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES venus::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES diff --git a/testing/tests/wlan/hosts/alice/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables index 86a76e2db..86a76e2db 100755 --- a/testing/tests/wlan/hosts/alice/etc/init.d/iptables +++ b/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables diff --git a/testing/tests/wlan/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf index a658e4fe8..665ce592f 100755 --- a/testing/tests/wlan/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=no + charonstart=no conn %default ikelifetime=60m @@ -30,7 +29,7 @@ conn wlan leftcert=aliceCert.pem leftid=alice@strongswan.org leftfirewall=yes - right=PH_IP1_MOON + right=PH_IP_MOON1 rightid=@moon.strongswan.org rightsubnet=0.0.0.0/0 auto=add diff --git a/testing/tests/wlan/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables index e95ef44c6..e95ef44c6 100755 --- a/testing/tests/wlan/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/wlan/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf index f873479e8..44f980422 100755 --- a/testing/tests/wlan/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=no + charonstart=no conn %default ikelifetime=60m @@ -27,7 +26,7 @@ conn venus auto=add conn wlan - left=PH_IP1_MOON + left=PH_IP_MOON1 leftnexthop=%direct leftsubnet=0.0.0.0/0 leftcert=moonCert.pem diff --git a/testing/tests/wlan/hosts/venus/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables index 6f95e7576..6f95e7576 100755 --- a/testing/tests/wlan/hosts/venus/etc/init.d/iptables +++ b/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables diff --git a/testing/tests/wlan/hosts/venus/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf index 742c1dbce..5d861548d 100755 --- a/testing/tests/wlan/hosts/venus/etc/ipsec.conf +++ b/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=no + charonstart=no conn %default ikelifetime=60m @@ -30,7 +29,7 @@ conn wlan leftcert=venusCert.pem leftid=@venus.strongswan.org leftfirewall=yes - right=PH_IP1_MOON + right=PH_IP_MOON1 rightid=@moon.strongswan.org rightsubnet=0.0.0.0/0 auto=add diff --git a/testing/tests/wlan/posttest.dat b/testing/tests/ikev1/wlan/posttest.dat index cc873d1ff..6bd2379d8 100644 --- a/testing/tests/wlan/posttest.dat +++ b/testing/tests/ikev1/wlan/posttest.dat @@ -1,10 +1,8 @@ -alice::iptables -v -n -L -venus::iptables -v -n -L moon::iptables -t nat -v -n -L POSTROUTING -moon::iptables -v -n -L moon::ipsec stop alice::ipsec stop venus::ipsec stop alice::/etc/init.d/iptables stop 2> /dev/null venus::/etc/init.d/iptables stop 2> /dev/null moon::/etc/init.d/iptables stop 2> /dev/null +moon::conntrack -F diff --git a/testing/tests/wlan/pretest.dat b/testing/tests/ikev1/wlan/pretest.dat index de4a6ad31..de4a6ad31 100644 --- a/testing/tests/wlan/pretest.dat +++ b/testing/tests/ikev1/wlan/pretest.dat diff --git a/testing/tests/wlan/test.conf b/testing/tests/ikev1/wlan/test.conf index b141c4f1b..b141c4f1b 100644 --- a/testing/tests/wlan/test.conf +++ b/testing/tests/ikev1/wlan/test.conf diff --git a/testing/tests/xauth-psk-mode-config/description.txt b/testing/tests/ikev1/xauth-psk-mode-config/description.txt index 9abe6298c..9abe6298c 100644 --- a/testing/tests/xauth-psk-mode-config/description.txt +++ b/testing/tests/ikev1/xauth-psk-mode-config/description.txt diff --git a/testing/tests/xauth-psk-mode-config/evaltest.dat b/testing/tests/ikev1/xauth-psk-mode-config/evaltest.dat index 15dd054a0..15dd054a0 100644 --- a/testing/tests/xauth-psk-mode-config/evaltest.dat +++ b/testing/tests/ikev1/xauth-psk-mode-config/evaltest.dat diff --git a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf index ff1628fb0..3fd0ebf85 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets index 70ea1dab6..70ea1dab6 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf index 65c8d534e..8d20a5d20 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets index 0690d9cde..0690d9cde 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf index 1e543b2fe..66f705e79 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -22,8 +23,8 @@ conn %default conn carol rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 conn dave rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 diff --git a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets index 1ea69f998..1ea69f998 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat b/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/xauth-psk-mode-config/pretest.dat b/testing/tests/ikev1/xauth-psk-mode-config/pretest.dat index 95a6be131..95a6be131 100644 --- a/testing/tests/xauth-psk-mode-config/pretest.dat +++ b/testing/tests/ikev1/xauth-psk-mode-config/pretest.dat diff --git a/testing/tests/xauth-psk-mode-config/test.conf b/testing/tests/ikev1/xauth-psk-mode-config/test.conf index 75510b295..75510b295 100644 --- a/testing/tests/xauth-psk-mode-config/test.conf +++ b/testing/tests/ikev1/xauth-psk-mode-config/test.conf diff --git a/testing/tests/xauth-psk/description.txt b/testing/tests/ikev1/xauth-psk/description.txt index 0ac2043c2..0ac2043c2 100644 --- a/testing/tests/xauth-psk/description.txt +++ b/testing/tests/ikev1/xauth-psk/description.txt diff --git a/testing/tests/xauth-psk/evaltest.dat b/testing/tests/ikev1/xauth-psk/evaltest.dat index e1dc6b5b0..e1dc6b5b0 100644 --- a/testing/tests/xauth-psk/evaltest.dat +++ b/testing/tests/ikev1/xauth-psk/evaltest.dat diff --git a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.conf index b9af32c65..3e8ddf0fe 100644 --- a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.secrets index 70ea1dab6..70ea1dab6 100644 --- a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.conf index f392a3e66..9aee88cfe 100644 --- a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.secrets index 0690d9cde..0690d9cde 100644 --- a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.conf index 4c423b017..dfaa44521 100644 --- a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.secrets index 047d6c235..047d6c235 100644 --- a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk-mode-config/posttest.dat b/testing/tests/ikev1/xauth-psk/posttest.dat index 530cfc7b9..7cebd7f25 100644 --- a/testing/tests/xauth-psk-mode-config/posttest.dat +++ b/testing/tests/ikev1/xauth-psk/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/xauth-psk/pretest.dat b/testing/tests/ikev1/xauth-psk/pretest.dat index 95a6be131..95a6be131 100644 --- a/testing/tests/xauth-psk/pretest.dat +++ b/testing/tests/ikev1/xauth-psk/pretest.dat diff --git a/testing/tests/xauth-psk/test.conf b/testing/tests/ikev1/xauth-psk/test.conf index 70416826e..70416826e 100644 --- a/testing/tests/xauth-psk/test.conf +++ b/testing/tests/ikev1/xauth-psk/test.conf diff --git a/testing/tests/xauth-rsa-fail/description.txt b/testing/tests/ikev1/xauth-rsa-fail/description.txt index 83e9d2726..83e9d2726 100644 --- a/testing/tests/xauth-rsa-fail/description.txt +++ b/testing/tests/ikev1/xauth-rsa-fail/description.txt diff --git a/testing/tests/xauth-rsa-fail/evaltest.dat b/testing/tests/ikev1/xauth-rsa-fail/evaltest.dat index 0bcef388d..0bcef388d 100644 --- a/testing/tests/xauth-rsa-fail/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa-fail/evaltest.dat diff --git a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.conf index bfee72421..d49bc1490 100755 --- a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets index 24506be09..24506be09 100644 --- a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.conf index f7cf06fae..6a48cf6ee 100755 --- a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets index a18e885f8..a18e885f8 100644 --- a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-nosecret/posttest.dat b/testing/tests/ikev1/xauth-rsa-fail/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/xauth-rsa-nosecret/posttest.dat +++ b/testing/tests/ikev1/xauth-rsa-fail/posttest.dat diff --git a/testing/tests/xauth-rsa-fail/pretest.dat b/testing/tests/ikev1/xauth-rsa-fail/pretest.dat index 1b8fc3b79..1b8fc3b79 100644 --- a/testing/tests/xauth-rsa-fail/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa-fail/pretest.dat diff --git a/testing/tests/xauth-rsa-fail/test.conf b/testing/tests/ikev1/xauth-rsa-fail/test.conf index 5442565f8..5442565f8 100644 --- a/testing/tests/xauth-rsa-fail/test.conf +++ b/testing/tests/ikev1/xauth-rsa-fail/test.conf diff --git a/testing/tests/xauth-rsa-mode-config/description.txt b/testing/tests/ikev1/xauth-rsa-mode-config/description.txt index aa2b31542..aa2b31542 100644 --- a/testing/tests/xauth-rsa-mode-config/description.txt +++ b/testing/tests/ikev1/xauth-rsa-mode-config/description.txt diff --git a/testing/tests/xauth-rsa-mode-config/evaltest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/evaltest.dat index 15dd054a0..15dd054a0 100644 --- a/testing/tests/xauth-rsa-mode-config/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa-mode-config/evaltest.dat diff --git a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf index 751c2a29d..90539650f 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets index 48fd260c1..48fd260c1 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf index c97e815df..19618145d 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets index 14f088501..14f088501 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf index e3b2219c4..eccdc2b70 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug="control" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -23,8 +24,8 @@ conn %default conn rw-carol rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 conn rw-dave rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 diff --git a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets index 8d41919fc..8d41919fc 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/xauth-rsa-mode-config/pretest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/pretest.dat index 78e2d57f8..78e2d57f8 100644 --- a/testing/tests/xauth-rsa-mode-config/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa-mode-config/pretest.dat diff --git a/testing/tests/xauth-rsa-mode-config/test.conf b/testing/tests/ikev1/xauth-rsa-mode-config/test.conf index 75510b295..75510b295 100644 --- a/testing/tests/xauth-rsa-mode-config/test.conf +++ b/testing/tests/ikev1/xauth-rsa-mode-config/test.conf diff --git a/testing/tests/xauth-rsa-nosecret/description.txt b/testing/tests/ikev1/xauth-rsa-nosecret/description.txt index ffbb47c04..ffbb47c04 100644 --- a/testing/tests/xauth-rsa-nosecret/description.txt +++ b/testing/tests/ikev1/xauth-rsa-nosecret/description.txt diff --git a/testing/tests/xauth-rsa-nosecret/evaltest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/evaltest.dat index ddbb3ae2d..ddbb3ae2d 100644 --- a/testing/tests/xauth-rsa-nosecret/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa-nosecret/evaltest.dat diff --git a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf index bfee72421..d49bc1490 100755 --- a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets index 6a2aea811..6a2aea811 100644 --- a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf index f7cf06fae..6a48cf6ee 100755 --- a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets index a18e885f8..a18e885f8 100644 --- a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ike-alg-strict/pretest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/ike-alg-strict/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa-nosecret/pretest.dat diff --git a/testing/tests/xauth-rsa-nosecret/test.conf b/testing/tests/ikev1/xauth-rsa-nosecret/test.conf index 5442565f8..5442565f8 100644 --- a/testing/tests/xauth-rsa-nosecret/test.conf +++ b/testing/tests/ikev1/xauth-rsa-nosecret/test.conf diff --git a/testing/tests/xauth-rsa/description.txt b/testing/tests/ikev1/xauth-rsa/description.txt index 0cdaba1c5..0cdaba1c5 100644 --- a/testing/tests/xauth-rsa/description.txt +++ b/testing/tests/ikev1/xauth-rsa/description.txt diff --git a/testing/tests/xauth-rsa/evaltest.dat b/testing/tests/ikev1/xauth-rsa/evaltest.dat index e1dc6b5b0..e1dc6b5b0 100644 --- a/testing/tests/xauth-rsa/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa/evaltest.dat diff --git a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.conf index bfee72421..d49bc1490 100644 --- a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.secrets index 48fd260c1..48fd260c1 100644 --- a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.conf index 0f34a209a..5c1de3372 100644 --- a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.secrets index 14f088501..14f088501 100644 --- a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.conf index f7cf06fae..a997fb73f 100644 --- a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.conf @@ -1,9 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - plutodebug=control + plutodebug="control" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.secrets index 8d41919fc..8d41919fc 100644 --- a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk/posttest.dat b/testing/tests/ikev1/xauth-rsa/posttest.dat index 530cfc7b9..7cebd7f25 100644 --- a/testing/tests/xauth-psk/posttest.dat +++ b/testing/tests/ikev1/xauth-rsa/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/xauth-rsa/pretest.dat b/testing/tests/ikev1/xauth-rsa/pretest.dat index 78e2d57f8..78e2d57f8 100644 --- a/testing/tests/xauth-rsa/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa/pretest.dat diff --git a/testing/tests/xauth-rsa/test.conf b/testing/tests/ikev1/xauth-rsa/test.conf index 70416826e..70416826e 100644 --- a/testing/tests/xauth-rsa/test.conf +++ b/testing/tests/ikev1/xauth-rsa/test.conf diff --git a/testing/tests/ikev2/config-payload-swapped/description.txt b/testing/tests/ikev2/config-payload-swapped/description.txt new file mode 100644 index 000000000..2160e6b92 --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/description.txt @@ -0,0 +1,3 @@ +Same scenario as test <a href="../config-payload/"><b>mode-config</b></a> but with +swapped end definitions: <b>right</b> denotes the <b>local</b> side whereas +<b>left</b> stands for the <b>remote</b> peer. diff --git a/testing/tests/ikev2/config-payload-swapped/evaltest.dat b/testing/tests/ikev2/config-payload-swapped/evaltest.dat new file mode 100644 index 000000000..40cb4339b --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/evaltest.dat @@ -0,0 +1,20 @@ +carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES +carol::ip addr list dev eth0::PH_IP_CAROL1::YES +carol::ip route list dev eth0::10.1.0.0/16.*src PH_IP_CAROL1::YES +carol::ipsec status::home.*INSTALLED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES +dave::ip addr list dev eth0::PH_IP_DAVE1::YES +dave::ip route list dev eth0::10.1.0.0/16.*src PH_IP_DAVE1::YES +dave::ipsec status::home.*INSTALLED::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::ipsec status::rw-carol.*INSTALLED::YES +moon::ipsec status::rw-dave.*INSTALLED::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES +alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES +alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..6e2cbd153 --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + right=PH_IP_CAROL + rightsourceip=%config + rightnexthop=%direct + rightcert=carolCert.pem + rightid=carol@strongswan.org + rightfirewall=yes + righthostaccess=yes + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..f148757db --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + right=PH_IP_DAVE + rightsourceip=%config + rightnexthop=%direct + rightcert=daveCert.pem + rightid=dave@strongswan.org + rightfirewall=yes + righthostaccess=yes + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftid=@moon.strongswan.org + auto=add diff --git a/testing/tests/esp-ah-tunnel/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/moon/etc/ipsec.conf index 98cdaab7a..5cb49cfc8 100755 --- a/testing/tests/esp-ah-tunnel/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/config-payload-swapped/hosts/moon/etc/ipsec.conf @@ -1,28 +1,32 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup - plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + plutostart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 - auth=ah - ike=aes128-sha - esp=aes128-sha1 - -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - leftfirewall=yes + keyexchange=ikev2 right=PH_IP_MOON rightsubnet=10.1.0.0/16 + rightsourceip=PH_IP_MOON1 + rightnexthop=%direct + rightcert=moonCert.pem rightid=@moon.strongswan.org + rightfirewall=yes + +conn rw-carol + left=%any + leftid=carol@strongswan.org + leftsourceip=PH_IP_CAROL1 + auto=add + +conn rw-dave + left=%any + leftid=dave@strongswan.org + leftsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/xauth-rsa-mode-config/posttest.dat b/testing/tests/ikev2/config-payload-swapped/posttest.dat index 530cfc7b9..7cebd7f25 100644 --- a/testing/tests/xauth-rsa-mode-config/posttest.dat +++ b/testing/tests/ikev2/config-payload-swapped/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/ikev2/config-payload-swapped/pretest.dat b/testing/tests/ikev2/config-payload-swapped/pretest.dat new file mode 100644 index 000000000..014e80517 --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/pretest.dat @@ -0,0 +1,10 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up home +dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/config-payload-swapped/test.conf b/testing/tests/ikev2/config-payload-swapped/test.conf new file mode 100644 index 000000000..1a8f2a4e0 --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon alice" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/config-payload/description.txt b/testing/tests/ikev2/config-payload/description.txt new file mode 100644 index 000000000..7690e7dce --- /dev/null +++ b/testing/tests/ikev2/config-payload/description.txt @@ -0,0 +1,7 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>. +Both <b>carol</b> and <b>dave</b> request a <b>virtual IP</b> via the IKEv2 configuration payload +by using the <b>leftsourceip=%config</b> parameter. <b>leftfirewall=yes</b> automatically +inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test the +tunnels, <b>carol</b> and <b>dave</b> then ping the client <b>alice</b> behind the gateway +<b>moon</b>. The source IP addresses of the two pings will be the virtual IPs <b>carol1</b> +and <b>dave1</b>, respectively. diff --git a/testing/tests/ikev2/config-payload/evaltest.dat b/testing/tests/ikev2/config-payload/evaltest.dat new file mode 100644 index 000000000..40cb4339b --- /dev/null +++ b/testing/tests/ikev2/config-payload/evaltest.dat @@ -0,0 +1,20 @@ +carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES +carol::ip addr list dev eth0::PH_IP_CAROL1::YES +carol::ip route list dev eth0::10.1.0.0/16.*src PH_IP_CAROL1::YES +carol::ipsec status::home.*INSTALLED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES +dave::ip addr list dev eth0::PH_IP_DAVE1::YES +dave::ip route list dev eth0::10.1.0.0/16.*src PH_IP_DAVE1::YES +dave::ipsec status::home.*INSTALLED::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::ipsec status::rw-carol.*INSTALLED::YES +moon::ipsec status::rw-dave.*INSTALLED::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES +alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES +alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..4ea2b22f7 --- /dev/null +++ b/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftsourceip=%config + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..dad3f3440 --- /dev/null +++ b/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_DAVE + leftsourceip=%config + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a4c4b3553 --- /dev/null +++ b/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf @@ -0,0 +1,32 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftsourceip=PH_IP_MOON1 + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + +conn rw-carol + right=%any + rightid=carol@strongswan.org + rightsourceip=PH_IP_CAROL1 + auto=add + +conn rw-dave + right=%any + rightid=dave@strongswan.org + rightsourceip=PH_IP_DAVE1 + auto=add diff --git a/testing/tests/xauth-rsa/posttest.dat b/testing/tests/ikev2/config-payload/posttest.dat index 530cfc7b9..7cebd7f25 100644 --- a/testing/tests/xauth-rsa/posttest.dat +++ b/testing/tests/ikev2/config-payload/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/ikev2/config-payload/pretest.dat b/testing/tests/ikev2/config-payload/pretest.dat new file mode 100644 index 000000000..014e80517 --- /dev/null +++ b/testing/tests/ikev2/config-payload/pretest.dat @@ -0,0 +1,10 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up home +dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/config-payload/test.conf b/testing/tests/ikev2/config-payload/test.conf new file mode 100644 index 000000000..1a8f2a4e0 --- /dev/null +++ b/testing/tests/ikev2/config-payload/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon alice" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/crl-from-cache/description.txt b/testing/tests/ikev2/crl-from-cache/description.txt new file mode 100644 index 000000000..17866f572 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/description.txt @@ -0,0 +1,5 @@ +By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. When <b>carol</b> initiates +an IPsec connection to <b>moon</b>, both VPN endpoints find a cached CRL in +their <b>/etc/ipsec.d/crls/</b> directories which allows them to immediately verify +the certificate received from their peer. diff --git a/testing/tests/ikev2/crl-from-cache/evaltest.dat b/testing/tests/ikev2/crl-from-cache/evaltest.dat new file mode 100644 index 000000000..9aa53fb64 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/evaltest.dat @@ -0,0 +1,8 @@ +moon::cat /var/log/daemon.log::loading crl file::YES +carol::cat /var/log/daemon.log::loading crl file::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES +moon::cat /var/log/auth.log::written crl file::NO +carol::cat /var/log/auth.log::written crl file::NO +moon::ipsec listcrls:: ok::YES +carol::ipsec listcrls:: ok::YES diff --git a/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..cea581bc2 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..fe2179885 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/crl-from-cache/posttest.dat b/testing/tests/ikev2/crl-from-cache/posttest.dat new file mode 100644 index 000000000..be17847c1 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::rm /etc/ipsec.d/crls/* +carol::rm /etc/ipsec.d/crls/* diff --git a/testing/tests/ikev2/crl-from-cache/pretest.dat b/testing/tests/ikev2/crl-from-cache/pretest.dat new file mode 100644 index 000000000..acdb265ed --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/pretest.dat @@ -0,0 +1,8 @@ +moon::wget -q http://crl.strongswan.org/strongswan.crl +moon::mv strongswan.crl /etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl +carol::wget -q http://crl.strongswan.org/strongswan.crl +carol::mv strongswan.crl /etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/crl-from-cache/test.conf b/testing/tests/ikev2/crl-from-cache/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-ldap/description.txt b/testing/tests/ikev2/crl-ldap/description.txt new file mode 100644 index 000000000..d7ed591cc --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/description.txt @@ -0,0 +1,6 @@ +By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. Thus when <b>carol</b> initiates +the connection and only an expired CRL cache file in <b>/etc/ipsec.d/crls</b> is +availabl, an ldap fetch to get the CRL from the LDAP server <b>winnetou</b> is +successfully started and the IKE authentication completes. The new CRL is again +cached locally as a file in <b>/etc/ipsec.d/crls</b> due to the <b>cachecrls=yes</b> option. diff --git a/testing/tests/ikev2/crl-ldap/evaltest.dat b/testing/tests/ikev2/crl-ldap/evaltest.dat new file mode 100644 index 000000000..05e818e21 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/evaltest.dat @@ -0,0 +1,12 @@ +moon::cat /var/log/daemon.log::loading crl file::YES +carol::cat /var/log/daemon.log::loading crl file::YES +moon::cat /var/log/daemon.log::crl is stale::YES +carol::cat /var/log/daemon.log::crl is stale::YES +moon::cat /var/log/daemon.log::sending ldap request::YES +carol::cat /var/log/daemon.log::sending ldap request::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES +moon::cat /var/log/daemon.log::written crl file::YES +carol::cat /var/log/daemon.log::written crl file::YES +moon::ipsec listcrls:: ok::YES +carol::ipsec listcrls:: ok::YES diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables new file mode 100755 index 000000000..571459bae --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables @@ -0,0 +1,73 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +opts="start stop reload" + +depend() { + before net + need logger +} + +start() { + ebegin "Starting firewall" + + # default policy is DROP + /sbin/iptables -P INPUT DROP + /sbin/iptables -P OUTPUT DROP + /sbin/iptables -P FORWARD DROP + + # allow esp + iptables -A INPUT -i eth0 -p 50 -j ACCEPT + iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT + + # allow IKE + iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT + iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + + # allow ldap crl fetch from winnetou + iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT + iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + + # allow ssh + iptables -A INPUT -p tcp --dport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + + eend $? +} + +stop() { + ebegin "Stopping firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + + if [ $a == nat ]; then + /sbin/iptables -t nat -P PREROUTING ACCEPT + /sbin/iptables -t nat -P POSTROUTING ACCEPT + /sbin/iptables -t nat -P OUTPUT ACCEPT + elif [ $a == mangle ]; then + /sbin/iptables -t mangle -P PREROUTING ACCEPT + /sbin/iptables -t mangle -P INPUT ACCEPT + /sbin/iptables -t mangle -P FORWARD ACCEPT + /sbin/iptables -t mangle -P OUTPUT ACCEPT + /sbin/iptables -t mangle -P POSTROUTING ACCEPT + elif [ $a == filter ]; then + /sbin/iptables -t filter -P INPUT ACCEPT + /sbin/iptables -t filter -P FORWARD ACCEPT + /sbin/iptables -t filter -P OUTPUT ACCEPT + fi + done + eend $? +} + +reload() { + ebegin "Flushing firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + done; + eend $? + start +} + diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..8b37ec6b8 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf @@ -0,0 +1,31 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList" + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=2 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl Binary files differnew file mode 100644 index 000000000..75e8b0959 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables new file mode 100755 index 000000000..8de514a2e --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables @@ -0,0 +1,76 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +opts="start stop reload" + +depend() { + before net + need logger +} + +start() { + ebegin "Starting firewall" + + # enable IP forwarding + echo 1 > /proc/sys/net/ipv4/ip_forward + + # default policy is DROP + /sbin/iptables -P INPUT DROP + /sbin/iptables -P OUTPUT DROP + /sbin/iptables -P FORWARD DROP + + # allow esp + iptables -A INPUT -i eth0 -p 50 -j ACCEPT + iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT + + # allow IKE + iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT + iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + + # allow ldap crl fetch from winnetou + iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT + iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + + # allow ssh + iptables -A INPUT -p tcp --dport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + + eend $? +} + +stop() { + ebegin "Stopping firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + + if [ $a == nat ]; then + /sbin/iptables -t nat -P PREROUTING ACCEPT + /sbin/iptables -t nat -P POSTROUTING ACCEPT + /sbin/iptables -t nat -P OUTPUT ACCEPT + elif [ $a == mangle ]; then + /sbin/iptables -t mangle -P PREROUTING ACCEPT + /sbin/iptables -t mangle -P INPUT ACCEPT + /sbin/iptables -t mangle -P FORWARD ACCEPT + /sbin/iptables -t mangle -P OUTPUT ACCEPT + /sbin/iptables -t mangle -P POSTROUTING ACCEPT + elif [ $a == filter ]; then + /sbin/iptables -t filter -P INPUT ACCEPT + /sbin/iptables -t filter -P FORWARD ACCEPT + /sbin/iptables -t filter -P OUTPUT ACCEPT + fi + done + eend $? +} + +reload() { + ebegin "Flushing firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + done; + eend $? + start +} + diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..3b1fbabb8 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + crluri="ldap://ldap1.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList" + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=2 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl Binary files differnew file mode 100644 index 000000000..75e8b0959 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl diff --git a/testing/tests/ikev2/crl-ldap/posttest.dat b/testing/tests/ikev2/crl-ldap/posttest.dat new file mode 100644 index 000000000..bddd87424 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/posttest.dat @@ -0,0 +1,7 @@ +moon::ipsec stop +carol::ipsec stop +winnetou::/etc/init.d/slapd stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +moon::rm /etc/ipsec.d/crls/* +carol::rm /etc/ipsec.d/crls/* diff --git a/testing/tests/ikev2/crl-ldap/pretest.dat b/testing/tests/ikev2/crl-ldap/pretest.dat new file mode 100644 index 000000000..64fa8116b --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/pretest.dat @@ -0,0 +1,8 @@ +winnetou::/etc/init.d/slapd start +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home +carol::sleep 3 diff --git a/testing/tests/ikev2/crl-ldap/test.conf b/testing/tests/ikev2/crl-ldap/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-revoked/description.txt b/testing/tests/ikev2/crl-revoked/description.txt new file mode 100644 index 000000000..b39c59c97 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/description.txt @@ -0,0 +1,4 @@ +By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The remote host <b>carol</b> +initiates the connection and presents a certificate that has been revoked by the +current CRL causing the IKE negotiation to fail. diff --git a/testing/tests/ikev2/crl-revoked/evaltest.dat b/testing/tests/ikev2/crl-revoked/evaltest.dat new file mode 100644 index 000000000..3d6cf72bb --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::certificate was revoked::YES +moon::cat /var/log/daemon.log::end entity certificate is not trusted::YES +carol::cat /var/log/daemon.log::AUTHENTICATION_FAILED::YES +moon::ipsec listcrls:: ok::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..29b3c2a65 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolRevokedCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem new file mode 100644 index 000000000..5b742fc9e --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEIjCCAwqgAwIBAgIBBzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjU0OFoXDTA5MDkwOTExMjU0OFowWjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAM5413q1B2EF3spcYD1u0ce9AtIHdxmU3+1E0hqV +mLqpIQtyp4SLbrRunxpoVUuEpHWXgLb3C/ljjlKCMWWmhw4wja1rBTjMNJLPj6Bo +5Qn4Oeuqm7/kLHPGbveQGtcSsJCk6iLqFTbq0wsji5Ogq7kmjWgQv0nM2jpofHLv +VOAtWVSj+x2b3OHdl/WpgTgTw1HHjYo7/NOkARdTcZ2/wxxM3z1Abp9iylc45GLN +IL/OzHkT8b5pdokdMvVijz8IslkkewJYXrVQaCNMZg/ydlXOOAEKz0YqnvXQaYs5 +K+s8XvQ2RFCr5oO0fRT2VbiI9TgHnbcnfUi25iHl6txsXg0CAwEAAaOCAQYwggEC +MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBTbA2TH3ca8tgCGkYy9 +OV/MqUTHAzBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT +EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz +d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u +b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQC9acuCUPEBOrWB +56vS8N9bksQwv/XcYIFYqV73kFBAzOPLX2a9igFGvBPdCxFu/t8JCswzE6to4LFM +2+6Z2QJf442CLPcJKxITahrjJXSxGbzMlmaDvZ5wFCJAlyin+yuInpTwl8rMZe/Q +O5JeJjzGDgWJtnGdkLUk/l2r6sZ/Cmk5rZpuO0hcUHVztMLQYPzqTpuMvC5p4JzL +LWGWhKRhJs53NmxXXodck/ZgaqiTWuQFYlbamJRvzVBfX7c1SWHRJvxSSOPKGIg3 +wphkO2naj/SQD+BNuWTRmZ9YCiLOQ64ybLpJzRZISETdqtLBPKsIqosUZwkxlR1N +9IcgYi5x +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem new file mode 100644 index 000000000..8aefcc5a6 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAznjXerUHYQXeylxgPW7Rx70C0gd3GZTf7UTSGpWYuqkhC3Kn +hItutG6fGmhVS4SkdZeAtvcL+WOOUoIxZaaHDjCNrWsFOMw0ks+PoGjlCfg566qb +v+Qsc8Zu95Aa1xKwkKTqIuoVNurTCyOLk6CruSaNaBC/SczaOmh8cu9U4C1ZVKP7 +HZvc4d2X9amBOBPDUceNijv806QBF1Nxnb/DHEzfPUBun2LKVzjkYs0gv87MeRPx +vml2iR0y9WKPPwiyWSR7AlhetVBoI0xmD/J2Vc44AQrPRiqe9dBpizkr6zxe9DZE +UKvmg7R9FPZVuIj1OAedtyd9SLbmIeXq3GxeDQIDAQABAoIBAAUdyXko8z3cP2EU +WO4syNYCQQejV7gykDn48pvmCRrXBhKajLwkGGIwO5ET9MkiSFEBqBbgmFNdvDEf +OMokDkSzv08Ez+RQax0YN57p+oL8u7KzT5i5tsBHsog/8epSdD2hWIv08QGjYAdu +og7OdHLqGabyg0r44I+B91OBysCjU51rDdkhz59AmURdEIJV5xhuGojFM68jaNm2 +MUxDfDuCsRIydjAP0VTUTAUxD4/S5I+jt/GK9aRsEeRH9Q3011iTGMR9viAUBhq/ +khkWNltg9lkOqO7LpnNku4sSv3v4CWge7/T+4RR2vZgv1oSs4ox2UKYoqIqiYIfx +uUcnqQECgYEA+LPiRMoXvlssQWlaFc2k4xga0efs+mWeLglDdc3R3fBEibP/AU07 +a576AgvUJtkI50/WNGKT73O+VtxcXn/N646m/8OtqNXuVKKjsxxNOZEKdO8aOdbt +7lM5WepNiQeaKAFudUxpUiZQx8LCKSsNDiJZKWBu6xAG2O5X32VMZvUCgYEA1Ie+ +rNa490PSC1ym7WbmdAjvGmSOn2GOBfO7BECsPZstccU7D5pZl/89fTfn1TDKP49Y +ScVOuFz7f/u6UJpb/WzI71RXEQOdojLWmF2HDx5osRi3hXEJa20fbPq6DQXCJ8pf +IF37AEqAY4UNSNic0Cw+rGHdWPQhDNXhFWpdu7kCgYEAmv4oNmyoDXbuhrlsbggi +CXE9TbG3a3mm8dPOGf2yHBmf7R2i/6GtNW33Kw1KIwfBV77WpQEGZwWACsv8ONx3 +baUSiHTfpkfk5xQQ5w/tRMISfTuB4agD0jJFnLa7qXl2ZhY2S53aSVsdntDOhi+R +TEy1umah2Za8Xbd0RgHwcn0CgYEAl9Hgg9dfikMIaNVm6W/4cCtxoojy2Sf3LIlP +r1oDsH6JmBwsdJjuJ4ZNhoXJNqID2COuDgTEly7U+jf4gFvEGuT7JPw6tgy/Ln7i +jTVCpaozX08oykpVUEhDirYQ8fyLFaGbEqQQCcUusej59G/IlW0F2F6QoFrEwUaH +46R4EQECgYBEZ7edMkj3dmJH1wxQjp5GJNbrJkS8IKvzza0mDTJdz33CgEX9Oyva +o2iEkDVpvj2SEy28ewt22IRptWKH/3bQfxSCcRV6JFNt3+LongMshRYqq1leqrKa +9fnQVtfTIbIVXwjTZap6BL8R66OeFtexsSFRfDF/8P4n2oF4zmn4qA== +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..8e31be4cb --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolRevokedKey.pem diff --git a/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a1a9587dd --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/crl-revoked/posttest.dat b/testing/tests/ikev2/crl-revoked/posttest.dat new file mode 100644 index 000000000..d742e8410 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/crl-revoked/pretest.dat b/testing/tests/ikev2/crl-revoked/pretest.dat new file mode 100644 index 000000000..8984dcbcf --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home diff --git a/testing/tests/ikev2/crl-revoked/test.conf b/testing/tests/ikev2/crl-revoked/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-strict/description.txt b/testing/tests/ikev2/crl-strict/description.txt new file mode 100644 index 000000000..b2b70906f --- /dev/null +++ b/testing/tests/ikev2/crl-strict/description.txt @@ -0,0 +1,2 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict CRL policy</b> is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. diff --git a/testing/tests/ikev2/crl-strict/evaltest.dat b/testing/tests/ikev2/crl-strict/evaltest.dat new file mode 100644 index 000000000..ac70750c5 --- /dev/null +++ b/testing/tests/ikev2/crl-strict/evaltest.dat @@ -0,0 +1,4 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +moon::ipsec listcrls:: ok::YES +carol::ipsec listcrls:: ok::YES diff --git a/testing/tests/ikev2/crl-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-strict/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..52e5c291d --- /dev/null +++ b/testing/tests/ikev2/crl-strict/hosts/carol/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a9f6a4bb4 --- /dev/null +++ b/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf @@ -0,0 +1,34 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn net-net + leftsubnet=10.1.0.0/16 + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=add + +conn host-host + right=PH_IP_SUN + rightid=@sun.strongswan.org + auto=add + +conn rw + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/crl-strict/posttest.dat b/testing/tests/ikev2/crl-strict/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/crl-strict/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/crl-strict/pretest.dat b/testing/tests/ikev2/crl-strict/pretest.dat new file mode 100644 index 000000000..8984dcbcf --- /dev/null +++ b/testing/tests/ikev2/crl-strict/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home diff --git a/testing/tests/ikev2/crl-strict/test.conf b/testing/tests/ikev2/crl-strict/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-strict/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-to-cache/description.txt b/testing/tests/ikev2/crl-to-cache/description.txt new file mode 100644 index 000000000..9f542e73d --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/description.txt @@ -0,0 +1,6 @@ +By setting <b>cachecrls=yes</b> in ipsec.conf, a copy of the CRL fetched +via http from the web server <b>winnetou</b> is saved locally in the +directory <b>/etc/ipsec.d/crls</b> on both the roadwarrior <b>carol</b> +and the gateway <b>moon</b> when the IPsec connection is set up. The +<b>subjectKeyIdentifier</b> of the issuing CA plus the suffix <b>.crl</b> +is used as a unique filename for the cached CRL. diff --git a/testing/tests/ikev2/crl-to-cache/evaltest.dat b/testing/tests/ikev2/crl-to-cache/evaltest.dat new file mode 100644 index 000000000..14edd946f --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/evaltest.dat @@ -0,0 +1,4 @@ +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES +moon::cat /var/log/daemon.log::written crl file.*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES +carol::cat /var/log/daemon.log::written crl file.*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES diff --git a/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..cea581bc2 --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..fe2179885 --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/crl-to-cache/posttest.dat b/testing/tests/ikev2/crl-to-cache/posttest.dat new file mode 100644 index 000000000..be17847c1 --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::rm /etc/ipsec.d/crls/* +carol::rm /etc/ipsec.d/crls/* diff --git a/testing/tests/ocsp-strict/pretest.dat b/testing/tests/ikev2/crl-to-cache/pretest.dat index d5516fd3b..d92333d86 100644 --- a/testing/tests/ocsp-strict/pretest.dat +++ b/testing/tests/ikev2/crl-to-cache/pretest.dat @@ -1,4 +1,3 @@ -winnetou::/etc/openssl/start-ocsp moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/crl-to-cache/test.conf b/testing/tests/ikev2/crl-to-cache/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/default-keys/description.txt b/testing/tests/ikev2/default-keys/description.txt new file mode 100644 index 000000000..639e909da --- /dev/null +++ b/testing/tests/ikev2/default-keys/description.txt @@ -0,0 +1,8 @@ +Because of the missing <b>/etc/ipsec.secrets</b> file, roadwarrior <b>carol</b> +and gateway <b>moon</b> each automatically generate a PKCS#1 RSA private key +and a self-signed X.509 certificate. Because the UML testing environment does +not offer enough entropy, the non-blocking /dev/urandom device is used in place +of /dev/random for generating the random primes. +<p> +The self-signed certificates are then distributed to the peers via scp +and are used to set up a road warrior connection initiated by <b>carol</b> diff --git a/testing/tests/ikev2/default-keys/evaltest.dat b/testing/tests/ikev2/default-keys/evaltest.dat new file mode 100644 index 000000000..2c1e11c97 --- /dev/null +++ b/testing/tests/ikev2/default-keys/evaltest.dat @@ -0,0 +1,7 @@ +carol::cat /var/log/auth.log::scepclient::YES +moon::cat /var/log/auth.log::scepclient::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +moon::ipsec statusall::carol.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..a4668d9ae --- /dev/null +++ b/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=selfCert.der + leftsendcert=never + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightcert=peerCert.der + rightsendcert=never + auto=add diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables new file mode 100755 index 000000000..13ad3063f --- /dev/null +++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables @@ -0,0 +1,78 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +opts="start stop reload" + +depend() { + before net + need logger +} + +start() { + ebegin "Starting firewall" + + # enable IP forwarding + echo 1 > /proc/sys/net/ipv4/ip_forward + + # default policy is DROP + /sbin/iptables -P INPUT DROP + /sbin/iptables -P OUTPUT DROP + /sbin/iptables -P FORWARD DROP + + # allow esp + iptables -A INPUT -i eth0 -p 50 -j ACCEPT + iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT + + # allow IKE + iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT + iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + + # allow crl fetch from winnetou + iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT + iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + + # allow ssh + iptables -A INPUT -p tcp --dport 22 -j ACCEPT + iptables -A INPUT -p tcp --sport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT + + eend $? +} + +stop() { + ebegin "Stopping firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + + if [ $a == nat ]; then + /sbin/iptables -t nat -P PREROUTING ACCEPT + /sbin/iptables -t nat -P POSTROUTING ACCEPT + /sbin/iptables -t nat -P OUTPUT ACCEPT + elif [ $a == mangle ]; then + /sbin/iptables -t mangle -P PREROUTING ACCEPT + /sbin/iptables -t mangle -P INPUT ACCEPT + /sbin/iptables -t mangle -P FORWARD ACCEPT + /sbin/iptables -t mangle -P OUTPUT ACCEPT + /sbin/iptables -t mangle -P POSTROUTING ACCEPT + elif [ $a == filter ]; then + /sbin/iptables -t filter -P INPUT ACCEPT + /sbin/iptables -t filter -P FORWARD ACCEPT + /sbin/iptables -t filter -P OUTPUT ACCEPT + fi + done + eend $? +} + +reload() { + ebegin "Flushing firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + done; + eend $? + start +} + diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..b6a0e4990 --- /dev/null +++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn carol + left=PH_IP_MOON + leftnexthop=%direct + leftcert=selfCert.der + leftsendcert=never + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + rightcert=peerCert.der + rightsendcert=never + auto=add diff --git a/testing/tests/ikev2/default-keys/posttest.dat b/testing/tests/ikev2/default-keys/posttest.dat new file mode 100644 index 000000000..8cada5e7e --- /dev/null +++ b/testing/tests/ikev2/default-keys/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +carol::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/certs/* +moon::rm /etc/ipsec.d/private/* +moon::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/default-keys/pretest.dat b/testing/tests/ikev2/default-keys/pretest.dat new file mode 100644 index 000000000..fe68be4b5 --- /dev/null +++ b/testing/tests/ikev2/default-keys/pretest.dat @@ -0,0 +1,18 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +carol::rm /etc/ipsec.secrets +carol::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/cacerts/* +carol::ipsec start +moon::rm /etc/ipsec.secrets +moon::rm /etc/ipsec.d/private/* +moon::rm /etc/ipsec.d/certs/* +moon::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +moon::sleep 3 +moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der +moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der +moon::ipsec reload +carol::ipsec reload +carol::ipsec up home diff --git a/testing/tests/ikev2/default-keys/test.conf b/testing/tests/ikev2/default-keys/test.conf new file mode 100644 index 000000000..0baa48d90 --- /dev/null +++ b/testing/tests/ikev2/default-keys/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol" + +# Corresponding block diagram +# +DIAGRAM="a-m-c.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/double-nat-net/description.txt b/testing/tests/ikev2/double-nat-net/description.txt new file mode 100644 index 000000000..ff09155f6 --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/description.txt @@ -0,0 +1,7 @@ +The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a +tunnel to the subnet hiding behind the NAT router <b>sun</b>. All IKE and ESP traffic +directed to the router <b>sun</b> is forwarded to the VPN gateway <b>bob</b> +using destination NAT. UDP encapsulation is used to traverse the NAT routers. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that +let pass the tunneled traffic. In order to test the double NAT-ed IPsec +tunnel <b>alice</b> pings the inner IP address of the router <b>sun</b>. diff --git a/testing/tests/ikev2/double-nat-net/evaltest.dat b/testing/tests/ikev2/double-nat-net/evaltest.dat new file mode 100644 index 000000000..aa69dabfa --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/evaltest.dat @@ -0,0 +1,5 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +bob::ipsec statusall::nat-t.*INSTALLED::YES +alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..c8aa460cf --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=bob@strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf new file mode 100755 index 000000000..f0c5b6f15 --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftsubnet=10.2.0.0/16 + leftcert=bobCert.pem + leftid=bob@strongswan.org + leftfirewall=yes + right=%any + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/double-nat-net/posttest.dat b/testing/tests/ikev2/double-nat-net/posttest.dat new file mode 100644 index 000000000..484297418 --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/posttest.dat @@ -0,0 +1,9 @@ +bob::ipsec stop +alice::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +bob::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +sun::iptables -t nat -F +moon::conntrack -F +sun::conntrack -F +sun::ip route del 10.1.0.0/16 via PH_IP_BOB diff --git a/testing/tests/ikev2/double-nat-net/pretest.dat b/testing/tests/ikev2/double-nat-net/pretest.dat new file mode 100644 index 000000000..41b69aed6 --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/pretest.dat @@ -0,0 +1,15 @@ +alice::/etc/init.d/iptables start 2> /dev/null +bob::/etc/init.d/iptables start 2> /dev/null +bob::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 +sun::iptables -t nat -A PREROUTING -i eth0 -s PH_IP_MOON -p udp -j DNAT --to-destination PH_IP_BOB +sun::ip route add 10.1.0.0/16 via PH_IP_BOB +alice::ipsec start +bob::ipsec start +alice::sleep 2 +alice::ipsec up nat-t +alice::sleep 1 diff --git a/testing/tests/ikev2/double-nat-net/test.conf b/testing/tests/ikev2/double-nat-net/test.conf new file mode 100644 index 000000000..1ca2ffe5a --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/double-nat/description.txt b/testing/tests/ikev2/double-nat/description.txt new file mode 100644 index 000000000..ce7de0e56 --- /dev/null +++ b/testing/tests/ikev2/double-nat/description.txt @@ -0,0 +1,5 @@ +The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a tunnel to +the peer <b>bob</b> hiding behind the NAT router <b>sun</b>. UDP encapsulation is used to +traverse the NAT routers. <b>leftfirewall=yes</b> automatically inserts iptables-based +firewall rules that let pass the tunneled traffic. In order to test the double NAT-ed IPsec +tunnel <b>alice</b> pings <b>bob</b>. diff --git a/testing/tests/ikev2/double-nat/evaltest.dat b/testing/tests/ikev2/double-nat/evaltest.dat new file mode 100644 index 000000000..77deea2a7 --- /dev/null +++ b/testing/tests/ikev2/double-nat/evaltest.dat @@ -0,0 +1,5 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +bob::ipsec statusall::nat-t.*INSTALLED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..26830f390 --- /dev/null +++ b/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=bob@strongswan.org + rightsubnet=PH_IP_BOB/32 + auto=add diff --git a/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf new file mode 100755 index 000000000..b4a24cb1f --- /dev/null +++ b/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=bobCert.pem + leftid=bob@strongswan.org + leftfirewall=yes + right=%any + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/double-nat/posttest.dat b/testing/tests/ikev2/double-nat/posttest.dat new file mode 100644 index 000000000..5d39e406d --- /dev/null +++ b/testing/tests/ikev2/double-nat/posttest.dat @@ -0,0 +1,8 @@ +bob::ipsec stop +alice::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +bob::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +sun::iptables -t nat -F +moon::conntrack -F +sun::conntrack -F diff --git a/testing/tests/ikev2/double-nat/pretest.dat b/testing/tests/ikev2/double-nat/pretest.dat new file mode 100644 index 000000000..10ba6d735 --- /dev/null +++ b/testing/tests/ikev2/double-nat/pretest.dat @@ -0,0 +1,13 @@ +alice::/etc/init.d/iptables start 2> /dev/null +bob::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 +sun::iptables -t nat -A PREROUTING -i eth0 -s PH_IP_MOON -p udp -j DNAT --to-destination PH_IP_BOB +alice::ipsec start +bob::ipsec start +alice::sleep 2 +alice::ipsec up nat-t +alice::sleep 1 diff --git a/testing/tests/ikev2/double-nat/test.conf b/testing/tests/ikev2/double-nat/test.conf new file mode 100644 index 000000000..1ca2ffe5a --- /dev/null +++ b/testing/tests/ikev2/double-nat/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/dpd-clear/description.txt b/testing/tests/ikev2/dpd-clear/description.txt new file mode 100644 index 000000000..7f62dc576 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/description.txt @@ -0,0 +1,5 @@ +The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway <b>moon</b> +which in turn activates <b>Dead Peer Detection</b> (DPD) with a polling interval of 10 s. +When the network connectivity between <b>carol</b> and <b>moon</b> is forcefully disrupted, +<b>moon</b> clears the connection after 4 unsuccessful retransmits. + diff --git a/testing/tests/ikev2/dpd-clear/evaltest.dat b/testing/tests/ikev2/dpd-clear/evaltest.dat new file mode 100644 index 000000000..86c0227bd --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/evaltest.dat @@ -0,0 +1,6 @@ +carol::ipsec statusall::home.*INSTALLED::YES +carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +moon::sleep 180::no output expected::NO +moon::cat /var/log/daemon.log::sending DPD request::YES +moon::cat /var/log/daemon.log::retransmit.*of request::YES +moon::cat /var/log/daemon.log::giving up after 5 retransmits::YES diff --git a/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..e5d9ad476 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..97b5411bd --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + leftnexthop=%direct + keyexchange=ikev2 + dpdaction=clear + dpddelay=10 + +conn rw + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + rightid=carol@strongswan.org + auto=add diff --git a/testing/tests/ikev2/dpd-clear/posttest.dat b/testing/tests/ikev2/dpd-clear/posttest.dat new file mode 100644 index 000000000..931db4272 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/posttest.dat @@ -0,0 +1,3 @@ +carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/dpd-clear/pretest.dat b/testing/tests/ikev2/dpd-clear/pretest.dat new file mode 100644 index 000000000..14ed95322 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/dpd-clear/test.conf b/testing/tests/ikev2/dpd-clear/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dpd-hold/description.txt b/testing/tests/ikev2/dpd-hold/description.txt new file mode 100644 index 000000000..405e67cb9 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/description.txt @@ -0,0 +1,7 @@ +The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway +<b>moon</b>. Both end points activate <b>Dead Peer Detection</b> (DPD) with a +polling interval of 10 s. When the network connectivity between <b>carol</b> +and <b>moon</b> is forcefully disrupted for a duration of 100 s, <b>moon</b> +clears the connection after 4 unsuccessful retransmits whereas <b>carol</b> +also takes down the connection but installs a route which triggers when +<b>carol</b> sends a ping to client <b>alice</b> behind gateway <b>moon</b>. diff --git a/testing/tests/ikev2/dpd-hold/evaltest.dat b/testing/tests/ikev2/dpd-hold/evaltest.dat new file mode 100644 index 000000000..2cf063762 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/evaltest.dat @@ -0,0 +1,14 @@ +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::rw.*INSTALLED::YES +moon::iptables -A INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO +carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +carol::sleep 180::no output expected::NO +carol::cat /var/log/daemon.log::sending DPD request::YES +carol::cat /var/log/daemon.log::retransmit.*of request::YES +carol::cat /var/log/daemon.log::giving up after 5 retransmits::YES +carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +moon::iptables -D INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO +carol::ping -c 1 PH_IP_ALICE::trigger route::NO +carol::sleep 2::no output expected::NO +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::rw.*INSTALLED::YES diff --git a/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..dff90e563 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + dpdaction=hold + dpddelay=10 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..97b5411bd --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + leftnexthop=%direct + keyexchange=ikev2 + dpdaction=clear + dpddelay=10 + +conn rw + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + rightid=carol@strongswan.org + auto=add diff --git a/testing/tests/ikev2/dpd-hold/posttest.dat b/testing/tests/ikev2/dpd-hold/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/dpd-hold/pretest.dat b/testing/tests/ikev2/dpd-hold/pretest.dat new file mode 100644 index 000000000..14ed95322 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/dpd-hold/test.conf b/testing/tests/ikev2/dpd-hold/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dpd-restart/description.txt b/testing/tests/ikev2/dpd-restart/description.txt new file mode 100644 index 000000000..410d3d636 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/description.txt @@ -0,0 +1,7 @@ +The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway +<b>moon</b>. Both end points activate <b>Dead Peer Detection</b> (DPD) with a +polling interval of 10 s. When the network connectivity between <b>carol</b> +and <b>moon</b> is forcefully disrupted for a duration of 100 s, <b>moon</b> +clears the connection after 4 unsuccessful retransmits whereas <b>carol</b> +also takes down the connection but immediately tries to reconnect which succeeds +as soon as the connection becomes available again. diff --git a/testing/tests/ikev2/dpd-restart/evaltest.dat b/testing/tests/ikev2/dpd-restart/evaltest.dat new file mode 100644 index 000000000..28edd4823 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/evaltest.dat @@ -0,0 +1,13 @@ +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::rw.*INSTALLED::YES +moon::iptables -A INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO +carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +carol::sleep 180::no output expected::NO +carol::cat /var/log/daemon.log::sending DPD request::YES +carol::cat /var/log/daemon.log::retransmit.*of request::YES +carol::cat /var/log/daemon.log::giving up after 5 retransmits::YES +carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +moon::iptables -D INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO +carol::sleep 10::no output expected::NO +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::rw.*INSTALLED::YES diff --git a/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..7c5b88a2c --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + dpdaction=restart + dpddelay=10 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..97b5411bd --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + leftnexthop=%direct + keyexchange=ikev2 + dpdaction=clear + dpddelay=10 + +conn rw + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + rightid=carol@strongswan.org + auto=add diff --git a/testing/tests/ikev2/dpd-restart/posttest.dat b/testing/tests/ikev2/dpd-restart/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/dpd-restart/pretest.dat b/testing/tests/ikev2/dpd-restart/pretest.dat new file mode 100644 index 000000000..14ed95322 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/dpd-restart/test.conf b/testing/tests/ikev2/dpd-restart/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/host2host-cert/description.txt b/testing/tests/ikev2/host2host-cert/description.txt new file mode 100644 index 000000000..6be21bf8f --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/description.txt @@ -0,0 +1,4 @@ +A connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up. +The authentication is based on X.509 certificates. <b>leftfirewall=yes</b> automatically +inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test the host-to-host tunnel <b>moon</b> pings <b>sun</b>. diff --git a/testing/tests/ikev2/host2host-cert/evaltest.dat b/testing/tests/ikev2/host2host-cert/evaltest.dat new file mode 100644 index 000000000..8d5d8167a --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::host-host.*ESTABLISHED::YES +sun::ipsec statusall::host-host.*ESTABLISHED::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..2d41690cc --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + auto=add diff --git a/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..7ffbf64ac --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_SUN + leftnexthop=%direct + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/host2host-cert/posttest.dat b/testing/tests/ikev2/host2host-cert/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/host2host-cert/pretest.dat b/testing/tests/ikev2/host2host-cert/pretest.dat new file mode 100644 index 000000000..1fa70177c --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up host-host diff --git a/testing/tests/ikev2/host2host-cert/test.conf b/testing/tests/ikev2/host2host-cert/test.conf new file mode 100644 index 000000000..305a67316 --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/host2host-swapped/description.txt b/testing/tests/ikev2/host2host-swapped/description.txt new file mode 100644 index 000000000..34cfe43cc --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/description.txt @@ -0,0 +1,3 @@ +Same scenario as test <a href="../host2host-cert/"><b>host2host-cert</b></a> but with +swapped end definitions: <b>right</b> denotes the <b>local</b> side whereas +<b>left</b> stands for the <b>remote</b> peer. diff --git a/testing/tests/ikev2/host2host-swapped/evaltest.dat b/testing/tests/ikev2/host2host-swapped/evaltest.dat new file mode 100644 index 000000000..8d5d8167a --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::host-host.*ESTABLISHED::YES +sun::ipsec statusall::host-host.*ESTABLISHED::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..0c3dd7abe --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + right=PH_IP_MOON + rightnexthop=%direct + rightcert=moonCert.pem + rightid=@moon.strongswan.org + rightfirewall=yes + left=PH_IP_SUN + leftid=@sun.strongswan.org + auto=add diff --git a/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..bd510cc73 --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + right=PH_IP_SUN + rightnexthop=%direct + rightcert=sunCert.pem + rightid=@sun.strongswan.org + rightfirewall=yes + left=PH_IP_MOON + leftid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/host2host-swapped/posttest.dat b/testing/tests/ikev2/host2host-swapped/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/host2host-swapped/pretest.dat b/testing/tests/ikev2/host2host-swapped/pretest.dat new file mode 100644 index 000000000..1fa70177c --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up host-host diff --git a/testing/tests/ikev2/host2host-swapped/test.conf b/testing/tests/ikev2/host2host-swapped/test.conf new file mode 100644 index 000000000..305a67316 --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/host2host-transport/description.txt b/testing/tests/ikev2/host2host-transport/description.txt new file mode 100644 index 000000000..fe3482c96 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/description.txt @@ -0,0 +1,4 @@ +An IPsec <b>transport-mode</b> connection between the hosts <b>moon</b> and <b>sun</b> is +successfully set up. <b>leftfirewall=yes</b> automatically inserts iptables-based firewall +rules that let pass the decrypted IP packets. In order to test the host-to-host connection +<b>moon</b> pings <b>sun</b>. diff --git a/testing/tests/ikev2/host2host-transport/evaltest.dat b/testing/tests/ikev2/host2host-transport/evaltest.dat new file mode 100644 index 000000000..a46e4e4e4 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec status::host-host.*INSTALLED.*TRANSPORT::YES +sun::ipsec status::host-host.*INSTALLED.*TRANSPORT::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..f957e5fb3 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + type=transport + auto=add diff --git a/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..52b605024 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_SUN + leftnexthop=%direct + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + type=transport + auto=add diff --git a/testing/tests/ikev2/host2host-transport/posttest.dat b/testing/tests/ikev2/host2host-transport/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/host2host-transport/pretest.dat b/testing/tests/ikev2/host2host-transport/pretest.dat new file mode 100644 index 000000000..e2d98f2eb --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 2 +moon::ipsec up host-host diff --git a/testing/tests/ikev2/host2host-transport/test.conf b/testing/tests/ikev2/host2host-transport/test.conf new file mode 100644 index 000000000..cf2e704fd --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/nat-double-snat/description.txt b/testing/tests/ikev2/nat-double-snat/description.txt new file mode 100644 index 000000000..e0708898b --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/description.txt @@ -0,0 +1,6 @@ +The roadwarrior <b>alice</b> sets up a connection to host <b>bob</b> using IKEv2. The hosts +sit behind NAT router <b>moon</b> (SNAT) and <b>sun</b> (SNAT) respectively. +UDP encapsulation is used to traverse the NAT router. +The authentication is based on locally loaded <b>X.509 certificates</b>. +In order to test the tunnel the NAT-ed host <b>alice</b> pings the host +<b>bob</b>. diff --git a/testing/tests/ikev2/nat-double-snat/evaltest.dat b/testing/tests/ikev2/nat-double-snat/evaltest.dat new file mode 100644 index 000000000..7a3dede42 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/evaltest.dat @@ -0,0 +1,5 @@ +bob::ipsec statusall::rw-alice.*ESTABLISHED::YES +alice::ipsec statusall::home.*ESTABLISHED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdumpcount::IP moon.strongswan.org.* > bob.strongswan.org.ipsec-nat-t: UDP::2 +moon::tcpdumpcount::IP bob.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::2 diff --git a/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf new file mode 100644 index 000000000..30a067bc9 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf @@ -0,0 +1,16 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn home + left=PH_IP_ALICE + leftcert=aliceCert.pem + leftid=alice@strongswan.org + right=PH_IP_BOB + rightcert=bobCert.pem + rightid=bob@strongswan.org + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem new file mode 100644 index 000000000..199d3eee2 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHjCCAwagAwIBAgIBBjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjUzNFoXDTA5MDkwOTExMjUzNFowWDELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMRswGQYDVQQDFBJib2JAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDAJaejS3/lJfQHgw0nzvotgSQS8ey/6tvbx7s5RsWY +27x9K5xd44aPrvP2Qpyq34IXRY6uPlIqeUTQN7EKpLrWCxMOT36x5N0Co9J5UWRB +fJC141D+8+1RwJ9/baEIecpCvb0GfDOX0GXN5ltcJk82hZjE4y1yHC1FN7V3zdRg +xmloupPuon+X3bTmyMQ93NKkg48CQGtqtfwQ0MqPiOWu8MBhdztfOyu6aW3EgviF +ithLc02SeNzlpqB3M8GDfX+mr3OVDhhhC2OI+VRlZzz7KxJ13DUR2KkvLZR8Ak4E +5lRjkUnTYd/f3OQYxfjC8idUmj5ojR6Fb0x1tsV/glzXAgMBAAGjggEEMIIBADAJ +BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQUaLN5EPOkOkVU3J1Ud0sl ++27OOHswbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ +BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz +dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHQYDVR0RBBYwFIESYm9iQHN0cm9uZ3N3YW4u +b3JnMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcv +c3Ryb25nc3dhbi5jcmwwDQYJKoZIhvcNAQEEBQADggEBAIyQLLxdeO8clplzRW9z +TRR3J0zSedvi2XlIZ/XCsv0ZVfoBLLWcDp3QrxNiVZXvXXtzjPsDs+DAveZF9LGq +0tIw1uT3JorbgNNrmWvxBvJoQTtSw4LQBuV7vF27jrposx3Hi5qtUXUDS6wVnDUI +5iORqsrddnoDuMN+Jt7oRcvKfYSNwTV+m0ZAHdB5a/ARWO5UILOrxEA/N72NcDYN +NdAd+bLaB38SbkSbh1xj/AGnrHxdJBF4h4mx4btc9gtBSh+dwBHOsn4TheqJ6bbw +7FlXBowQDCJIswKNhWfnIepQlM1KEzmq5YX43uZO2b7amRaIKqy2vNE7+UNFYBpE +Mto= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf new file mode 100644 index 000000000..eaec3d642 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn %default + left=PH_IP_BOB + leftcert=bobCert.pem + leftid=bob@strongswan.org + leftsubnet=10.2.0.10/32 + keyexchange=ikev2 + +conn rw-alice + right=%any + rightcert=aliceCert.pem + rightid=alice@strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem new file mode 100644 index 000000000..e99ae8ec7 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer +GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4 +FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W +6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH +v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc +KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG +A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa +60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG +A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0 +cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo +2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ +AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5 +D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S +CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi +6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re +JGhV +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-double-snat/posttest.dat b/testing/tests/ikev2/nat-double-snat/posttest.dat new file mode 100644 index 000000000..8ad7df96c --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/posttest.dat @@ -0,0 +1,8 @@ +alice::ipsec stop +bob::ipsec stop +alice::rm /etc/ipsec.d/certs/* +bob::rm /etc/ipsec.d/certs/* +moon::route del -net 10.2.0.0/16 +sun::route del -net 10.1.0.0/16 +moon::iptables -t nat -F +sun::iptables -t nat -F diff --git a/testing/tests/ikev2/nat-double-snat/pretest.dat b/testing/tests/ikev2/nat-double-snat/pretest.dat new file mode 100644 index 000000000..da1d43c4e --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/pretest.dat @@ -0,0 +1,11 @@ +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::route add -net 10.1.0.0/16 gw PH_IP_MOON +sun::iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.0/24 -p udp -j SNAT --to-source PH_IP_SUN1:4024-4100 +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::route add -net 10.2.0.0/16 gw PH_IP_SUN +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +bob::ipsec start +alice::ipsec start +alice::sleep 1 +alice::ipsec up home +alice::sleep 1 diff --git a/testing/tests/ikev2/nat-double-snat/test.conf b/testing/tests/ikev2/nat-double-snat/test.conf new file mode 100644 index 000000000..1ca2ffe5a --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/nat-one-rw/description.txt b/testing/tests/ikev2/nat-one-rw/description.txt new file mode 100644 index 000000000..c3b9bb820 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/description.txt @@ -0,0 +1,5 @@ +The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a tunnel to +gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnel, the NAT-ed host <b>alice</b> pings the +client <b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-one-rw/evaltest.dat b/testing/tests/ikev2/nat-one-rw/evaltest.dat new file mode 100644 index 000000000..7395e5571 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/evaltest.dat @@ -0,0 +1,5 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec statusall::nat-t.*INSTALLED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..8db43213f --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..a2c168601 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf @@ -0,0 +1,35 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + +conn net-net + leftsubnet=10.2.0.0/16 + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + +conn host-host + right=PH_IP_MOON + rightid=@moon.strongswan.org + auto=add + +conn nat-t + leftsubnet=10.2.0.0/16 + right=%any + rightsubnet=10.1.0.10/32 + auto=add diff --git a/testing/tests/ikev2/nat-one-rw/posttest.dat b/testing/tests/ikev2/nat-one-rw/posttest.dat new file mode 100644 index 000000000..cd0d4df25 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/posttest.dat @@ -0,0 +1,6 @@ +alice::ipsec stop +sun::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/ikev2/nat-one-rw/pretest.dat b/testing/tests/ikev2/nat-one-rw/pretest.dat new file mode 100644 index 000000000..ebd0c19e2 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/pretest.dat @@ -0,0 +1,11 @@ +alice::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +alice::ipsec start +sun::ipsec start +alice::sleep 4 +alice::ipsec up nat-t +alice::sleep 1 + diff --git a/testing/tests/ikev2/nat-one-rw/test.conf b/testing/tests/ikev2/nat-one-rw/test.conf new file mode 100644 index 000000000..d84149aaf --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/nat-pf/description.txt b/testing/tests/ikev2/nat-pf/description.txt new file mode 100644 index 000000000..bb38af458 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/description.txt @@ -0,0 +1,4 @@ +The roadwarrior <b>carol</b> sets up a connection to host <b>alice</b> sitting behind the NAT router <b>moon</b> +using IKEv2. Port Forwarding is used to publish host <b>alice</b>. UDP encapsulation is used to traverse the NAT router. +The authentication is based on locally loaded <b>X.509 certificates</b>. +In order to test the tunnel the roadwarrior <b>carol</b> pings the host <b>alice</b>. diff --git a/testing/tests/ikev2/nat-pf/evaltest.dat b/testing/tests/ikev2/nat-pf/evaltest.dat new file mode 100644 index 000000000..4d2950521 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/evaltest.dat @@ -0,0 +1,5 @@ +alice::ipsec statusall::rw-carol.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdumpcount::IP carol.strongswan.org.* > moon.strongswan.org.ipsec-nat-t: UDP::2 +moon::tcpdumpcount::IP moon.strongswan.org.ipsec-nat-t > carol.strongswan.org.*: UDP::2 diff --git a/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf new file mode 100644 index 000000000..836379494 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf @@ -0,0 +1,19 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn %default + left=PH_IP_ALICE + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftsubnet=10.1.0.10/32 + keyexchange=ikev2 + +conn rw-carol + right=%any + rightcert=carolCert.pem + rightid=carol@strongswan.org + auto=add diff --git a/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem new file mode 100644 index 000000000..8492fbd45 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX +T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl +vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii +S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW +LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM +YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC +MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD +j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT +EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz +d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u +b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI +U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM +2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE +HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd +hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG +C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK +omBYfxqp +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..52345af7c --- /dev/null +++ b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf @@ -0,0 +1,17 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn home + left=PH_IP_CAROL + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightcert=aliceCert.pem + rightid=alice@strongswan.org + rightsubnet=10.1.0.0/24 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem new file mode 100644 index 000000000..e99ae8ec7 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer +GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4 +FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W +6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH +v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc +KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG +A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa +60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG +A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0 +cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo +2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ +AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5 +D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S +CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi +6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re +JGhV +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-pf/posttest.dat b/testing/tests/ikev2/nat-pf/posttest.dat new file mode 100644 index 000000000..bed4ae1b7 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/posttest.dat @@ -0,0 +1,5 @@ +carol::ipsec stop +alice::ipsec stop +carol::rm /etc/ipsec.d/certs/* +alice::rm /etc/ipsec.d/certs/* +moon::iptables -t nat -F diff --git a/testing/tests/ikev2/nat-pf/pretest.dat b/testing/tests/ikev2/nat-pf/pretest.dat new file mode 100644 index 000000000..fdb3de711 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/pretest.dat @@ -0,0 +1,7 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -m multiport -t nat -A PREROUTING -i eth0 -p udp --dports 500,4500 -j DNAT --to 10.1.0.10 +alice::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/nat-pf/test.conf b/testing/tests/ikev2/nat-pf/test.conf new file mode 100644 index 000000000..21bece8e6 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice carol" diff --git a/testing/tests/ikev2/nat-portswitch/description.txt b/testing/tests/ikev2/nat-portswitch/description.txt new file mode 100644 index 000000000..93b779ee1 --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/description.txt @@ -0,0 +1,6 @@ +The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a connection +to gateway <b>sun</b> using IKEv2. UDP encapsulation is used to traverse the NAT router. +The authentication is based on locally loaded <b>X.509 certificates</b>. +After the IPsec Setup NAT router moon "crashes" (i.e. flushes its conntrack +table) and with the next dpd sent from <b>alice</b> a dynamical address update +should occur in gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-portswitch/evaltest.dat b/testing/tests/ikev2/nat-portswitch/evaltest.dat new file mode 100644 index 000000000..75b01a551 --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/evaltest.dat @@ -0,0 +1,10 @@ +sun::ipsec statusall::rw-alice.*ESTABLISHED::YES +alice::ipsec statusall::home.*ESTABLISHED::YES +moon::cmd::iptables -t nat -F::YES +moon::cmd::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:3024-3100::YES +moon::cmd::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:4000-4100::YES +moon::cmd::conntrack -F::YES +alice::cmd::sleep 75::YES +bob::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP, length: 132::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP, length: 132::YES diff --git a/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf new file mode 100644 index 000000000..cd9de533a --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf @@ -0,0 +1,17 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn home + left=PH_IP_ALICE + leftcert=aliceCert.pem + leftid=alice@strongswan.org + right=PH_IP_SUN + rightcert=sunCert.pem + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem new file mode 100644 index 000000000..e7825e3db --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIECzCCAvOgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMTU1M1oXDTA5MDkwOTExMTU1M1owRTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN1bi5z +dHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOQ8 +foB9h5BZ92gA5JkQTJNuoF6FAzoq91Gh7To27/g74p01+SUnsSaBfPmNfGp4avdS +Ewy2dWMA/7uj0Dbe8MEKssNztp0JQubp2s7n8mrrQLGsqB6YAS09l75XDjS3yqTC +AtH1kD4zAl/j/AyeQBuLR4CyJEmC/rqD3/a+pr42CaljuFBgBRpCTUpU4mlslZSe +zv9wu61PwTFxb8VDlBHUd/lwkXThKgU3uEhWRxLahpSldEGmiTTmx30k/XbOMF2n +HObEHt5EY9uWRGGbj81ZRWiNk0dNtbpneUHv/NvdWLc591M8cEGEQdWW2XTVbL2G +N67q8hdzGgIvb7QJPMcCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQD +AgOoMB0GA1UdDgQWBBQ9xLkyCBbyQmRet0vvV1Fg6z5q2DBtBgNVHSMEZjBkgBRd +p91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoT +EExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIB +ADAdBgNVHREEFjAUghJzdW4uc3Ryb25nc3dhbi5vcmcwOQYDVR0fBDIwMDAuoCyg +KoYoaHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2FuLmNybDANBgkq +hkiG9w0BAQQFAAOCAQEAGQQroiAa0SwwhJprGd7OM+rfBJAGbsa3DPzFCfHX1R7i +ZyDs9aph1DK+IgUa377Ev1U7oB0EldpmOoJJugCjtNLfpW3t1RXBERL/QfpO2+VP +Wt3SfZ0Oq48jiqB1MVLMZRPCICZEQjT4sJ3HYs5ZuucuvoxeMx3rQ4HxUtHtMD3S +5JNMwFFiOXAjyIyrTlb7YuRJTT5hE+Rms8GUQ5Xnt7zKZ7yfoSLFzy0/cLFPdQvE +JA7w8crODCZpDgEKVHVyUWuyt1O46N3ydUfDcnKJoQ9HWHm3xCbDex5MHTnvm1lk +Stx71CGM7TE6VPy028UlrSw0JqEwCVwstei2cMzwgA== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf new file mode 100644 index 000000000..a7722142f --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn %default + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + keyexchange=ikev2 + +conn rw-alice + right=%any + rightcert=aliceCert.pem + rightid=alice@strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem new file mode 100644 index 000000000..e99ae8ec7 --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer +GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4 +FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W +6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH +v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc +KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG +A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa +60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG +A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0 +cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo +2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ +AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5 +D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S +CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi +6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re +JGhV +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-portswitch/posttest.dat b/testing/tests/ikev2/nat-portswitch/posttest.dat new file mode 100644 index 000000000..3b9f53e9b --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/posttest.dat @@ -0,0 +1,6 @@ +sun::ipsec stop +alice::ipsec stop +sun::rm /etc/ipsec.d/certs/* +alice::rm /etc/ipsec.d/certs/* +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/ikev2/nat-portswitch/pretest.dat b/testing/tests/ikev2/nat-portswitch/pretest.dat new file mode 100644 index 000000000..17cc4b070 --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/pretest.dat @@ -0,0 +1,9 @@ +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +sun::ipsec start +alice::ipsec start +alice::sleep 1 +alice::ipsec up home +alice::sleep 1 diff --git a/testing/tests/ikev2/nat-portswitch/test.conf b/testing/tests/ikev2/nat-portswitch/test.conf new file mode 100644 index 000000000..d84149aaf --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/nat-rw-mixed/description.txt b/testing/tests/ikev2/nat-rw-mixed/description.txt new file mode 100644 index 000000000..511a1a874 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> +set up a connection to gateway <b>sun</b>. <b>alice</b> uses the IKEv2 key exchange protocol +whereas <b>venus</b> negotiates the connection via the IKEv1 protocol. +UDP encapsulation is used to traverse the NAT router. +In order to test the tunnel the NAT-ed hosts <b>alice</b> and <b>venus</b> ping the client +<b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-rw-mixed/evaltest.dat b/testing/tests/ikev2/nat-rw-mixed/evaltest.dat new file mode 100644 index 000000000..685c1b43f --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/evaltest.dat @@ -0,0 +1,9 @@ +sun::ipsec statusall::rw-alice.*ESTABLISHED::YES +sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES +sun::ipsec status::nat-t.*@venus.strongswan.org::YES +alice::ipsec statusall::home.*ESTABLISHED::YES +sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf new file mode 100644 index 000000000..cd9de533a --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf @@ -0,0 +1,17 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn home + left=PH_IP_ALICE + leftcert=aliceCert.pem + leftid=alice@strongswan.org + right=PH_IP_SUN + rightcert=sunCert.pem + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem new file mode 100644 index 000000000..e7825e3db --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIECzCCAvOgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMTU1M1oXDTA5MDkwOTExMTU1M1owRTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN1bi5z +dHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOQ8 +foB9h5BZ92gA5JkQTJNuoF6FAzoq91Gh7To27/g74p01+SUnsSaBfPmNfGp4avdS +Ewy2dWMA/7uj0Dbe8MEKssNztp0JQubp2s7n8mrrQLGsqB6YAS09l75XDjS3yqTC +AtH1kD4zAl/j/AyeQBuLR4CyJEmC/rqD3/a+pr42CaljuFBgBRpCTUpU4mlslZSe +zv9wu61PwTFxb8VDlBHUd/lwkXThKgU3uEhWRxLahpSldEGmiTTmx30k/XbOMF2n +HObEHt5EY9uWRGGbj81ZRWiNk0dNtbpneUHv/NvdWLc591M8cEGEQdWW2XTVbL2G +N67q8hdzGgIvb7QJPMcCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQD +AgOoMB0GA1UdDgQWBBQ9xLkyCBbyQmRet0vvV1Fg6z5q2DBtBgNVHSMEZjBkgBRd +p91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoT +EExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIB +ADAdBgNVHREEFjAUghJzdW4uc3Ryb25nc3dhbi5vcmcwOQYDVR0fBDIwMDAuoCyg +KoYoaHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2FuLmNybDANBgkq +hkiG9w0BAQQFAAOCAQEAGQQroiAa0SwwhJprGd7OM+rfBJAGbsa3DPzFCfHX1R7i +ZyDs9aph1DK+IgUa377Ev1U7oB0EldpmOoJJugCjtNLfpW3t1RXBERL/QfpO2+VP +Wt3SfZ0Oq48jiqB1MVLMZRPCICZEQjT4sJ3HYs5ZuucuvoxeMx3rQ4HxUtHtMD3S +5JNMwFFiOXAjyIyrTlb7YuRJTT5hE+Rms8GUQ5Xnt7zKZ7yfoSLFzy0/cLFPdQvE +JA7w8crODCZpDgEKVHVyUWuyt1O46N3ydUfDcnKJoQ9HWHm3xCbDex5MHTnvm1lk +Stx71CGM7TE6VPy028UlrSw0JqEwCVwstei2cMzwgA== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf new file mode 100644 index 000000000..b85bd607b --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf @@ -0,0 +1,31 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutodebug=control + crlcheckinterval=180 + nat_traversal=yes + +conn %default + ikelifetime=60m + keylife=20m + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + +conn rw-alice + right=%any + rightcert=aliceCert.pem + rightid=alice@strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add + +conn nat-t + leftsubnet=10.2.0.0/16 + right=%any + rightsubnetwithin=10.1.0.0/16 + keyexchange=ikev1 + auto=add diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem new file mode 100644 index 000000000..e99ae8ec7 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer +GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4 +FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W +6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH +v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc +KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG +A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa +60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG +A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0 +cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo +2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ +AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5 +D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S +CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi +6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re +JGhV +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem new file mode 100644 index 000000000..25a6941b0 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIEDzCCAvegAwIBAgIBBDANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMTgyNloXDTA5MDkwOTExMTgyNlowRzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHTAbBgNVBAMTFHZlbnVz +LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +mlQ2s9J7bw73onkw0ZwwcM2JDJuU3KmmuzETlmLdtg7m8yFCdhoDg6cxrsIvPAWy +Gs++1e+1qzy7LTnNHckaHHFwJQf0JoIGE1bbUrJidX8B1T3sDdvZFbyfmQTWSEyJ +thrdqdPS92VJW/9XQOPeEhudIHr+NtWQfCm3OQFKDXGCEkHOjpVNHn3BPUiL99ON +FiLZX3gZy6vTERpEE8ga66fHtpM3RJfIxYoUQUdRw8iIa8iOvRGtJa/MfOWX6L/H +wquRv3SuCl4iMSph7e/VE+z5xx3OyKSAki914DgRFnQITKjyGxw1lORlDQlZy2w/ +nu0BAbXS1pb/2AiF8jDpbQIDAQABo4IBBjCCAQIwCQYDVR0TBAIwADALBgNVHQ8E +BAMCA6gwHQYDVR0OBBYEFEqPlXBYJh1knX0Q61HMcn9LOZ6sMG0GA1UdIwRmMGSA +FF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcGA1UE +ChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290IENB +ggEAMB8GA1UdEQQYMBaCFHZlbnVzLnN0cm9uZ3N3YW4ub3JnMDkGA1UdHwQyMDAw +LqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dhbi5jcmww +DQYJKoZIhvcNAQEEBQADggEBAEx3kXh2Z5CMH+tX6cJPyi6gSeOgXy7NBiNsEdXN +rwGp4DwN6uiSog4EYZJA203oqE3eaoYdBXKiOGvjW4vyigvpDr8H+MeW2HsNuMKX +PFpY4NucV0fJlzFhtkp31zTLHNESCgTqNIwGj+CbN0rxhHGE6502krnu+C12nJ7B +fdMzml1RmVp4JlZC5yfiTy0F2s/aH+8xQ2x509UoD+boNM9GR+IlWS2dDypISGid +hbM4rpiMLBj2riWD8HiuljkKQ6LemBXeZQXuIPlusl7cH/synNkHk8iiALM8xfGh +wTEmdo5Tp5sDI3cj3LVvhcsTxjiOA81her1F0itlxpEA/gA= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-rw-mixed/posttest.dat b/testing/tests/ikev2/nat-rw-mixed/posttest.dat new file mode 100644 index 000000000..0a8ce2bbc --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/posttest.dat @@ -0,0 +1,6 @@ +sun::ipsec stop +alice::ipsec stop +venus::ipsec stop +sun::rm /etc/ipsec.d/certs/* +alice::rm /etc/ipsec.d/certs/* +moon::iptables -t nat -F diff --git a/testing/tests/ikev2/nat-rw-mixed/pretest.dat b/testing/tests/ikev2/nat-rw-mixed/pretest.dat new file mode 100644 index 000000000..d2c5c7df2 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/pretest.dat @@ -0,0 +1,11 @@ +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +sun::ipsec start +alice::ipsec start +venus::ipsec start +alice::sleep 1 +venus::ipsec up nat-t +alice::ipsec up home +alice::sleep 1 diff --git a/testing/tests/ikev2/nat-rw-mixed/test.conf b/testing/tests/ikev2/nat-rw-mixed/test.conf new file mode 100644 index 000000000..84317fd70 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-two-rw-psk/description.txt b/testing/tests/ikev2/nat-two-rw-psk/description.txt new file mode 100644 index 000000000..c74897d9a --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up +tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +Both roadwarriors share the same Pre-Shared Key (PSK) with the gateway <b>sun</b>. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b> +ping the client <b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat b/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat new file mode 100644 index 000000000..2cab168f0 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat @@ -0,0 +1,9 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +venus::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec status::nat-t.*\[PH_IP_ALICE\]::YES +sun::ipsec status::nat-t.*\[PH_IP_VENUS\]::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..e0ccbb812 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf @@ -0,0 +1,19 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn nat-t + left=%defaultroute + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets new file mode 100644 index 000000000..d61e3eb48 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +PH_IP_ALICE : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..c76e7ce92 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn nat-t + left=PH_IP_SUN + leftsubnet=10.2.0.0/16 + leftfirewall=yes + leftnexthop=%direct + right=%any + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets new file mode 100644 index 000000000..5f2955503 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +PH_IP_ALICE : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL + +PH_IP_VENUS : PSK 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf new file mode 100755 index 000000000..e0ccbb812 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf @@ -0,0 +1,19 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn nat-t + left=%defaultroute + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets new file mode 100644 index 000000000..9cd66b1df --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +PH_IP_VENUS : PSK 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br diff --git a/testing/tests/ikev2/nat-two-rw-psk/posttest.dat b/testing/tests/ikev2/nat-two-rw-psk/posttest.dat new file mode 100644 index 000000000..52572ece8 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/posttest.dat @@ -0,0 +1,8 @@ +sun::ipsec stop +alice::ipsec stop +venus::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/ikev2/nat-two-rw-psk/pretest.dat b/testing/tests/ikev2/nat-two-rw-psk/pretest.dat new file mode 100644 index 000000000..5e23259bb --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/pretest.dat @@ -0,0 +1,17 @@ +alice::/etc/init.d/iptables start 2> /dev/null +venus::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +alice::rm /etc/ipsec.d/cacerts/* +venus::rm /etc/ipsec.d/cacerts/* +sun::rm /etc/ipsec.d/cacerts/* +alice::ipsec start +venus::ipsec start +sun::ipsec start +alice::sleep 2 +alice::ipsec up nat-t +venus::sleep 2 +venus::ipsec up nat-t +venus::sleep 2 diff --git a/testing/tests/ikev2/nat-two-rw-psk/test.conf b/testing/tests/ikev2/nat-two-rw-psk/test.conf new file mode 100644 index 000000000..84317fd70 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-two-rw/description.txt b/testing/tests/ikev2/nat-two-rw/description.txt new file mode 100644 index 000000000..dcf4b94bd --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/description.txt @@ -0,0 +1,5 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up +tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b> +ping the client <b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-two-rw/evaltest.dat b/testing/tests/ikev2/nat-two-rw/evaltest.dat new file mode 100644 index 000000000..28d5b5289 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/evaltest.dat @@ -0,0 +1,9 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +venus::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec status::alice@strongswan.org::YES +sun::ipsec status::@venus.strongswan.org::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..3da2fcf86 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..d8b426318 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf @@ -0,0 +1,35 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + +conn net-net + leftsubnet=10.2.0.0/16 + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + +conn host-host + right=PH_IP_MOON + rightid=@moon.strongswan.org + auto=add + +conn nat-t + leftsubnet=10.2.0.0/16 + right=%any + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf new file mode 100755 index 000000000..3a70b3434 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=venusCert.pem + leftid=@venus.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw/posttest.dat b/testing/tests/ikev2/nat-two-rw/posttest.dat new file mode 100644 index 000000000..52572ece8 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/posttest.dat @@ -0,0 +1,8 @@ +sun::ipsec stop +alice::ipsec stop +venus::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/ikev2/nat-two-rw/pretest.dat b/testing/tests/ikev2/nat-two-rw/pretest.dat new file mode 100644 index 000000000..e365ff5c5 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/pretest.dat @@ -0,0 +1,14 @@ +alice::/etc/init.d/iptables start 2> /dev/null +venus::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +alice::ipsec start +venus::ipsec start +sun::ipsec start +alice::sleep 2 +alice::ipsec up nat-t +venus::sleep 2 +venus::ipsec up nat-t +venus::sleep 2 diff --git a/testing/tests/ikev2/nat-two-rw/test.conf b/testing/tests/ikev2/nat-two-rw/test.conf new file mode 100644 index 000000000..84317fd70 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/net2net-cert/description.txt b/testing/tests/ikev2/net2net-cert/description.txt new file mode 100644 index 000000000..7eea9192f --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/description.txt @@ -0,0 +1,6 @@ +A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up. +The authentication is based on <b>X.509 certificates</b>. Upon the successful +establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically +inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b> +pings client <b>bob</b> located behind gateway <b>sun</b>. diff --git a/testing/tests/ikev2/net2net-cert/evaltest.dat b/testing/tests/ikev2/net2net-cert/evaltest.dat new file mode 100644 index 000000000..e67c39a08 --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::net-net.*ESTABLISHED::YES +sun::ipsec statusall::net-net.*ESTABLISHED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..e86ed4f72 --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..ea55d2edb --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/net2net-cert/posttest.dat b/testing/tests/ikev2/net2net-cert/posttest.dat new file mode 100644 index 000000000..a4c96e10f --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/posttest.dat @@ -0,0 +1,5 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null + diff --git a/testing/tests/ikev2/net2net-cert/pretest.dat b/testing/tests/ikev2/net2net-cert/pretest.dat new file mode 100644 index 000000000..2d7a78acb --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up net-net diff --git a/testing/tests/ikev2/net2net-cert/test.conf b/testing/tests/ikev2/net2net-cert/test.conf new file mode 100644 index 000000000..d9a61590f --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-psk/description.txt b/testing/tests/ikev2/net2net-psk/description.txt new file mode 100644 index 000000000..02cddbb83 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/description.txt @@ -0,0 +1,6 @@ +A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up. +The authentication is based on <b>Preshared Keys</b> (PSK). Upon the successful +establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically +inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b> +pings client <b>bob</b> located behind gateway <b>sun</b>. diff --git a/testing/tests/ikev2/net2net-psk/evaltest.dat b/testing/tests/ikev2/net2net-psk/evaltest.dat new file mode 100644 index 000000000..e67c39a08 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::net-net.*ESTABLISHED::YES +sun::ipsec statusall::net-net.*ESTABLISHED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..da51fa46a --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + keyexchange=ikev2 + +conn net-net + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftid=@moon.strongswan.org + leftnexthop=%direct + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=add diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..cbdddfb18 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,12 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL + +@moon.strongswan.org %any : PSK 0x45a30759df97dc26a15b88ff + +@sun.strongswan.org : PSK "This is a strong password" + +: PSK 'My "home" is my "castle"!' + +192.168.0.1 : PSK "Andi's home" + diff --git a/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..bea0eeb08 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + keyexchange=ikev2 + +conn net-net + left=PH_IP_SUN + leftsubnet=10.2.0.0/16 + leftid=@sun.strongswan.org + leftfirewall=yes + leftnexthop=%direct + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets new file mode 100644 index 000000000..be95c4d99 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets @@ -0,0 +1,7 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL + + + + diff --git a/testing/tests/ikev2/net2net-psk/posttest.dat b/testing/tests/ikev2/net2net-psk/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/net2net-psk/pretest.dat b/testing/tests/ikev2/net2net-psk/pretest.dat new file mode 100644 index 000000000..976a196db --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/pretest.dat @@ -0,0 +1,8 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::rm /etc/ipsec.d/cacerts/* +sun::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up net-net diff --git a/testing/tests/ikev2/net2net-psk/test.conf b/testing/tests/ikev2/net2net-psk/test.conf new file mode 100644 index 000000000..f74d0f7d6 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-route/description.txt b/testing/tests/ikev2/net2net-route/description.txt new file mode 100644 index 000000000..323f09555 --- /dev/null +++ b/testing/tests/ikev2/net2net-route/description.txt @@ -0,0 +1,9 @@ +A tunnel that will connect the subnets behind the gateways <b>moon</b> +and <b>sun</b>, respectively, is preconfigured by installing a %trap eroute +on gateway <b>moon</b> by means of the setting <b>auto=route</b> in ipsec.conf. +A subsequent ping issued by client <b>alice</b> behind gateway <b>moon</b> to +<b>bob</b> located behind gateway <b>sun</b> triggers the %trap eroute and +leads to the automatic establishment of the subnet-to-subnet tunnel. +<p> +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules +that let pass the tunneled traffic. diff --git a/testing/tests/ikev2/net2net-route/evaltest.dat b/testing/tests/ikev2/net2net-route/evaltest.dat new file mode 100644 index 000000000..d5350467e --- /dev/null +++ b/testing/tests/ikev2/net2net-route/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::creating acquire job for CHILD_SA::YES +moon::ipsec statusall::net-net.*INSTALLED::YES +sun::ipsec statusall::net-net.*INSTALLED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..8b8548815 --- /dev/null +++ b/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + leftnexthop=%direct + keyexchange=ikev2 + +conn net-net + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=route diff --git a/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..ea55d2edb --- /dev/null +++ b/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/net2net-route/posttest.dat b/testing/tests/ikev2/net2net-route/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/net2net-route/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/net2net-route/pretest.dat b/testing/tests/ikev2/net2net-route/pretest.dat new file mode 100644 index 000000000..2eef7de19 --- /dev/null +++ b/testing/tests/ikev2/net2net-route/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 2 +alice::ping -c 10 PH_IP_BOB diff --git a/testing/tests/ikev2/net2net-route/test.conf b/testing/tests/ikev2/net2net-route/test.conf new file mode 100644 index 000000000..d9a61590f --- /dev/null +++ b/testing/tests/ikev2/net2net-route/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-start/description.txt b/testing/tests/ikev2/net2net-start/description.txt new file mode 100644 index 000000000..f5320685e --- /dev/null +++ b/testing/tests/ikev2/net2net-start/description.txt @@ -0,0 +1,8 @@ +A tunnel connecting the subnets behind the gateways <b>moon</b> and <b>sun</b>, +respectively, is automatically established by means of the setting +<b>auto=start</b> in ipsec.conf. The connection is tested by client <b>alice</b> +behind gateway <b>moon</b> pinging the client <b>bob</b> located behind +gateway <b>sun</b>. +<p> +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules +that let pass the tunneled traffic. diff --git a/testing/tests/ikev2/net2net-start/evaltest.dat b/testing/tests/ikev2/net2net-start/evaltest.dat new file mode 100644 index 000000000..244dec5bf --- /dev/null +++ b/testing/tests/ikev2/net2net-start/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::net-net.*INSTALLED::YES +sun::ipsec statusall::net-net.*INSTALLED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..091871e49 --- /dev/null +++ b/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=start diff --git a/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..b2e41894c --- /dev/null +++ b/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + leftnexthop=%direct + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/net2net-start/posttest.dat b/testing/tests/ikev2/net2net-start/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/net2net-start/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/net2net-start/pretest.dat b/testing/tests/ikev2/net2net-start/pretest.dat new file mode 100644 index 000000000..6e41d5245 --- /dev/null +++ b/testing/tests/ikev2/net2net-start/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +sun::ipsec start +sun::sleep 2 +moon::ipsec start +alice::sleep 3 diff --git a/testing/tests/ikev2/net2net-start/test.conf b/testing/tests/ikev2/net2net-start/test.conf new file mode 100644 index 000000000..d9a61590f --- /dev/null +++ b/testing/tests/ikev2/net2net-start/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/ocsp-local-cert/description.txt b/testing/tests/ikev2/ocsp-local-cert/description.txt new file mode 100644 index 000000000..61f7d9957 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/description.txt @@ -0,0 +1,9 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which possesses a <b>self-signed</b> +OCSP signer certificate that must be imported locally by the peers into +<b>/etc/ipsec.d/ocspcerts/</b>. A strongswan <b>ca</b> section in ipsec.conf +defines an <b>OCSP URI</b> pointing to <b>winnetou</b>. +<p> +<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since +the status of both certificates is <b>good</b>. diff --git a/testing/tests/ikev2/ocsp-local-cert/evaltest.dat b/testing/tests/ikev2/ocsp-local-cert/evaltest.dat new file mode 100644 index 000000000..6b849b811 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/evaltest.dat @@ -0,0 +1,8 @@ +moon::cat /var/log/daemon.log::received valid http response::YES +carol::cat /var/log/daemon.log::received valid http response::YES +moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..0209111ba --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem new file mode 100644 index 000000000..77f5bde52 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEbjCCA1agAwIBAgIJALN2wqyLTIzfMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQ +IFNlbGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2Fu +Lm9yZzAeFw0wNzAzMTQxMjM0MDNaFw0xMjAzMTIxMjM0MDNaMGsxCzAJBgNVBAYT +AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQIFNl +bGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2FuLm9y +ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMgSOFeDdWxYKGPUSUhM +BFAELGmHKfg2R25aWlE8ju//I0ByaoIsm8BPapSiiiwTdho/JPP44/nvHcDQu828 +P3uY5XbSPZpiiBgFoo8BC2/Y/rxY/skjEzqoHEXjg/vO1bA0tqjVn5a0jpkai7pD +mUyBrmn1ArOjhR/HAupCHsIb7sAL+IEXByMcZQK6bvNL9PMTYI1T72+t/9cZAAEJ +DfEhyJZMxQKgmT1SNzLwyszy1M1HF95D59gBok4PaRWWsLdwzplfTKh61CeGCYqb +UP3qpMKrJ8Y7uv+e1vVzuYbJg5DR+bF1IGIc9QRyJlTkhZco+zTCQYxpvsNO18yr +4qcCAwEAAaOCARMwggEPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgECMB0GA1UdDgQW +BBQHqEiJbwUSQJDtrfhopkda0nXrLTCBnQYDVR0jBIGVMIGSgBQHqEiJbwUSQJDt +rfhopkda0nXrLaFvpG0wazELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0 +cm9uZ1N3YW4xIzAhBgNVBAsTGk9DU1AgU2VsZi1TaWduZWQgQXV0aG9yaXR5MRww +GgYDVQQDExNvY3NwLnN0cm9uZ3N3YW4ub3JnggkAs3bCrItMjN8wHgYDVR0RBBcw +FYITb2NzcC5zdHJvbmdzd2FuLm9yZzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN +BgkqhkiG9w0BAQUFAAOCAQEAi//I0DOlUXNHxzLuuxyr6k5gO55zMCmHUcVfjVFZ +9e+UpLLFZY+qbxOfzVLpKyDch6dKDIA/H+SzX1GZ+uW4FFQ1wYlHcK1Sio9hOgqI +zeWdY5uHF6iERVYgOU/xp0+0LS5l4ezCvOKVkYJEFWe2eyn9rd4PGLW4/lTQiK1V +14YzPyAhB7n8Sln5LBxAeY7U7Y8jEMLXZ+VF21mjH2sxZzWV/qWZdNWVUNaLZTYL +lTqyzqsk40v5BTrjSvAWHN+c1WzydMvatFDzghlPnvR8dufRN2bnlj10J8sizn+v +1iDtM6uYi8+Yn26yMGjCP+RYW+bwKQ927Gr43UkqqGsbCg== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..21b48ef0c --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem new file mode 100644 index 000000000..77f5bde52 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEbjCCA1agAwIBAgIJALN2wqyLTIzfMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQ +IFNlbGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2Fu +Lm9yZzAeFw0wNzAzMTQxMjM0MDNaFw0xMjAzMTIxMjM0MDNaMGsxCzAJBgNVBAYT +AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQIFNl +bGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2FuLm9y +ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMgSOFeDdWxYKGPUSUhM +BFAELGmHKfg2R25aWlE8ju//I0ByaoIsm8BPapSiiiwTdho/JPP44/nvHcDQu828 +P3uY5XbSPZpiiBgFoo8BC2/Y/rxY/skjEzqoHEXjg/vO1bA0tqjVn5a0jpkai7pD +mUyBrmn1ArOjhR/HAupCHsIb7sAL+IEXByMcZQK6bvNL9PMTYI1T72+t/9cZAAEJ +DfEhyJZMxQKgmT1SNzLwyszy1M1HF95D59gBok4PaRWWsLdwzplfTKh61CeGCYqb +UP3qpMKrJ8Y7uv+e1vVzuYbJg5DR+bF1IGIc9QRyJlTkhZco+zTCQYxpvsNO18yr +4qcCAwEAAaOCARMwggEPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgECMB0GA1UdDgQW +BBQHqEiJbwUSQJDtrfhopkda0nXrLTCBnQYDVR0jBIGVMIGSgBQHqEiJbwUSQJDt +rfhopkda0nXrLaFvpG0wazELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0 +cm9uZ1N3YW4xIzAhBgNVBAsTGk9DU1AgU2VsZi1TaWduZWQgQXV0aG9yaXR5MRww +GgYDVQQDExNvY3NwLnN0cm9uZ3N3YW4ub3JnggkAs3bCrItMjN8wHgYDVR0RBBcw +FYITb2NzcC5zdHJvbmdzd2FuLm9yZzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN +BgkqhkiG9w0BAQUFAAOCAQEAi//I0DOlUXNHxzLuuxyr6k5gO55zMCmHUcVfjVFZ +9e+UpLLFZY+qbxOfzVLpKyDch6dKDIA/H+SzX1GZ+uW4FFQ1wYlHcK1Sio9hOgqI +zeWdY5uHF6iERVYgOU/xp0+0LS5l4ezCvOKVkYJEFWe2eyn9rd4PGLW4/lTQiK1V +14YzPyAhB7n8Sln5LBxAeY7U7Y8jEMLXZ+VF21mjH2sxZzWV/qWZdNWVUNaLZTYL +lTqyzqsk40v5BTrjSvAWHN+c1WzydMvatFDzghlPnvR8dufRN2bnlj10J8sizn+v +1iDtM6uYi8+Yn26yMGjCP+RYW+bwKQ927Gr43UkqqGsbCg== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..dda793f44 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ + -resp_no_certs -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/tests/ikev2/ocsp-local-cert/posttest.dat b/testing/tests/ikev2/ocsp-local-cert/posttest.dat new file mode 100644 index 000000000..0c05c16a1 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::rm /etc/ipsec.d/ocspcerts/* +carol::rm /etc/ipsec.d/ocspcerts/* diff --git a/testing/tests/ikev2/ocsp-local-cert/pretest.dat b/testing/tests/ikev2/ocsp-local-cert/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-local-cert/test.conf b/testing/tests/ikev2/ocsp-local-cert/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-multi-level/description.txt b/testing/tests/ikev2/ocsp-multi-level/description.txt new file mode 100644 index 000000000..cd0ecf162 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/description.txt @@ -0,0 +1,10 @@ +The VPN gateway <b>moon</b> controls the access to the hosts <b>alice</b> and +<b>venus</b> by means of two different Intermediate CAs. Access to +<b>alice</b> is granted to users presenting a certificate issued by the Research CA +whereas <b>venus</b> can only be reached with a certificate issued by the +Sales CA. The roadwarriors <b>carol</b> and <b>dave</b> have certificates from +the Research CA and Sales CA, respectively. Therefore <b>carol</b> can access +<b>alice</b> and <b>dave</b> can reach <b>venus</b>. +<p> +By setting <b>strictcrlpolicy=yes</b>, the certificate status from the strongSwan, Research and +Sales OCSP servers must be fetched first, before the connection setups can be successfully completed. diff --git a/testing/tests/ikev2/ocsp-multi-level/evaltest.dat b/testing/tests/ikev2/ocsp-multi-level/evaltest.dat new file mode 100644 index 000000000..911c209a5 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec listocspcerts::altNames.*ocsp.*strongswan.org::YES +carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +dave::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +dave::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::ESTABLISHED.*carol::YES +moon::ipsec status::ESTABLISHED.*dave::YES +carol::ipsec status::alice.*ESTABLISHED::YES +dave::ipsec status::venus.*ESTABLISHED::YES diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..89a4f2ce9 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf @@ -0,0 +1,31 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem new file mode 100644 index 000000000..2990d6a12 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIELDCCAxSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjERMA8GA1UECxMIUmVzZWFyY2gxFDAS +BgNVBAMTC1Jlc2VhcmNoIENBMB4XDTA1MDMyMzA3MDQyM1oXDTEwMDMyMjA3MDQy +M1owWjELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAP +BgNVBAsTCFJlc2VhcmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCC +ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM+oTiV7lCh1ID41edDUgUjR +dZwEMPBAM1xDqoxJxIJpug8UIuuUL0TvQnZ4Z5fa/9QNNCkQ7FDh8ZcR+TT8x0mO +dYYA73mMQic0n4O57F+s/lESKvIoN+vIDR3rGJBv9rYztS4ODE+DJl9XK9TtId5u +57jfXu/k3IYl5GeQ3f+ic2l2Ola70t70Op6cFDZIhOCjs2xWw2yqGdPWODaN/Enw +5fOLv/om+7HHB4KgPGv4p4ohWIUCo2XK597Ii+jB2MdOUlG83/1aX7+M+IeYVwjI +hzWjwRQfMz0AQha0HYN4cvrZ7stUluMxewsCROCBzcGQYTZxYU4FjR8nhH4ApYMC +AwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBSL +qNn96rsWg0kOJY/cyXD2JpnPIjBtBgNVHSMEZjBkgBTndfCg8q0gzc1gI8zHyA8p +891UIKFJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3 +YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIBDDAfBgNVHREEGDAWgRRj +YXJvbEBzdHJvbmdzd2FuLm9yZzA3BgNVHR8EMDAuMCygKqAohiZodHRwOi8vY3Js +LnN0cm9uZ3N3YW4ub3JnL3Jlc2VhcmNoLmNybDANBgkqhkiG9w0BAQUFAAOCAQEA +FNPepmta0ac9TWe7Gl31fKkuf6ZiQftMwx/uq6PoX9PBVGeooktJMo+EiROQhL3N +Zomtl2nLfxYruXPHa7YaMWyv4+3NkV9p7jseC1K/2lCXipY4Vp8u14hqlRLCTejp +7uC/0+628e+qXlCm8wafDb9/JXzQar7rADhoLp7gJKI2PKMAzLUP2xZVzY5zx57G ++OCR/ZXonVeAPy9/0g9N8uQzJEXOVZYMjsoRra9rdlvnY1DgDoAK7QvJMC4VzENm +wKmz2rPrBlKaEcivubg7dwPMGNmb3f7F7w0HHuRbQd5Y0nDfEWBKCp0bVx1GLc7/ +MWjwPJs52qVJ3Ph++EF6bw== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem new file mode 100644 index 000000000..b91f9bf81 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAz6hOJXuUKHUgPjV50NSBSNF1nAQw8EAzXEOqjEnEgmm6DxQi +65QvRO9Cdnhnl9r/1A00KRDsUOHxlxH5NPzHSY51hgDveYxCJzSfg7nsX6z+URIq +8ig368gNHesYkG/2tjO1Lg4MT4MmX1cr1O0h3m7nuN9e7+TchiXkZ5Dd/6JzaXY6 +VrvS3vQ6npwUNkiE4KOzbFbDbKoZ09Y4No38SfDl84u/+ib7sccHgqA8a/iniiFY +hQKjZcrn3siL6MHYx05SUbzf/Vpfv4z4h5hXCMiHNaPBFB8zPQBCFrQdg3hy+tnu +y1SW4zF7CwJE4IHNwZBhNnFhTgWNHyeEfgClgwIDAQABAoIBAHXoftbRoIKIXtJz +0sM8plwOctUvnAoOqhsNYN1fVXEnTzoYmOtirKRbpkVWgJu9Ad4J0UAwF76lTGQX +FIV9sjqV5S09grxlY3qXaquE+i4pMA4gXro5E+eRI8GFJ+F7cX5rRcjsuRi8wyEH +gh/YtY5zMqfKTUGxlXWmNlaH70WilianuMPNXwaKgyBGcfZdheyUggM0rYEJrG1Z +PZqNo0JKfeI4htpENDp0k1xJ9lCjIqdNw0ZjBi+pL6hF5PYaPjlVC2yn5CzRaT1D +nUeKUK+SVES4sPrEQtaOlk86uZC4pIz5IlEoSvaw/Yo3Gk1sQKIQMMh1crhHd0El +U831KwECgYEA7fQY+aFk3fHabwgf9gjuPKgwetVQ8jNDWUiSqffHUC0AQfKZQQsF +mXJeSRZomPCWG3DRz1EcqXr9f82bN295I0CI6foXZgKUmjed7Bohc0HvUqNOi2qm +MdbdWBOaH4RBzi1fAENJZnprmq65jQ/tkfCwqIz4KaLt+8xiWmU2h6ECgYEA32gB +UbCzs1LoJC03uGHqZFRWK/YNKOKBUw58XCnzPTA+34UupI88lPj8LD269tDtruRy +G7wt4HjayPKtK430nKAl01IXq6ULBTByu3KrCOm/gTAycVMj4ZimTn7Qu9jyv4Lz +Ka3rBQxB+yQWfn27dc7U+EBsA7PT53NR6Zl8CqMCgYALJYod93+AHho7ZUgKAHUY +hlBvEJsQHXKkNhAYwjCmAtWmQTUIpPmILKFaDyCrOWnusyRA7+3FyqshV4JT4Hbu +PdGsFDkQYEKRztUpADhc69PILTo6sa5DW2tW+uQXYdyrSdjPbFd943Iy9sheYUah +tYKxApmFacp4JyTcUy1wwQKBgA44xLy6jvX/dR+4cS+frBgu9j1eMIBFyw3Kgkgr +s3xVserww4NeSvEA2KzIUTqdGkRj7o+tbw43I1ZffH6lTskZuM63DyKyIv11lBgy +uIicuMA0nUFxlXsrCIs+r3MF4I4oe+pPVALCQQEHzxbGUkSxogUbtMSXkgnN4Y0J +ZEgZAoGAfo0nv/IeKi0KkKiPTQSGVWGAQyCpGE0UQ2RYYToT84kjXs+LrVGFH2lu +LJvyYnSnM7eKqCFKh+kLQ3bezum56y5XTyAEipTmu7Lhp0CiVjSdnu+0QykmhKsx +Z17Ut2ryGKOXySnlMNual4eCLq98o0iOcYPq08V6x33dhK7Z3kU= +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..fac55d63b --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey.pem diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..45b6efcc8 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf @@ -0,0 +1,31 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem new file mode 100644 index 000000000..b76032480 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIEHDCCAwSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBLMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEOMAwGA1UECxMFU2FsZXMxETAPBgNV +BAMTCFNhbGVzIENBMB4XDTA1MDMyMzA3MTAxN1oXDTEwMDMyMjA3MTAxN1owVjEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsT +BVNhbGVzMRwwGgYDVQQDFBNkYXZlQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyqAR0itGIuSt/RR8IHjFTLH/lywprmHUw0GS +zZwo/q4AE4v6OeWRG3JUUg44K40yBwr7zvcsLztRTfbNqlt7o+Hjpo3kz0AMwDo+ +1V42Qkh61VJW1P0NQvkgjiQn+ElSMg1u3uiYCIMAhYMYo2ZMKxHXxRqjU79AVuJN +P3p8wUpfwReImAy3/n685YbSzWcbPqCfjRH/YrnYS8Ga7m/QzdNfrtxhAWAGow1+ ++eTSMvLXSkQeujU6OCJNOPUNB3nnJ1IoZrQm8wNP8Y5B5HzvOSyFEvNuHFc63gSP +aSRhuz0gubuMpr1d9Rgjny8JgsfCEbOktlKwnbFeSB8AAgVMjwIDAQABo4H/MIH8 +MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBSCy57rUdNRbytUkRGY +GjmjvXfIszBtBgNVHSMEZjBkgBRfmxNG+SByyADViLWnTC6X6guTKKFJpEcwRTEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT +EnN0cm9uZ1N3YW4gUm9vdCBDQYIBDTAeBgNVHREEFzAVgRNkYXZlQHN0cm9uZ3N3 +YW4ub3JnMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwuc3Ryb25nc3dhbi5v +cmcvc2FsZXMuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQB+BknSxFKaDhbRVobOAU2P +p9cirkVCitoZrvK2QIS/7WRoqy85RQ+zorJb3jyTxQl4Pu9Qrap9Zn0H8GQXGlQw +ZJqdDqRaIa4nCc57qP5DsuQKIQRxc1QMCiWyIRAESn+r8IbxLbjvEd7ZXNsieip6 +Q15uUZldjTveHVi89i9oFWS1nWo4SV+tJaEqPBvsTZZKBPAEu6+7lRzbJ4ukzRsA +DjuvmaPNUTyf21fD66I4sgrwgxoPhZ7r6qsqISJ5f0EzTXgYNi1yk/TXoAaot3c/ +Gu5+iyO/espV6kPADSOzPSFwsGHYG4kXi1VY0Z7x6UnjQSdEelOBplJ5XYDzEn4+ +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem new file mode 100644 index 000000000..022436de4 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAyqAR0itGIuSt/RR8IHjFTLH/lywprmHUw0GSzZwo/q4AE4v6 +OeWRG3JUUg44K40yBwr7zvcsLztRTfbNqlt7o+Hjpo3kz0AMwDo+1V42Qkh61VJW +1P0NQvkgjiQn+ElSMg1u3uiYCIMAhYMYo2ZMKxHXxRqjU79AVuJNP3p8wUpfwReI +mAy3/n685YbSzWcbPqCfjRH/YrnYS8Ga7m/QzdNfrtxhAWAGow1++eTSMvLXSkQe +ujU6OCJNOPUNB3nnJ1IoZrQm8wNP8Y5B5HzvOSyFEvNuHFc63gSPaSRhuz0gubuM +pr1d9Rgjny8JgsfCEbOktlKwnbFeSB8AAgVMjwIDAQABAoIBAHKaRFoVpa6Ynpu0 +mVwYUqdFSaVsEgsSRC9HiEuIllsteNeVZSqX4BGhAXYDmttvGauIF9IAVNpF939c +JwjCg1S2r3aFbLOXq16R0vYFOjUVH3xF/NysX3LQywv6AS1Z8wZiOKIU9eBij8nz +0tygQFZf2iUeIuB8HFzH1B8iHSuI7qn6hh1Y9Zgx4kWYL9I+WYefbR906xveHVGq +8VrgHtBAn1WeWg7FoN1VURW0s1bxkiWtpF9x9OMmwK4qR8HSCilss59V1eJrAAR0 +3FGdWwbbGg9hW0adnyDCtoaYW3r0WcXwqklyas4C+dClOpUInn8kZisoghQYT92u +U2QeDzECgYEA5Rv7+rP9HX1pNd9NQwOyIHztv4jfx60gybioogtCeRZUwPQ3GtXJ +Q0ouBxCVLdyCImIKcvd2q2b9HZE8tvOHBA/YxofH4miEN5GWA4aL+LcGrxIbxPWs +MEkxgQwsyK7lWH47fG7eW86LMx0VikFXS1EeeZZS3f3Avaww1uRtXecCgYEA4mhS +sAClZamGVWQ7VXCHuS4xHn/gPA4TCyoR5l9g9pwregGKxsROQVIFQCDMd9eTtS6B +oqoUTHdg0TlujHVUojdwHtgDaqDMTk+RXD9qy2Wob9HQVBlIwgijoLb+OjwdoAj7 +1OQx8FmMjAlMmlyJ50e1FnbNJFEJ1EMgV5QxtxkCgYEArdUeyehYy1BFTJ/CIm+i +bm37gdDbYchlUUivgkuiwvcDlWd2jADbdRfKdofJeIOPpYDXxsUmIATDVfTFqVZ7 +AcT4SCHrskh00SjANqqWdz5/bsQBl96DKBvQ2MYhEJ9K2mrkvZPtWKENEtolZsIO +9tF0mvJIq7CF1iPY5qNoq88CgYEAoZhELErJwl3U+22my7ydopZNiK9MpJCHFxjX +3c2Fr36XqWUgX+4MzKJ2DOdcCM1dJ5wh+q/Z/RnXiH2tYaL83SskY19aUOij6eDw +px68YqAUMHtYbi39uD/iSftSSM5PdsHyvGiDHEFOB0U735Dc/K45mecBVEJi+ZVP +qDKlqUECgYA1DcGOWM3P3XdB7zKy47LcankMtFZozEOLTUdGJRlmWrLdcRlZPKjt +/ALripehesp1++VtmttWQJX7uI3gveD07/tSKeMHmIoKappjRTrcaA7Pa5+z/xS/ +UhRmZUFOJwNLzy3jdv5f2c/5SIz6o4Ae3I+Zb+IapHL+lBv146/I5g== +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..98a0e9b81 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf @@ -0,0 +1,44 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +ca research + cacert=researchCert.pem + ocspuri=http://ocsp.strongswan.org:8881 + auto=add + +ca sales + cacert=salesCert.pem + ocspuri=http://ocsp.strongswan.org:8882 + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn alice + leftsubnet=PH_IP_ALICE/32 + right=%any + rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA" + auto=add + +conn venus + leftsubnet=PH_IP_VENUS/32 + right=%any + rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA" + auto=add diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem new file mode 100644 index 000000000..154cff654 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIIDwTCCAqmgAwIBAgIBDzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA1MDYyMTE5NTgwNloXDTEwMDYyMDE5NTgwNlowUTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMRQwEgYDVQQDEwtSZXNlYXJjaCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBALY5sjqm4AdbWKc/T7JahWpy9xtdPbHngBN6lbnpYaHfrxnGsvmD +FCFZHCd7egRqQ/AuJHHcEv3DUdfJWWAypVnUvdlcp58hBjpxfTPXP9IDBxzQaQyU +zsExIGWOVUY2e7xJ5BKBnXVkok3htY4Hr1GdqNh+3LEmbegJBngTRSRx4PKJ54FO +/b78LUzB+rMxrzxw/lnI8jEmAtKlugQ7c9auMeFCz+NmlSfnSoWhHN5qm+0iNKy0 +C+25IuE8Nq+i3jtBiI8BwBqHY3u2IuflUh9Nc9d/R6vGsRPMHs30X1Ha/m0Ug494 ++wwqwfEBZRjzxMmMF/1SG4I1E3TDOJ3srjkCAwEAAaOBrzCBrDAPBgNVHRMBAf8E +BTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQU53XwoPKtIM3NYCPMx8gPKfPd +VCAwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJv +bmdTd2FuIFJvb3QgQ0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAHArS2trQnBoMVcg +Br3HV78wYsa1MNAQCBAPhKMMd6EziO4FTwgNgecbKXpObX6ErFDgjtVTcLOMTvNX +fvZoNuPpdcitlgcWjfxZafNbj6j9ClE/rMbGDO64NLhdXuPVkbmic6yXRwGZpTuq +3CKgTguLvhzIEM47yfonXKaaJcKVPI7nYRZdlJmD4VflYrSUpzB361dCaPpl0AYa +0zz1+jfBBvlyic/tf+cCngV3f+GlJ4ntZ3gvRjyysHRmYpWBD7xcA8mJzgUiMyi1 +IKeNzydp+tnLfxwetfA/8ptc346me7RktAaASqO9vpS/N78eXyJRthZTKEf/OqVW +Tfcyi+M= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem new file mode 100644 index 000000000..e50477872 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDuzCCAqOgAwIBAgIBDTANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA1MDMyMzA2MjkxNloXDTE0MDMyMTA2MjkxNlowSzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MREwDwYDVQQDEwhTYWxlcyBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +ggEBAMJOTSaZjDe5UR+hJbodcE40WBxWm+r0FiD+FLc2c0hH/QcWm1Xfqnc9qaPP +GoxO2BfwXgFEHfOdQzHGuthhsvdMPkmWP1Z3uDrwscqrmLyq4JI87exSen1ggmCV +Eib55T4fNxrTIGJaoe6Jn9v9ZwG2B+Ur3nFA/wdckSdqJxc6XL9DKcRk3TxZtv9S +uDftE9G787O6PJSyfyUYhldz1EZe5PTsUoAbBJ0DDXJx3562kDtfQdwezat0LAyO +sVabYq/0G/fBZwLLer4qGF2+3CsvP7jNXnhRYeSv2+4i2mAjgbBRI1A3iqoU3Nq1 +vPAqzrekOI/RV9Hre9L1r8X1dIECAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/ +MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUX5sTRvkgcsgA1Yi1p0wul+oLkygwbQYD +VR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNI +MRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2Fu +IFJvb3QgQ0GCAQAwDQYJKoZIhvcNAQEFBQADggEBAJ7j3X20Q8ICJ2e+iUCpVUIV +8RudUeHt9qjSXalohuxxhegL5vu7I9Gx0H56RE4glOjLMCb1xqVZ55Odxx14pHaZ +9iMnQFpgzi96exYAmBKYCHl4IFix2hrTqTWSJhEO+o+PXnQTgcfG43GQepk0qAQr +iZZy8OWiUhHSJQLJtTMm4rnYjgPn+sLwx7hCPDZpHTZocETDars7wTiVkodCbeEU +uKahAbq4b6MvvC3+7quvwoEpAEStT7+Yml+QuK/jKmhjX0hcQcw4ZWi+m32RjUAv +xDJGEvBqV2hyrzRqwh4lVNJEBba5X+QB3N6a0So6BENaJrUM3v8EDaS2KLUWyu0= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-multi-level/posttest.dat b/testing/tests/ikev2/ocsp-multi-level/posttest.dat new file mode 100644 index 000000000..1646d5ed2 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/posttest.dat @@ -0,0 +1,5 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::rm /etc/ipsec.d/cacerts/* + diff --git a/testing/tests/ikev2/ocsp-multi-level/pretest.dat b/testing/tests/ikev2/ocsp-multi-level/pretest.dat new file mode 100644 index 000000000..f15265e32 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/pretest.dat @@ -0,0 +1,7 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up alice +dave::ipsec up venus diff --git a/testing/tests/ikev2/ocsp-multi-level/test.conf b/testing/tests/ikev2/ocsp-multi-level/test.conf new file mode 100644 index 000000000..08e5cc145 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ocsp-revoked/description.txt b/testing/tests/ikev2/ocsp-revoked/description.txt new file mode 100644 index 000000000..73d072549 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/description.txt @@ -0,0 +1,9 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which possesses an OCSP signer certificate +issued by the strongSwan CA. This certificate contains an <b>OCSPSigning</b> +extended key usage flag. A strongswan <b>ca</b> section in ipsec.conf defines an +<b>OCSP URI</b> pointing to <b>winnetou</b>. +<p> +<b>carol</b> tries to initiate an IPsec connection to <b>moon</b> but fails +because <b>carol</b>'s certificate has been <b>revoked</b>. diff --git a/testing/tests/ikev2/ocsp-revoked/evaltest.dat b/testing/tests/ikev2/ocsp-revoked/evaltest.dat new file mode 100644 index 000000000..eacb70c40 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/evaltest.dat @@ -0,0 +1,7 @@ +moon::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES +moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO + diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..be15f6ec5 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert-revoked.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem new file mode 100644 index 000000000..5b742fc9e --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEIjCCAwqgAwIBAgIBBzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjU0OFoXDTA5MDkwOTExMjU0OFowWjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAM5413q1B2EF3spcYD1u0ce9AtIHdxmU3+1E0hqV +mLqpIQtyp4SLbrRunxpoVUuEpHWXgLb3C/ljjlKCMWWmhw4wja1rBTjMNJLPj6Bo +5Qn4Oeuqm7/kLHPGbveQGtcSsJCk6iLqFTbq0wsji5Ogq7kmjWgQv0nM2jpofHLv +VOAtWVSj+x2b3OHdl/WpgTgTw1HHjYo7/NOkARdTcZ2/wxxM3z1Abp9iylc45GLN +IL/OzHkT8b5pdokdMvVijz8IslkkewJYXrVQaCNMZg/ydlXOOAEKz0YqnvXQaYs5 +K+s8XvQ2RFCr5oO0fRT2VbiI9TgHnbcnfUi25iHl6txsXg0CAwEAAaOCAQYwggEC +MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBTbA2TH3ca8tgCGkYy9 +OV/MqUTHAzBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT +EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz +d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u +b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQC9acuCUPEBOrWB +56vS8N9bksQwv/XcYIFYqV73kFBAzOPLX2a9igFGvBPdCxFu/t8JCswzE6to4LFM +2+6Z2QJf442CLPcJKxITahrjJXSxGbzMlmaDvZ5wFCJAlyin+yuInpTwl8rMZe/Q +O5JeJjzGDgWJtnGdkLUk/l2r6sZ/Cmk5rZpuO0hcUHVztMLQYPzqTpuMvC5p4JzL +LWGWhKRhJs53NmxXXodck/ZgaqiTWuQFYlbamJRvzVBfX7c1SWHRJvxSSOPKGIg3 +wphkO2naj/SQD+BNuWTRmZ9YCiLOQ64ybLpJzRZISETdqtLBPKsIqosUZwkxlR1N +9IcgYi5x +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem new file mode 100644 index 000000000..8aefcc5a6 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAznjXerUHYQXeylxgPW7Rx70C0gd3GZTf7UTSGpWYuqkhC3Kn +hItutG6fGmhVS4SkdZeAtvcL+WOOUoIxZaaHDjCNrWsFOMw0ks+PoGjlCfg566qb +v+Qsc8Zu95Aa1xKwkKTqIuoVNurTCyOLk6CruSaNaBC/SczaOmh8cu9U4C1ZVKP7 +HZvc4d2X9amBOBPDUceNijv806QBF1Nxnb/DHEzfPUBun2LKVzjkYs0gv87MeRPx +vml2iR0y9WKPPwiyWSR7AlhetVBoI0xmD/J2Vc44AQrPRiqe9dBpizkr6zxe9DZE +UKvmg7R9FPZVuIj1OAedtyd9SLbmIeXq3GxeDQIDAQABAoIBAAUdyXko8z3cP2EU +WO4syNYCQQejV7gykDn48pvmCRrXBhKajLwkGGIwO5ET9MkiSFEBqBbgmFNdvDEf +OMokDkSzv08Ez+RQax0YN57p+oL8u7KzT5i5tsBHsog/8epSdD2hWIv08QGjYAdu +og7OdHLqGabyg0r44I+B91OBysCjU51rDdkhz59AmURdEIJV5xhuGojFM68jaNm2 +MUxDfDuCsRIydjAP0VTUTAUxD4/S5I+jt/GK9aRsEeRH9Q3011iTGMR9viAUBhq/ +khkWNltg9lkOqO7LpnNku4sSv3v4CWge7/T+4RR2vZgv1oSs4ox2UKYoqIqiYIfx +uUcnqQECgYEA+LPiRMoXvlssQWlaFc2k4xga0efs+mWeLglDdc3R3fBEibP/AU07 +a576AgvUJtkI50/WNGKT73O+VtxcXn/N646m/8OtqNXuVKKjsxxNOZEKdO8aOdbt +7lM5WepNiQeaKAFudUxpUiZQx8LCKSsNDiJZKWBu6xAG2O5X32VMZvUCgYEA1Ie+ +rNa490PSC1ym7WbmdAjvGmSOn2GOBfO7BECsPZstccU7D5pZl/89fTfn1TDKP49Y +ScVOuFz7f/u6UJpb/WzI71RXEQOdojLWmF2HDx5osRi3hXEJa20fbPq6DQXCJ8pf +IF37AEqAY4UNSNic0Cw+rGHdWPQhDNXhFWpdu7kCgYEAmv4oNmyoDXbuhrlsbggi +CXE9TbG3a3mm8dPOGf2yHBmf7R2i/6GtNW33Kw1KIwfBV77WpQEGZwWACsv8ONx3 +baUSiHTfpkfk5xQQ5w/tRMISfTuB4agD0jJFnLa7qXl2ZhY2S53aSVsdntDOhi+R +TEy1umah2Za8Xbd0RgHwcn0CgYEAl9Hgg9dfikMIaNVm6W/4cCtxoojy2Sf3LIlP +r1oDsH6JmBwsdJjuJ4ZNhoXJNqID2COuDgTEly7U+jf4gFvEGuT7JPw6tgy/Ln7i +jTVCpaozX08oykpVUEhDirYQ8fyLFaGbEqQQCcUusej59G/IlW0F2F6QoFrEwUaH +46R4EQECgYBEZ7edMkj3dmJH1wxQjp5GJNbrJkS8IKvzza0mDTJdz33CgEX9Oyva +o2iEkDVpvj2SEy28ewt22IRptWKH/3bQfxSCcRV6JFNt3+LongMshRYqq1leqrKa +9fnQVtfTIbIVXwjTZap6BL8R66OeFtexsSFRfDF/8P4n2oF4zmn4qA== +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..22f06e662 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey-revoked.pem diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..21b48ef0c --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-revoked/posttest.dat b/testing/tests/ikev2/ocsp-revoked/posttest.dat new file mode 100644 index 000000000..d742e8410 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/ocsp-revoked/pretest.dat b/testing/tests/ikev2/ocsp-revoked/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-revoked/test.conf b/testing/tests/ikev2/ocsp-revoked/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-root-cert/description.txt b/testing/tests/ikev2/ocsp-root-cert/description.txt new file mode 100644 index 000000000..9574aa5b1 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/description.txt @@ -0,0 +1,8 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which uses the <b>strongSwan CA</b>'s +private key to sign OCSP responses. A <b>strongswan ca</b> section in ipsec.conf +defines an <b>OCSP URI</b> pointing to <b>winnetou</b>. +<p> +<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since +the status of both certificates is <b>good</b>. diff --git a/testing/tests/ikev2/ocsp-root-cert/evaltest.dat b/testing/tests/ikev2/ocsp-root-cert/evaltest.dat new file mode 100644 index 000000000..a3a1df194 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::received valid http response::YES +carol::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..0209111ba --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..21b48ef0c --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..e998b6ad0 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey strongswanKey.pem -rsigner strongswanCert.pem \ + -resp_no_certs -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/tests/ikev2/ocsp-root-cert/posttest.dat b/testing/tests/ikev2/ocsp-root-cert/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/ocsp-root-cert/pretest.dat b/testing/tests/ikev2/ocsp-root-cert/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-root-cert/test.conf b/testing/tests/ikev2/ocsp-root-cert/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-signer-cert/description.txt b/testing/tests/ikev2/ocsp-signer-cert/description.txt new file mode 100644 index 000000000..492a9882b --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/description.txt @@ -0,0 +1,10 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which possesses an OCSP signer certificate +issued by the strongSwan CA. This certificate contains an <b>OCSPSigning</b> +extended key usage flag. <b>carol</b>'s certificate includes an <b>OCSP URI</b> +in an authority information access extension pointing to <b>winnetou</b>. +Therefore no special ca section information is needed in ipsec.conf. +<p> +<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since +the status of both certificates is <b>good</b>. diff --git a/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat b/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat new file mode 100644 index 000000000..4a8ffd412 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat @@ -0,0 +1,13 @@ +moon::ipsec listcainfos::ocspuris.*http://ocsp.strongswan.org::YES +carol::ipsec listcainfos::ocspuris.*http://ocsp.strongswan.org::YES +moon::cat /var/log/daemon.log::received valid http response::YES +carol::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES +carol::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES +moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES + diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..f49fa9204 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert-ocsp.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem new file mode 100644 index 000000000..aeca7e1db --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEWzCCA0OgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA3MDIyNTA3NTg1N1oXDTEyMDIyNDA3NTg1N1owVjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDTALBgNVBAsTBE9DU1Ax +HTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5 +vVZX3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8 +G7M2uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J +5rRlvXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+Kdt +kkCRQYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0If +pPr/QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABo4IBQzCCAT8wCQYD +VR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDRTWKccFIi95BslK3U92mIQ +2rWGMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYD +VQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ry +b25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3YW4u +b3JnMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL29jc3Auc3Ry +b25nc3dhbi5vcmc6ODg4MDA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0 +cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAc +1bBYLYcc+js3UsHVk7W17Nr/qoNFzQZJ5Er3RjhNAgzAX1wOTrNgKXztwZde1Alj +o05ZLXUFkB4coQwl7xo7I3EMJPUmSdHoyYyG7c7AgfcL/wwnzz4rWQl74WIZjySc +ON0Ny9vrzbVboktYof/9Yp/+HgeKopfsaIiuNCAwmAWxiYqvDmlxxn16oOXeJFV8 +pFzZMirQ5l7QRD9iuabOdcnBp8ASH+5AbD4KjFQjo5RBVg92LwOkJo3Pf1twI57s +pObrcM4JbHVohDornYQYfr9ymkMxJbqqkEgD8oIip0NFSbziam4ZkwgUlRIMUMU1 +/xsH+BXYZtKJbYjlnyc8 +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem new file mode 100644 index 000000000..603f071d0 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5vVZX +3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8G7M2 +uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J5rRl +vXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+KdtkkCR +QYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0IfpPr/ +QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABAoIBAFTGd5+gmpv96TGm +LW8Gp/poRX+BcDw2bUgLf6aMwd9jVV+4RVw5bTbXOSy2ls19x71dRSlyijDoUgZT +nSXPhwu1PIBM1JoRcZeJRjXiOUWFkCoTxBuykeyPiFcvNxWN5y2h6M822iHie9FI +UYomTYzvIT0LnIu00yJJpGAhwhW9BcL+Mo9lfWmhv4I1hXC9RTqZZ4rjPojDeFvL +maZNCk3kX2pxIJ1kG41/PJjg3JD2uEVrvV7SRuOknM+7f3SDtY60/Wnqx8dfBtjJ +hEdIxG+XXEOafdqwEPmmM++6V76uD8Rs1eFrrI4rfK6/H2PjppJCYtQeryug0q+0 +UN2u00kCgYEA5qJOcDSzb7CQAi58yYicYc3ShEbaL75V7G5rlnFg4/G1axU19hXQ +wEPDf87So9hnVroCMewjyDiNgI/OyYK2cv1TABUGAEFAHPzj99jtBT0/R0kX+Jd2 +kPwCU4/T2cHrezwNobrJf010JAvwc52b+U3lWtHxBWeq5KALUVT+BhcCgYEA3wdx +OwVxTf+OBOBcxPPGUcfsKbf9uVTcXFLNRSBbjzRIOR/bIVgUQaBXem2fJJTm1mWN +Yl/U14G5orv9693GKgE5IDAMMrDF7mOsX808o3pcXM04MTAyGmQEDDEO8tgmWzWo +nrYzxe9uBR1tej9IsiEPlD9ZLtWix9C2uV7EcSUCgYBKOrDuMjgSWYxv91BYeOyE +Gf+IbVlqBmOXPg7Ik+MwWioetevxMSJHz0eLyiBHda4E3sc4FB2MIo+AckiG2Ngp ++FiPbTTKPjYJXmds7NeUWRsVsXPSocUactG43VC9BEnrFu/4Pqr9mwsnUuRoAbEi +syx/Z5SgPbZl8RDTc3xyrwKBgBFpB1HQLvQjyvZefV9ymDyyGqF3F3tsQHeEjzmi +OQOI1UqATh7gPVSSK8IG5LF6XjrGWq8fRAI+wjsN6diLy3hj+A2nMoySeCEP7tjb +sKwiVSt5abWNSZv9ysMY4U3bycK9AZjCKHB/LFuB3JX6crZVFl5AQ7oAO2DVzi3S +VAtxAoGALzFZH7o1ZvVJGa23dW7p96G5vgop6Ulp2DLz4Qg6NYIeatZhwX3lls2J +P7ZxmHiECC7zR67xwv5QKjKfg6t/sOKU/bsyp6c3hOWQjcFbWU3AwlO1TeVX9TMG +SmPYcKM+KQ969qKD3aP9MQ+t4FERvlQcBAr0Qun3quN2i3eDkDo= +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..a89065443 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey-ocsp.pem diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a8a9f1e30 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-signer-cert/posttest.dat b/testing/tests/ikev2/ocsp-signer-cert/posttest.dat new file mode 100644 index 000000000..220bc2c1d --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/ocsp-signer-cert/pretest.dat b/testing/tests/ikev2/ocsp-signer-cert/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-signer-cert/test.conf b/testing/tests/ikev2/ocsp-signer-cert/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-timeouts-good/description.txt b/testing/tests/ikev2/ocsp-timeouts-good/description.txt new file mode 100644 index 000000000..9ee5db95b --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/description.txt @@ -0,0 +1,10 @@ +This scenario is based on <a href="../ocsp-signer-cert">ikev2/ocsp-signer-cert</a> +and tests the timeouts of the <b>libcurl</b> library used for http-based OCSP fetching +by adding an ocspuri2 in <b>moon</b>'s strongswan ca section that cannot be resolved by +<b>DNS</b> and an ocspuri2 in <b>carol</b>'s strongswan ca section on which no +OCSP server is listening. Thanks to timeouts the connection can nevertheless +be established successfully by contacting a valid OCSP URI contained in +<b>carol</b>'s certificate. +<p> +As an additional test the OCSP response is delayed by 5 seconds in order to check +the correct handling of retransmitted IKE_AUTH messages. diff --git a/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat b/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat new file mode 100644 index 000000000..4c4059810 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat @@ -0,0 +1,9 @@ +moon::cat /var/log/daemon.log::http post request using libcurl failed::YES +carol::cat /var/log/daemon.log::http post request using libcurl failed::YES +moon::cat /var/log/daemon.log::received valid http response::YES +carol::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES + diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf index 6d0aee86a..b53de16e4 100755 --- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf @@ -1,20 +1,24 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup - plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + plutostart=no +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri2=http://bob.strongswan.org:8800 + auto=add + conn %default + keyexchange=ikev2 ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 left=PH_IP_CAROL leftnexthop=%direct - leftcert=carolCert.pem + leftcert=carolCert-ocsp.pem leftid=carol@strongswan.org conn home diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem new file mode 100644 index 000000000..aeca7e1db --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEWzCCA0OgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA3MDIyNTA3NTg1N1oXDTEyMDIyNDA3NTg1N1owVjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDTALBgNVBAsTBE9DU1Ax +HTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5 +vVZX3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8 +G7M2uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J +5rRlvXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+Kdt +kkCRQYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0If +pPr/QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABo4IBQzCCAT8wCQYD +VR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDRTWKccFIi95BslK3U92mIQ +2rWGMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYD +VQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ry +b25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3YW4u +b3JnMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL29jc3Auc3Ry +b25nc3dhbi5vcmc6ODg4MDA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0 +cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAc +1bBYLYcc+js3UsHVk7W17Nr/qoNFzQZJ5Er3RjhNAgzAX1wOTrNgKXztwZde1Alj +o05ZLXUFkB4coQwl7xo7I3EMJPUmSdHoyYyG7c7AgfcL/wwnzz4rWQl74WIZjySc +ON0Ny9vrzbVboktYof/9Yp/+HgeKopfsaIiuNCAwmAWxiYqvDmlxxn16oOXeJFV8 +pFzZMirQ5l7QRD9iuabOdcnBp8ASH+5AbD4KjFQjo5RBVg92LwOkJo3Pf1twI57s +pObrcM4JbHVohDornYQYfr9ymkMxJbqqkEgD8oIip0NFSbziam4ZkwgUlRIMUMU1 +/xsH+BXYZtKJbYjlnyc8 +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem new file mode 100644 index 000000000..603f071d0 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5vVZX +3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8G7M2 +uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J5rRl +vXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+KdtkkCR +QYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0IfpPr/ +QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABAoIBAFTGd5+gmpv96TGm +LW8Gp/poRX+BcDw2bUgLf6aMwd9jVV+4RVw5bTbXOSy2ls19x71dRSlyijDoUgZT +nSXPhwu1PIBM1JoRcZeJRjXiOUWFkCoTxBuykeyPiFcvNxWN5y2h6M822iHie9FI +UYomTYzvIT0LnIu00yJJpGAhwhW9BcL+Mo9lfWmhv4I1hXC9RTqZZ4rjPojDeFvL +maZNCk3kX2pxIJ1kG41/PJjg3JD2uEVrvV7SRuOknM+7f3SDtY60/Wnqx8dfBtjJ +hEdIxG+XXEOafdqwEPmmM++6V76uD8Rs1eFrrI4rfK6/H2PjppJCYtQeryug0q+0 +UN2u00kCgYEA5qJOcDSzb7CQAi58yYicYc3ShEbaL75V7G5rlnFg4/G1axU19hXQ +wEPDf87So9hnVroCMewjyDiNgI/OyYK2cv1TABUGAEFAHPzj99jtBT0/R0kX+Jd2 +kPwCU4/T2cHrezwNobrJf010JAvwc52b+U3lWtHxBWeq5KALUVT+BhcCgYEA3wdx +OwVxTf+OBOBcxPPGUcfsKbf9uVTcXFLNRSBbjzRIOR/bIVgUQaBXem2fJJTm1mWN +Yl/U14G5orv9693GKgE5IDAMMrDF7mOsX808o3pcXM04MTAyGmQEDDEO8tgmWzWo +nrYzxe9uBR1tej9IsiEPlD9ZLtWix9C2uV7EcSUCgYBKOrDuMjgSWYxv91BYeOyE +Gf+IbVlqBmOXPg7Ik+MwWioetevxMSJHz0eLyiBHda4E3sc4FB2MIo+AckiG2Ngp ++FiPbTTKPjYJXmds7NeUWRsVsXPSocUactG43VC9BEnrFu/4Pqr9mwsnUuRoAbEi +syx/Z5SgPbZl8RDTc3xyrwKBgBFpB1HQLvQjyvZefV9ymDyyGqF3F3tsQHeEjzmi +OQOI1UqATh7gPVSSK8IG5LF6XjrGWq8fRAI+wjsN6diLy3hj+A2nMoySeCEP7tjb +sKwiVSt5abWNSZv9ysMY4U3bycK9AZjCKHB/LFuB3JX6crZVFl5AQ7oAO2DVzi3S +VAtxAoGALzFZH7o1ZvVJGa23dW7p96G5vgop6Ulp2DLz4Qg6NYIeatZhwX3lls2J +P7ZxmHiECC7zR67xwv5QKjKfg6t/sOKU/bsyp6c3hOWQjcFbWU3AwlO1TeVX9TMG +SmPYcKM+KQ969qKD3aP9MQ+t4FERvlQcBAr0Qun3quN2i3eDkDo= +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..a89065443 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey-ocsp.pem diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..f3b19d292 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..92aa920aa --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,14 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +# simulate a delayed response +sleep 5 + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat b/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat new file mode 100644 index 000000000..220bc2c1d --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat b/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-timeouts-good/test.conf b/testing/tests/ikev2/ocsp-timeouts-good/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt new file mode 100644 index 000000000..d17534b1b --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt @@ -0,0 +1,7 @@ +This scenario is based on <a href="../ocsp-signer-cert">ikev2/ocsp-signer-cert</a> +and tests the timeouts of the <b>libcurl</b> library used for http-based OCSP fetching +by adding an ocspuri1 in <b>moon</b>'s strongswan ca section on which no OCSP +server is listening and an ocspuri2 that cannot be resolved by <b>DNS</b>. +Since the certificate status is <b>unknown</b> the connection setup is aborted by +<b>moon</b> with an <b>AUTHORIZATION_FAILED</b> notification sent to <b>carol</b>. + diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat new file mode 100644 index 000000000..c9c09a72f --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::http post request using libcurl failed::YES +moon::cat /var/log/daemon.log::certificate status unknown::YES +carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO + diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..cdc1560ae --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri1=http://bob.strongswan.org:8800 + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..e759d1d79 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri1=http://bob.strongswan.org:8800 + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat new file mode 100644 index 000000000..cf72480d4 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::iptables -F OUTPUT +carol::iptables -F OUTPUT diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat new file mode 100644 index 000000000..7d9d600ff --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat @@ -0,0 +1,6 @@ +moon::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP +carol::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/description.txt b/testing/tests/ikev2/ocsp-untrusted-cert/description.txt new file mode 100644 index 000000000..f581dd319 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/description.txt @@ -0,0 +1,9 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which is sending its <b>self-signed</b> +OCSP signer certificate. A strongswan <b>ca</b> section in ipsec.conf +defines an <b>OCSP URI</b> pointing to <b>winnetou</b>. +<p> +<b>carol</b> cannot successfully initiate an IPsec connection to <b>moon</b> since +the self-signed certificate contained in the OCSP response will not be +accepted by <b>moon</b>. diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat new file mode 100644 index 000000000..a0b6d681f --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat @@ -0,0 +1,5 @@ +moon::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::received ocsp signer certificate is not trusted - rejected::YES +moon::cat /var/log/daemon.log::certificate status unknown::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..3c685a839 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..e2fabe0f5 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..20c4b2a22 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/protoport-dual/description.txt b/testing/tests/ikev2/protoport-dual/description.txt new file mode 100644 index 000000000..7bed8b959 --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/description.txt @@ -0,0 +1,6 @@ +Using the <b>left|rightprotoport</b> selectors, two IPsec tunnels +between the roadwarrior <b>carol</b> and the gateway <b>moon</b> are +defined. The first IPsec SA is restricted to ICMP packets and the second +covers TCP-based SSH connections. The established tunnels are tested +by <b>carol</b> by first pinging <b>alice</b> behind <b>moon</b> and +then setting up an SSH session to the same client. diff --git a/testing/tests/ikev2/protoport-dual/evaltest.dat b/testing/tests/ikev2/protoport-dual/evaltest.dat new file mode 100644 index 000000000..bd24b911c --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/evaltest.dat @@ -0,0 +1,9 @@ +carol::ipsec statusall::home-icmp.*INSTALLED::YES +carol::ipsec statusall::home-ssh.*INSTALLED::YES +moon::ipsec statusall::rw-icmp.*INSTALLED::YES +moon::ipsec statusall::rw-ssh.*INSTALLED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/protoport-dual/hosts/carol/etc/ipsec.conf index 598997b45..eda0ddf38 100755 --- a/testing/tests/mode-config/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/protoport-dual/hosts/carol/etc/ipsec.conf @@ -1,21 +1,17 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup - plutodebug=control - crlcheckinterval=180 + crlcheckinterval=180 strictcrlpolicy=no + plutostart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 - -conn home + keyexchange=ikev2 left=PH_IP_CAROL - leftsourceip=%modeconfig leftnexthop=%direct leftcert=carolCert.pem leftid=carol@strongswan.org @@ -24,7 +20,11 @@ conn home rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add - - - - + +conn home-icmp + leftprotoport=icmp + rightprotoport=icmp + +conn home-ssh + leftprotoport=tcp + rightprotoport=tcp/ssh diff --git a/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..0bc03380b --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + leftsubnet=10.1.0.0/16 + right=%any + auto=add + +conn rw-icmp + lefthostaccess=yes + leftprotoport=icmp + rightprotoport=icmp + +conn rw-ssh + leftprotoport=tcp/ssh + rightprotoport=tcp diff --git a/testing/tests/ikev2/protoport-dual/posttest.dat b/testing/tests/ikev2/protoport-dual/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/protoport-dual/pretest.dat b/testing/tests/ikev2/protoport-dual/pretest.dat new file mode 100644 index 000000000..d3d0061c3 --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/pretest.dat @@ -0,0 +1,7 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home-icmp +carol::ipsec up home-ssh diff --git a/testing/tests/ikev2/protoport-dual/test.conf b/testing/tests/ikev2/protoport-dual/test.conf new file mode 100644 index 000000000..9cd583b16 --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/protoport-route/description.txt b/testing/tests/ikev2/protoport-route/description.txt new file mode 100644 index 000000000..ec7ec69b0 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/description.txt @@ -0,0 +1,8 @@ +Using the <b>left|rightprotoport</b> selectors, two IPsec tunnels +between the roadwarrior <b>carol</b> and the gateway <b>moon</b> are +defined. The first IPsec SA is restricted to ICMP packets and the second +covers TCP-based SSH connections. Using <b>add=route</b> %trap +eroutes for these IPsec SAs are prepared on <b>carol</b>. By sending +a ping to the client <b>alice</b> behind <b>moon</b>, the ICMP eroute +is triggered and the corresponding IPsec tunnel is set up. In the same +way an ssh session to <b>alice</b> over the second IPsec SA is established. diff --git a/testing/tests/ikev2/protoport-route/evaltest.dat b/testing/tests/ikev2/protoport-route/evaltest.dat new file mode 100644 index 000000000..d6ce409f5 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/evaltest.dat @@ -0,0 +1,10 @@ +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES +carol::ssh PH_IP_ALICE hostname::alice::YES +carol::cat /var/log/daemon.log::creating acquire job for CHILD_SA::YES +carol::ipsec statusall::home-icmp.*INSTALLED::YES +carol::ipsec statusall::home-ssh.*INSTALLED::YES +moon::ipsec statusall::rw-icmp.*INSTALLED::YES +moon::ipsec statusall::rw-ssh.*INSTALLED::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..7f4e37bc2 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=route + +conn home-icmp + leftprotoport=icmp + rightprotoport=icmp + +conn home-ssh + leftprotoport=tcp + rightprotoport=tcp/ssh diff --git a/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..0bc03380b --- /dev/null +++ b/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + leftsubnet=10.1.0.0/16 + right=%any + auto=add + +conn rw-icmp + lefthostaccess=yes + leftprotoport=icmp + rightprotoport=icmp + +conn rw-ssh + leftprotoport=tcp/ssh + rightprotoport=tcp diff --git a/testing/tests/ikev2/protoport-route/posttest.dat b/testing/tests/ikev2/protoport-route/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/protoport-route/pretest.dat b/testing/tests/ikev2/protoport-route/pretest.dat new file mode 100644 index 000000000..0aded0f4d --- /dev/null +++ b/testing/tests/ikev2/protoport-route/pretest.dat @@ -0,0 +1,8 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ssh PH_IP_ALICE hostname +carol::ping -c 1 PH_IP_ALICE > /dev/null +carol::sleep 2 diff --git a/testing/tests/ikev2/protoport-route/test.conf b/testing/tests/ikev2/protoport-route/test.conf new file mode 100644 index 000000000..9cd583b16 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-cert/description.txt b/testing/tests/ikev2/rw-cert/description.txt new file mode 100644 index 000000000..15b3822b5 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>. +Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b> +automatically inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping +the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-cert/evaltest.dat b/testing/tests/ikev2/rw-cert/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/rw-cert/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..e5d9ad476 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..3c0014965 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..b8bc990cd --- /dev/null +++ b/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/rw-cert/posttest.dat b/testing/tests/ikev2/rw-cert/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-cert/pretest.dat b/testing/tests/ikev2/rw-cert/pretest.dat new file mode 100644 index 000000000..42e9d7c24 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/pretest.dat @@ -0,0 +1,9 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-cert/test.conf b/testing/tests/ikev2/rw-cert/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-fqdn/description.txt b/testing/tests/ikev2/rw-psk-fqdn/description.txt new file mode 100644 index 000000000..d4a7c3878 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b> +and fully qualified domain names. Upon the successful establishment of the IPsec tunnels, +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that +let pass the tunneled traffic. In order to test both tunnel and firewall, both +<b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..9a5087fff --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..47e31ca21 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..7b6e448b3 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..f6c1a22ef --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a6270a67e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + auto=add diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..e6c7420c9 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat new file mode 100644 index 000000000..282b2aec0 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat @@ -0,0 +1,12 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::rm /etc/ipsec.d/cacerts/* +carol::rm /etc/ipsec.d/cacerts/* +dave::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-fqdn/test.conf b/testing/tests/ikev2/rw-psk-fqdn/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-ipv4/description.txt b/testing/tests/ikev2/rw-psk-ipv4/description.txt new file mode 100644 index 000000000..4eb66c540 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b> +and IPv4 addresses. Upon the successful establishment of the IPsec tunnels, +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that +let pass the tunneled traffic. In order to test both tunnel and firewall, both +<b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..0e3fe6962 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..18a074472 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..368c3c6fb --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..e989540e9 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..c38a2a59b --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + auto=add diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..ab3fb129b --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat new file mode 100644 index 000000000..282b2aec0 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat @@ -0,0 +1,12 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::rm /etc/ipsec.d/cacerts/* +carol::rm /etc/ipsec.d/cacerts/* +dave::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-ipv4/test.conf b/testing/tests/ikev2/rw-psk-ipv4/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-no-idr/description.txt b/testing/tests/ikev2/rw-psk-no-idr/description.txt new file mode 100644 index 000000000..51286f123 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b> +and fully qualified domain names. By setting the wildcard <b>rightid=@*.strongswan.org</b> +on <b>carol</b> and <b>dave</b>, no <b>IDr</b> payloads are sent by the roadwarriors. +In order to test the tunnel, +both <b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..b23046668 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@*.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..47e31ca21 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..66734b543 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@*.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..f6c1a22ef --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a6270a67e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + auto=add diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..e6c7420c9 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat new file mode 100644 index 000000000..282b2aec0 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat @@ -0,0 +1,12 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::rm /etc/ipsec.d/cacerts/* +carol::rm /etc/ipsec.d/cacerts/* +dave::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-no-idr/test.conf b/testing/tests/ikev2/rw-psk-no-idr/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt b/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt new file mode 100644 index 000000000..f190cae4b --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> each set up a connection to gateway <b>moon</b>. +<b>carol</b>'s authentication is based on a Pre-Shared Key (<b>PSK</b>) whereas <b>dave</b>'s +is based on an RSA signature (<b>RSASIG</b>). Gateway <b>moon</b> supports both authentication modes +and selects the correct roadwarrior connection definition based on the gateway ID +requested by the roadwarrior. + diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat new file mode 100644 index 000000000..f7f9dc51d --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat @@ -0,0 +1,15 @@ +moon::cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES +moon::cat /var/log/daemon.log::authentication of 'PH_IP_MOON' (myself) with pre-shared key::YES +moon::ipsec statusall::rw-psk.*INSTALLED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +moon::cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES +moon::cat /var/log/daemon.log::authentication of '@moon.strongswan.org' (myself) with RSA signature::YES +moon::ipsec statusall::rw-rsasig.*INSTALLED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..10eeee9c1 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightsendcert=never + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..47e31ca21 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..ac99ac66c --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + crlcheckinterval=180 + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..7419be98a --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + +conn rw-rsasig + authby=rsasig + leftcert=moonCert.pem + leftid=@moon.strongswan.org + auto=add + +conn rw-psk + authby=secret + leftid=PH_IP_MOON + auto=add + diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..508d3a941 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,7 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey.pem + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat new file mode 100644 index 000000000..e48d11e42 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat @@ -0,0 +1,10 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +carol::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-rsa-split/description.txt b/testing/tests/ikev2/rw-psk-rsa-split/description.txt new file mode 100644 index 000000000..b601deea8 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/description.txt @@ -0,0 +1,8 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The roadwarriors' authentication is based on +<ib>Pre-Shared Keys</b> (PSK) whereas the gateway uses an <b>RSA signature</b> +(RSASIG) certified by an X.509 certificate. +Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b> +automatically inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping +the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat new file mode 100644 index 000000000..c0fd8b16b --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat @@ -0,0 +1,12 @@ +moon::cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES +moon::cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with pre-shared key successful::YES +moon::cat /var/log/daemon.log::authentication of '@moon.strongswan.org' (myself) with RSA signature::YES +moon::ipsec statusall::rw.*INSTALLED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..6a8253dc4 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..47e31ca21 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..3c9e9a009 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..f6c1a22ef --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..b62ab4156 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + rightsendcert=never + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..508d3a941 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,7 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey.pem + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat new file mode 100644 index 000000000..42e9d7c24 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat @@ -0,0 +1,9 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-rsa-split/test.conf b/testing/tests/ikev2/rw-psk-rsa-split/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/strong-keys-certs/description.txt b/testing/tests/ikev2/strong-keys-certs/description.txt new file mode 100644 index 000000000..9d0ca5528 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/description.txt @@ -0,0 +1,7 @@ +This scenario is derived from <a href="../rw-cert"><b>ikev2/rw-cert</b></a>. +The gateway <b>moon</b> uses a 2048 bit RSA private key protected by <b>AES-128</b> +encryption whereas the roadwarriors <b>carol</b> and <b>dave</b> have an +<b>AES-192</b> and <b>AES-256</b> envelope, respectively. +The X.509 certificate of the gateway <b>moon</b> uses a <b>SHA-256</b> hash in +its signature whereas the certificates of the roadwarriors <b>carol</b> +and <b>dave</b> use <b>SHA-384</b> and <b>SHA-512</b>, respectively. diff --git a/testing/tests/ikev2/strong-keys-certs/evaltest.dat b/testing/tests/ikev2/strong-keys-certs/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..4ddd99280 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert-sha384.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem new file mode 100644 index 000000000..d4b532323 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEITCCAwmgAwIBAgIBETANBgkqhkiG9w0BAQwFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA2MTAwODEyMTI1MFoXDTExMTAwNzEyMTI1MFowWTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS0z +ODQxHTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAtCwjB6Yni4jSTbPJ4GX0kM06nr2tDBdU0PH6dZra +IXNaNiBthBNPNDeCYAQDG/ouwuywAJ6L2Lt0GYEhJSwfXMm87fYSG8qRP+C/nlKz +3fCfsuZ8yOAo5NAp2kgvbFVdB5cMeOtid21UqUvDxkncjFRDgpERtrjSthalUFYu +ObIcSMPdlcDho73jzq6zVK5XDJ4l1LHUQLbS4SzyrphCYKekTIoDy3YwRUys6Pdm +4QlFBIXuBwOYHjclvVu0HQVNSM4nWAJd+204KUm/+8neO0kn1Yakv9yoa47o3KGP +3XjtmcgY9SqBbuF+8yDcZQ7+5zUBjc0J+d8txdPoIjLi7wIDAQABo4IBBjCCAQIw +CQYDVR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFIUlEfDm3V0eDmRrpIvj +4FiPpGlpMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQsw +CQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMS +c3Ryb25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3 +YW4ub3JnMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5v +cmcvc3Ryb25nc3dhbi5jcmwwDQYJKoZIhvcNAQEMBQADggEBAL5ZmFmy8lW4Vdwq +hWB6qTtLLa1wwCvTXwbV9V+F8dK39AvHj6CHFqTiFhAbGIq/Ryt9cg2XGy1TDjVj +hQEua7mjp8XH2j2NLY2SiFTMjchbHmMylFk2FrHy2ZnmlRCiH83TAw+EnUWsQKj+ +gL+7Of9SpiaaIblrl+aCiBVktRuXcFSaxjYWTVXOeTCwnxQdF2SNtUKDoCuVPk1J +XCrs86mj575xL/FGjyN4SVbjTEZ4lm1emxrf/RblZOhCKp7mUic8KyP0kf7o6X8E +MXXjq9fDQVrSDG/q62uhZu7CyInnBpWnoUKiMImSxRn/cs0r7RUspC5DtJyhE33Y +DW2BzIc= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem new file mode 100644 index 000000000..979740525 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-192-CBC,3127472197F76F3E81FF26DCD894FE6F + +ixCdabns1DD2EVjOUQYbxes+mSU6WmfUnRPBthTw1K3X7/jYEVRrApZlPoRxfitg +7aHdqsV70elT48ucP4z410jupq80OI5/3I31zHiqDpmUNXr0ZGs69dC2g01op98Q +IWfbHygALh0PDjhczHWhDBOx+gJDN58qgMfCI2hUDqpcYD9gvEpkkdM/R3Ggwgiq +f+HBD4rQHcpvuKCPIOBVAR/4cXE3D8pcls3FJALwNGf03yIm24hEG2mTz5cDIVTw +m0Bjk5Hbiym4LBreUoVQUF04wDXsuDtz7m1IPkw4GsYpeiomqRyAs7bKUJhbKwaK +/l2MKoQ06Ofx0kc20CG7/qoboiqUgDEOsNd/qdMVOXcqinONW2v2T8+mEi/iLZDJ +B6WXoV15PBkHXfaKeA66oFfF8EqggF4gLoPwekz1jvz5hbeTNYCiuFsMV9ntTxoE +opohFNBvY2ZbJUmmkecgSJcmmByR2cahukh91PjssfZUjMOJjoTpuB3OXF9J6g9U +RKWYxgcyT1n0e0MbYxe4TXHxxUDa5UBkquELQ2gcmJDO5GFuXF40mcvcz3Bse6I7 +GTRvhSL3hmRvbODE3JVI2dISHJ60Fethjxo5JNmCuBqnSkc2KPvsS7ulqANMnnNE +5u2g9RMAtYKfkwscLY8zByouCZTS2pAI+LQd/eTm3/TAZWDJx/Z2UA5peFm2At4n +aerRYP20TeaAI4tcnqsrOpBj0ouphgkGUTGAbBhjR3c2rSoOHxmjQXJOAc59vjgG +zBl2F9M1xtjuTFZxFLMbnx15W1l5rmhZmSTdDY8C5ePBcjn6umxl6QdwvPjbkMIL +MoeyM6w1Eqweg+m25CFOCWrFnglZNM6lcsR3X88oz+gzmHOs/VtAQn7vCA2Ukc5m +RuLro/1juBjMrXd63Mqvxml/0lcSrXH1/ZiTdrdakU5rHNk9554tSL14rBSD86tQ +u7unnobiXTmE0l/fDVuRYzW/Y8GGEr5S2t7SOuNFnU+tXTdavftJD0D7F8v4/bTf +ObDe5qJ/7Y7X/8i6L+va1cm5rXNDI1qrBgwmNv7FbY1G0qBIP80ie7FbcsCpXauE +T5HWTOdJX+xpTVCHXnBriMhlFHXAIKUVdAZqbzgRFWPCOYpzpztgny4l83qP0OLw +vYxvU7RSGFAamRz05t3vHXy3X8n7JulleE8laBFpwx9Xq/bEAkwwmZq1Y6tbksae +4G9aJ6Tdr4SA7BsH+FrtLtwFUkzgmKg+MqDGXamFSx0rvhksl3u67tMpGh0Il8KS +xGfpPXRKaeQwZ18AA1xfPVl01Ajuxhnmmr/ng8WR+DfBpx7uK3lSpUX37Gh06DP5 +Of9oPHpc+Z0Asx/k6XWYGP9G15azUXP5ejebl19QQdZex/wP0MkKNlZ/BH0xJO+a +FLOkg4OhtTppIA0dOhj/v/WCLC+pdl+78pBOQO7dpuJeYrcVvhiQKMhEJdYiYLXY +ZcbN+E0Ta8I9fX1D6qgIEhL0NOczEYT9kYYQZJf2LW9k+dxICPV/0hEjaRNyMrei +C9ZP1k9cEhNMSVRVV2jm2PhOW3nvOFUNkG8OIfFhCri8dXWaGVS/DMb18rpSoB+B +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..4c9a601ca --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey-aes192.pem "ITP/H4lSHqGpUGmCpgNDklbzTNV+swjA" diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..2b5407387 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert-sha512.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem new file mode 100644 index 000000000..73088cd1d --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBEjANBgkqhkiG9w0BAQ0FADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA2MTAwODEyMjExMloXDTExMTAwNzEyMjExMlowWDELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS01 +MTIxHDAaBgNVBAMUE2RhdmVAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDL4+PsltDM0QCCS08tkefhll5Q0nb2VEdRZotBIdt6 +XEY1kmDlw0yQOp0XUznnIhcrxXpKeWpLqJdbo56jSxMaUB3Mod1u+aKvVhCgkOT8 +uQa7gIdcNMuXnfnch7yYYS6YxVfzdr/qXBxmVYNbR9sXy48vAD6glZLEVjDITHJO +a6tEVSrAOMyeuA9XTYJiGw5loj63YbUr6Ikp6W9SncPCtfX6G2Amk38MTuITu93W +Pd/bGB06ra6gmMQGAhXuGs14n3QZfQz9PWTp9TPsQNqQZdEjQyNdfeAKtPuz5jnO +cnZuhvVR0q4sxWuy64vkyZ57luTZAXyxdInBeBOp7sC3AgMBAAGjggEFMIIBATAJ +BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU0wvMMeoe59mocM/RiYnD +iw9NUm0wbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ +BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz +dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYETZGF2ZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBDQUAA4IBAQC/uKe2O9elbSFgpKP5 +7ZjJrCkYu493iH/PDm5G4D76q6WkRvZDqTgGDSIrXrt1xRLIsVJES+HERxfED0DB +yXNe22p1jR8iZdCesZxmEsKYyLh9XmeixKCfnLvStWCVs0+vqwhJlIkyEAveZ4HR +Yq121khdmCDDUugpjEl/nU7CLvCRVgFrlhDm1QLs2rYqxwQrJ2SH4/1W0YRdkY2R +vKZ2ngjLBNjBfXWNXSOpEAG367nVam5lFAepUC0wZTshyCUXt1NzClTnxWABm6M6 +x2Qwg4D6Qt5iXSjR8+DGVh+LaBL/alQi1YYcjkxufdFHnko294c0HsZcTZ3KRghk +ue1F +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem new file mode 100644 index 000000000..e2a1ccb26 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-256-CBC,088DA49D259D5876324277FE7C38F22B + +fChe2r3NjWQnfK3tFIUHtrnYsU+CzbGKmWE1T8ARaLeVC7XtPN99odBYTBOzJj98 +REHk41NWHlVjcY+2ACedniTsQcvuuN3bMHGvyikQeLmg7tc54pQrc85BHfdGrU49 +5Bzhxn29kqY33Dt2aeAMyP3k/b5HyZlCGuQUJx71uPsaEl1so5QE0aIBLaCutIUz +zZcAAa6ahFhw2oOcU2kj8ACGzXrJvBhVU97/yZTdfqrTJauoPXL/WQ+ScfMBhQ0x +vaJbaVy8On1SXTMH2K1ehszjpeFTeRVgndkWuUipwm/xlyzoubs8L4BhJZNzV23r +04ZGYxwSQ0rZBEt+TqopVpc/iMx/vg33P8PHrI45DeoztvjHpD6Fgj5Yh2kGgU5R +cKD1ejgX3FMwTSI5xumUi8mQ+N2pUIK9polS146dpQRoM8F9hsXkYoK/l9Em5jJA +V4vBBbVr6E9G0fVyHboqIzAHgFiC3xnCvVC/Cnyit4zD7D0E86pktR0y4Imtxten +3WUV4rNAVkLR0D5Hoslk9nsqEaOxDBzUVU/zfG8GXItpWQgug5sb6RjcrK0b4Fit +iHsEO5qLZ09cM+1hoddgibUQd0G+iZDPfPc++SCdZVjcvdSOOtcUCJwQGjOdGi9U +I30gjh1Vtql67CnykRmk38duTFFNpL3zLNGfiA+kUeHDr0C4zeD2NsK4v/4nLAO1 +OWSYYFGrhbU5C96q3rgczdh+TurgIhM+ktBUJ/7yYV2eTRlRT35Wk03O7STBLinV +jaXuDBOKb/NAYgA+xtOeBqd1c4cSdOxJEv80G9hhXxxNgf1W1OHDNY6+qXhnLZJU +o1kbF6QNI+R+ip8643GwdLEcz5s49V7x53TDcCGnW2TwzVVHvj+63u5RPcfu8b9e +gz0ey++z6OWvEIt/7NiTzA0dZdmiNLY24uHDHvQ5XmMs4XVM1r5wSFXvs/tDuUpK +/a9zMbr12RDsObVcXXr07FD5Zyh/y2mBEB7xRFXKk5tt++Hvlzbgqxypgq9t5+m8 +PBddV4GarMuZw8bRjMHJ2CVY1VyRGIx+StsHehVMWdfzZTm/Uizq/yPaxqbQE8wY +Vcm6wgYRekAga6I9XsHZ0TBfKtfZqXf0kXX0A+ymQYbfyUm2MqWV5avOKtBRIqcW +B9jCKxah7rjQNlI7vzwZ/whePHU2sL4D23aGGZa373Ql2CmB3AetxYtkRGTSILw9 +aT+ZNgh+BGq6lcdlyks29fFuWRlE+NyJIAwmIVEisZGFijFe5WXBhKWsvEt2JT1v +3qW9lMimOgpkClroPSdb9gQMt1yXDR6z1ty+B41kgy5qSxUiL8z8EUCWPEBPrz5+ ++3KGi1cU5BsfptnkFYCSnVSyRxARh310mruQ2Mb6ipIXX95ejQPSskz5P4u26Olt +UHyS0lgDc8hZTwJUchE5wqj4bAJs12mKbIbapjYv83OAEW8ybGz8R6QVMp3pAad3 +O2WGef6evGrbGKHI6ACMEHaz8fP8GIMjhbJkPxsXYGRsHbUsqYcSmew3EYW51qSA +xMhrzZ6e9ow4PYDuNnUc4bFeV0BIVl6kH7KscT1LBtJVJkXDDoddxFiEhcRjOLDr +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..b4b1c6249 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA daveKey-aes256.pem "MeFnDN7VUbj+qU/bkgRIFvbCketIk2wrrs5Ii8297N2v" diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..9c0a14c9b --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert-sha256.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + auto=add diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem new file mode 100644 index 000000000..307f4953e --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBEDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA2MTAwODEwNTgxMVoXDTExMTAwNzEwNTgxMVowWDELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS0y +NTYxHDAaBgNVBAMTE21vb24uc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDzXHm8D8sY1lmX7o1KK0jt/M+UzAI2Ifpx7nAqoviH +XQIPe56BOAm4zHhEIlojEMFd1nncplXvDDGjuV/2F0KK1bFxbNtom88Ix1jrRWtk +FLopYwj3ERC2970OhNO3nuPLrnEAzj6k3XPGMTA3drGnpRf162f7mHAdmYIRXtWm +mfaecs4wGFs8BFGdeDfo6SPhQXZSBwZqjzQxvk1PA7E1qifgR5IGNZkNQRQ9IZD0 +86xzjmZgg5DaJcQKw45elpiVKQN6OkdWTngR3uUBfseWNeRGP5UxCUbDnPijWUbA +6ZAdEfFXLgSpSoXHLNttvGg+SWm0kgKTpHYWYhvpflKNAgMBAAGjggEFMIIBATAJ +BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU0gL3aEo/H8c/Ld/GkBTb +W9Ma+nUwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ +BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz +dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYITbW9vbi5zdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQCItzRn3TNWUzczBd8z +MtdPEsRl5Oi4fV3UecQxhjxAmJDLsEZT5I4uNa1XoLkJm6jVdSL7k+bjzjmpNJ1H +uL49cqia2yTdGP4IU0K8dTGaflg3ccaLLGGXTWU/NtgdI1o6yuZTwb6a9ZL7wWZT +x21BAsvyPTzCpUS1yCK4bFeYOxOYDphUGcwb0JTuRxx2/710b+p64BYiCfVkQJxT +eF1ZtjSW6nJgzMRg5n2zNpdrdXMMCPI6Nl7V6wxbs3Cphmz5qx3lijwi7nZt+jE5 +qK5gphph1MkKIhnA7MF66KEcx5Rknao68yLBBDIA/AISZ3bCIj8R1SGgl/tMYfep +sbRF +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem new file mode 100644 index 000000000..bc9ed38c8 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-128-CBC,381AA672F615E55CD044FB981754FDA6 + +whvkSUJ2sAIH4EOu8vT9LHcKKKG6W9hl/hO++/awU2AVtHn6mYlkkAqDRJiOZbbT +vo0ndy+0B0tCoTyKZbiMRNc6bzHPNgS17cVa2wXrzzMo64xRcElzdN14L8UGA7Cc +Wu3aD0zmzawU9uRZjaQ4qA46FPz/S9/REImZ02QSALIzZJSIIDoUbznBitaHYFve +eLl7e/0vMS/s03FaRNKrVhids3Z3q7lQoF/z5BzBaKNBaDYDLhMeScjNF6QZnDUe +k+++/l54pozl+RvQI6RljPhOzutIC5D627zfordITsBRYEhv6KPShy673H4McaRz +tx2zkflsDyPWDWmRLxA0GfD5jQvbS7aZU1R3iyi/TDXacHXlR92bzVu4AHZClOSn +fypT1h2YnUQOMMw9XlVKklHCWvgpWbVmjiBbnsIh1WjORLgSielrGP/iXVemgzEI +kaTErf7B7sx1pIMyQ8IFdniFryUSuGDvOV4Dt/PZhxh2oKIBIaVYwrl3jQvYlyNv +vpBD6MU2wXU4iP7kt9SN63RjzQoYk7TA7f9JlfXlBrjjwSjPYB1R+MoEfovvEr4j +PHghYnwtwZ4Ok3kR+zxR/M37iJ252IDkOwTuqEXWQMlOlxIeESlh1OYKVLptZwgB +0mFzzx4JapkHP34c4ntsFc3AbUh8uSt67zLJ7JDFhSQ6ltNu1/92nOjXh5tzwGvo +ak5lrUpi2zrgyxSgF7fxOxjXr604f7yxOcoWfXQd354dUXdxrMZigh3ajwsGwXxh +o5Zv+EVXaIpnHnUYmupJwrKQR1ffdVCPlvys99/BlGnvsBzLx+hmut1pjnFwQCPf +aj8Z3NhSdWspQiUzWm+DXpqPKt+4CL5mdxcjyye9ATOPf+30iuY25WvwelT4rgGt +NS0iVMJSHnPVMlcibCwVtCl8hvjzq2TYHGo6cCKDaYJ4+Hy6MjgNrHA011HkJ9iC +P4Ysyq04/OiFPrl0RS+om29By+4/O+w1t0HpuZIFTm6oRg7zWcXtDWkfrhu9WY7e +m7FI8O2f3ezPoMbiRJmdEi0RFsgyqkTdQLOUUF1ad5ZHEAVghsgvaPG5aRLhXQin +gqNvHlDmpekOTDLbEn9cyDf5po45LrUgGOBp6DK+AGb6SymjonNxczlG/eNYHtch +AXBdz5A/n6uP1DXfmGVyI6kZKU+Fotsly5Iov6SLcEicLcfA2oKHK6AIJL+IWGGL +kkShWx0Dv/2UbEkKDjFl36Z0oD5wSW6fyYeslD4IFCjXwkdgWd7l4nreisW9YTl/ +PdnVOBq6yQxfK0WlAxfGzAabmknIXkSE/BlTb5y8q92U3tR3YFLFQ1hPaSPIokIu +Op51DMXOfrbnd1iBrybduktdljoxlcAGmg5Dfz+s9fdkESQfw6oNOP5cHxfctAy9 +k21dKvkI/PqWkgwVv94wX8bWx0LgC0aV3F62qM+Y7/r5N4ZsD76GY7VFIFeSoPKx +Fn9yZOl8JzszvlWNtG7G6DwBL+ZyHS0rM7UEyTwWp8mLasEO96V6dYxD8LqWNbo4 +hY/6xsZOtNDsPdW/Os7MBD+Wf2fL/gzrD7QJyqcy41K8Oxhn2W+Aso3s9DnJ4eSt +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..9d298e183 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey-aes128.pem "gOQHdrSWeFuiZtYPetWuyzHW" diff --git a/testing/tests/ikev2/strong-keys-certs/posttest.dat b/testing/tests/ikev2/strong-keys-certs/posttest.dat new file mode 100644 index 000000000..9ccbaa1c2 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/posttest.dat @@ -0,0 +1,13 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +moon::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/private/* +dave::rm /etc/ipsec.d/private/* +moon::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/certs/* +dave::rm /etc/ipsec.d/certs/* + diff --git a/testing/tests/ikev2/strong-keys-certs/pretest.dat b/testing/tests/ikev2/strong-keys-certs/pretest.dat new file mode 100644 index 000000000..de51ccdfa --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/pretest.dat @@ -0,0 +1,10 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/strong-keys-certs/test.conf b/testing/tests/ikev2/strong-keys-certs/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/wildcards/description.txt b/testing/tests/ikev2/wildcards/description.txt new file mode 100644 index 000000000..e485f7066 --- /dev/null +++ b/testing/tests/ikev2/wildcards/description.txt @@ -0,0 +1,8 @@ +The VPN gateway <b>moon</b> controls the access to the hosts <b>alice</b> and +<b>venus</b> by means of wildcard parameters that must match the subject +<b>Distinguished Name</b> contained in the peer's X.509 certificate. Access to +<b>alice</b> is granted for DNs containing a OU=Research field whereas <b>venus</b> +can only be reached with a DN containing OU=Accounting. The roadwarriors +<b>carol</b> and <b>dave</b> belong to the departments 'Research' and 'Accounting', +respectively. Therefore <b>carol</b> can access <b>alice</b> and <b>dave</b> +can reach <b>venus</b>. diff --git a/testing/tests/ikev2/wildcards/evaltest.dat b/testing/tests/ikev2/wildcards/evaltest.dat new file mode 100644 index 000000000..2bc83eacd --- /dev/null +++ b/testing/tests/ikev2/wildcards/evaltest.dat @@ -0,0 +1,8 @@ +carol::ipsec status::alice.*PH_IP_CAROL.*PH_IP_ALICE::YES +moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_CAROL::YES +carol::ipsec status::venus.*PH_IP_CAROL.*PH_IP_VENUS::NO +moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_CAROL::NO +dave::ipsec status::venus.*PH_IP_DAVE.*PH_IP_VENUS::YES +moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_DAVE::YES +dave::ipsec status::alice.*PH_IP_DAVE.*PH_IP_ALICE::NO +moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_DAVE::NO diff --git a/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..59d41eb27 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..81e86e823 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..366e1fa9a --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn alice + leftsubnet=PH_IP_ALICE/32 + right=%any + rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*" + auto=add + +conn venus + leftsubnet=PH_IP_VENUS/32 + right=%any + rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*" + auto=add + diff --git a/testing/tests/ikev2/wildcards/posttest.dat b/testing/tests/ikev2/wildcards/posttest.dat new file mode 100644 index 000000000..ed530f6d9 --- /dev/null +++ b/testing/tests/ikev2/wildcards/posttest.dat @@ -0,0 +1,3 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop diff --git a/testing/tests/ikev2/wildcards/pretest.dat b/testing/tests/ikev2/wildcards/pretest.dat new file mode 100644 index 000000000..e3da87520 --- /dev/null +++ b/testing/tests/ikev2/wildcards/pretest.dat @@ -0,0 +1,9 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 1 +carol::ipsec up alice +carol::ipsec up venus +dave::ipsec up venus +dave::ipsec up alice diff --git a/testing/tests/ikev2/wildcards/test.conf b/testing/tests/ikev2/wildcards/test.conf new file mode 100644 index 000000000..08e5cc145 --- /dev/null +++ b/testing/tests/ikev2/wildcards/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/host2host-ikev1/description.txt b/testing/tests/ipv6/host2host-ikev1/description.txt new file mode 100644 index 000000000..c59b32acb --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/description.txt @@ -0,0 +1,3 @@ +An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up. +The authentication is based on X.509 certificates. In order to test the host-to-host tunnel +<b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command. diff --git a/testing/tests/ipv6/host2host-ikev1/evaltest.dat b/testing/tests/ipv6/host2host-ikev1/evaltest.dat new file mode 100644 index 000000000..62fc85953 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec status::host-host.*STATE_QUICK_I2.*IPsec SA established::YES +sun::ipsec status::host-host.*STATE_QUICK_R2.*IPsec SA established::YES +moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES +sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES +sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..9499140c5 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn net-net + also=host-host + leftsubnet=fec1::0/16 + rightsubnet=fec2::0/16 + +conn host-host + left=PH_IP6_MOON + leftnexthop=0::0 + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP6_SUN + rightnexthop=0::0 + rightid=@sun.strongswan.org + auto=add + diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/ipsec.conf index 58e2f1e5b..c64904a6e 100755 --- a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -13,17 +12,18 @@ conn %default rekeymargin=3m keyingtries=1 -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=myCert.pem - leftid=carol@strongswan.org +conn net-net + also=host-host + leftsubnet=fec2::0/16 + rightsubnet=fec1::0/16 + +conn host-host + left=PH_IP6_SUN + leftnexthop=0::0 + leftcert=sunCert.pem + leftid=@sun.strongswan.org leftfirewall=yes - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 + right=PH_IP6_MOON + rightnexthop=0::0 rightid=@moon.strongswan.org auto=add - - - - diff --git a/testing/tests/ipv6/host2host-ikev1/posttest.dat b/testing/tests/ipv6/host2host-ikev1/posttest.dat new file mode 100644 index 000000000..dff181797 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +sun::ipsec stop diff --git a/testing/tests/ipv6/host2host-ikev1/pretest.dat b/testing/tests/ipv6/host2host-ikev1/pretest.dat new file mode 100644 index 000000000..4707af077 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +sun::ipsec start +moon::sleep 2 +moon::ipsec up host-host diff --git a/testing/tests/ipv6/host2host-ikev1/test.conf b/testing/tests/ipv6/host2host-ikev1/test.conf new file mode 100644 index 000000000..cf2e704fd --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/host2host-ikev2/description.txt b/testing/tests/ipv6/host2host-ikev2/description.txt new file mode 100644 index 000000000..c59b32acb --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/description.txt @@ -0,0 +1,3 @@ +An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up. +The authentication is based on X.509 certificates. In order to test the host-to-host tunnel +<b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command. diff --git a/testing/tests/ipv6/host2host-ikev2/evaltest.dat b/testing/tests/ipv6/host2host-ikev2/evaltest.dat new file mode 100644 index 000000000..8b5ee4f6c --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec status::host-host.*ESTABLISHED::YES +sun::ipsec status::ESTABLISHED::YES +moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES +sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES +sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..44c85068e --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + also=host-host + leftsubnet=fec1::0/16 + rightsubnet=fec2::0/16 + +conn host-host + left=PH_IP6_MOON + leftnexthop=0::0 + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP6_SUN + rightnexthop=0::0 + rightid=@sun.strongswan.org + auto=add + diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..8b3858b30 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + also=host-host + leftsubnet=fec2::0/16 + rightsubnet=fec1::0/16 + +conn host-host + left=PH_IP6_SUN + leftnexthop=0::0 + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + right=PH_IP6_MOON + rightnexthop=0::0 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ipv6/host2host-ikev2/posttest.dat b/testing/tests/ipv6/host2host-ikev2/posttest.dat new file mode 100644 index 000000000..dff181797 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +sun::ipsec stop diff --git a/testing/tests/ipv6/host2host-ikev2/pretest.dat b/testing/tests/ipv6/host2host-ikev2/pretest.dat new file mode 100644 index 000000000..4707af077 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +sun::ipsec start +moon::sleep 2 +moon::ipsec up host-host diff --git a/testing/tests/ipv6/host2host-ikev2/test.conf b/testing/tests/ipv6/host2host-ikev2/test.conf new file mode 100644 index 000000000..cf2e704fd --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/mode-config-push/posttest.dat b/testing/tests/mode-config-push/posttest.dat deleted file mode 100644 index 932b319a7..000000000 --- a/testing/tests/mode-config-push/posttest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 -dave::ip addr del PH_IP1_DAVE/32 dev eth0 diff --git a/testing/tests/mode-config-swapped/posttest.dat b/testing/tests/mode-config-swapped/posttest.dat deleted file mode 100644 index 932b319a7..000000000 --- a/testing/tests/mode-config-swapped/posttest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 -dave::ip addr del PH_IP1_DAVE/32 dev eth0 diff --git a/testing/tests/mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/mode-config/hosts/dave/etc/ipsec.conf deleted file mode 100755 index da601389c..000000000 --- a/testing/tests/mode-config/hosts/dave/etc/ipsec.conf +++ /dev/null @@ -1,30 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - -conn home - left=PH_IP_DAVE - leftsourceip=%modeconfig - leftnexthop=%direct - leftcert=daveCert.pem - leftid=dave@strongswan.org - leftfirewall=yes - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add - - - - diff --git a/testing/tests/mode-config/posttest.dat b/testing/tests/mode-config/posttest.dat deleted file mode 100644 index 932b319a7..000000000 --- a/testing/tests/mode-config/posttest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 -dave::ip addr del PH_IP1_DAVE/32 dev eth0 diff --git a/testing/tests/net2net-psk/posttest.dat b/testing/tests/net2net-psk/posttest.dat deleted file mode 100644 index 52979508d..000000000 --- a/testing/tests/net2net-psk/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L -moon::ipsec stop -sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-route/posttest.dat b/testing/tests/net2net-route/posttest.dat deleted file mode 100644 index 52979508d..000000000 --- a/testing/tests/net2net-route/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L -moon::ipsec stop -sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-rsa/posttest.dat b/testing/tests/net2net-rsa/posttest.dat deleted file mode 100644 index 52979508d..000000000 --- a/testing/tests/net2net-rsa/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L -moon::ipsec stop -sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-start/posttest.dat b/testing/tests/net2net-start/posttest.dat deleted file mode 100644 index 52979508d..000000000 --- a/testing/tests/net2net-start/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L -moon::ipsec stop -sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/protoport-route/posttest.dat b/testing/tests/protoport-route/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/protoport-route/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-cert/posttest.dat b/testing/tests/rw-cert/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/rw-cert/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-fqdn-named/posttest.dat b/testing/tests/rw-psk-fqdn-named/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/rw-psk-fqdn-named/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-fqdn/posttest.dat b/testing/tests/rw-psk-fqdn/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/rw-psk-fqdn/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-ipv4/posttest.dat b/testing/tests/rw-psk-ipv4/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/rw-psk-ipv4/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/starter-also/posttest.dat b/testing/tests/starter-also/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/starter-also/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf b/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf deleted file mode 100755 index 598997b45..000000000 --- a/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,30 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - -conn home - left=PH_IP_CAROL - leftsourceip=%modeconfig - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - leftfirewall=yes - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add - - - - diff --git a/testing/tests/virtual-ip-swapped/posttest.dat b/testing/tests/virtual-ip-swapped/posttest.dat deleted file mode 100644 index ac5c7dd82..000000000 --- a/testing/tests/virtual-ip-swapped/posttest.dat +++ /dev/null @@ -1,7 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 diff --git a/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf b/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf deleted file mode 100755 index 2f1170a6b..000000000 --- a/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,30 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - -conn home - left=PH_IP_CAROL - leftsourceip=PH_IP1_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - leftfirewall=yes - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add - - - - diff --git a/testing/tests/virtual-ip/posttest.dat b/testing/tests/virtual-ip/posttest.dat deleted file mode 100644 index ac5c7dd82..000000000 --- a/testing/tests/virtual-ip/posttest.dat +++ /dev/null @@ -1,7 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 |