From c1343b3278cdf99533b7902744d15969f9d6fdc1 Mon Sep 17 00:00:00 2001 From: Yves-Alexis Perez Date: Wed, 2 Jan 2013 14:18:20 +0100 Subject: Imported Upstream version 5.0.1 --- testing/tests/gcrypt-ikev1/alg-twofish/description.txt | 2 +- testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat | 16 +++++++++------- .../gcrypt-ikev1/alg-twofish/hosts/carol/etc/ipsec.conf | 8 ++------ .../alg-twofish/hosts/carol/etc/strongswan.conf | 7 +++---- .../gcrypt-ikev1/alg-twofish/hosts/moon/etc/ipsec.conf | 10 +++------- .../alg-twofish/hosts/moon/etc/strongswan.conf | 7 +++---- testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat | 2 +- 7 files changed, 22 insertions(+), 30 deletions(-) mode change 100755 => 100644 testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/ipsec.conf mode change 100755 => 100644 testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/ipsec.conf (limited to 'testing/tests/gcrypt-ikev1/alg-twofish') diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/description.txt b/testing/tests/gcrypt-ikev1/alg-twofish/description.txt index f3fc61fe6..e1a7403e3 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/description.txt +++ b/testing/tests/gcrypt-ikev1/alg-twofish/description.txt @@ -1,4 +1,4 @@ Roadwarrior carol proposes to gateway moon the strong cipher suite TWOFISH_CBC_256 / HMAC_SHA2_512 / MODP_4096 for the IKE protocol and -TWOFISH_CBC_256 / HMAC_SHA2_512_256 for ESP packets. A ping from carol to +TWOFISH_CBC_256 / HMAC_SHA2_512_256 for ESP packets. A ping from carol to alice successfully checks the established tunnel. diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat b/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat index c69355b81..7003977f9 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat +++ b/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat @@ -1,11 +1,13 @@ -carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES -moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES -carol::ipsec statusall::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512/MODP_4096::YES -moon::ipsec statusall::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512/MODP_4096::YES +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES +carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES +moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES +carol::ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES +moon:: ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ipsec statusall::ESP proposal: TWOFISH_CBC_256/HMAC_SHA2_512::YES -moon::ipsec statusall::ESP proposal: TWOFISH_CBC_256/HMAC_SHA2_512::YES +carol::ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES +moon:: ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES carol::ip xfrm state::enc cbc(twofish)::YES -moon::ip xfrm state::enc cbc(twofish)::YES +moon:: ip xfrm state::enc cbc(twofish)::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/ipsec.conf b/testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/ipsec.conf old mode 100755 new mode 100644 index 4c02699b7..fe1a78d62 --- a/testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/ipsec.conf +++ b/testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/ipsec.conf @@ -1,10 +1,6 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - plutodebug="control crypt" - crlcheckinterval=180 - strictcrlpolicy=no - charonstart=no conn %default ikelifetime=60m @@ -12,8 +8,8 @@ conn %default rekeymargin=3m keyingtries=1 keyexchange=ikev1 - ike=twofish256-sha2_512-modp4096! - esp=twofish256-sha2_512! + ike=twofish256-sha512-modp4096! + esp=twofish256-sha512! conn home left=PH_IP_CAROL diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/strongswan.conf b/testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/strongswan.conf index 5e09a3a1d..969a5f5aa 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/strongswan.conf +++ b/testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/strongswan.conf @@ -1,11 +1,10 @@ # /etc/strongswan.conf - strongSwan configuration file -pluto { - load = pem pkcs1 x509 gcrypt hmac curl kernel-netlink +charon { + load = curl pem pkcs1 gcrypt nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown + send_vendor_id = yes } -# pluto uses optimized DH exponent sizes (RFC 3526) - libstrongswan { dh_exponent_ansi_x9_42 = no } diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/ipsec.conf b/testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/ipsec.conf old mode 100755 new mode 100644 index d608ac2f6..b4391cd1f --- a/testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/ipsec.conf +++ b/testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/ipsec.conf @@ -1,19 +1,15 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - plutodebug="control crypt" - crlcheckinterval=180 - strictcrlpolicy=no - charonstart=no - + conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 keyexchange=ikev1 - ike=twofish256-sha2_512-modp4096! - esp=twofish256-sha2_512! + ike=twofish256-sha512-modp4096! + esp=twofish256-sha512! conn rw left=PH_IP_MOON diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/strongswan.conf b/testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/strongswan.conf index 5e09a3a1d..969a5f5aa 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/strongswan.conf +++ b/testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/strongswan.conf @@ -1,11 +1,10 @@ # /etc/strongswan.conf - strongSwan configuration file -pluto { - load = pem pkcs1 x509 gcrypt hmac curl kernel-netlink +charon { + load = curl pem pkcs1 gcrypt nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown + send_vendor_id = yes } -# pluto uses optimized DH exponent sizes (RFC 3526) - libstrongswan { dh_exponent_ansi_x9_42 = no } diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat b/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat index 7d077c126..6d2eeb5f9 100644 --- a/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat +++ b/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat @@ -1,5 +1,5 @@ moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start -carol::sleep 2 +carol::sleep 2 carol::ipsec up home -- cgit v1.2.3