done
# Put DER-encoded moon private key and Root CA certificate into tkm scenarios
-for t in host2host-initiator host2host-responder host2host-xfrmproxy \
- multi-level-ca net2net-initiator net2net-xfrmproxy xfrmproxy-expire \
- xfrmproxy-rekey
+for t in host2host-initiator host2host-initiator-multi-ke host2host-responder \
+ host2host-responder-multi-ke host2host-xfrmproxy multi-level-ca \
+ net2net-initiator net2net-xfrmproxy xfrmproxy-expire xfrmproxy-rekey
do
TEST="${TEST_DIR}/tkm/${t}"
mkdir -p ${TEST}/hosts/moon/${TKM_DIR}
# TKM CA ID mapping #
################################################################################
-for t in host2host-initiator host2host-responder host2host-xfrmproxy \
- multi-level-ca net2net-initiator net2net-xfrmproxy xfrmproxy-expire \
- xfrmproxy-rekey
+for t in host2host-initiator host2host-initiator-multi-ke host2host-responder \
+ host2host-responder-multi-ke host2host-xfrmproxy multi-level-ca \
+ net2net-initiator net2net-xfrmproxy xfrmproxy-expire xfrmproxy-rekey
do
for h in moon
do
--- /dev/null
+A connection between the hosts <b>moon</b> and <b>sun</b> is set up using
+multiple key exchanges. The host <b>moon</b> uses the Trusted Key Manager (TKM)
+and is the initiator of the transport connection. The authentication is based
+on X.509 certificates. Rekeyings are initiated by <b>moon</b> for both the IKE
+and the ESP SA to test rekeying with multiple key exchanges.
--- /dev/null
+moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
+sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
+moon::swanctl --rekey --ike conn1
+moon::sleep 1
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
+moon::swanctl --rekey --child conn1
+moon::sleep 1
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::3
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::3
+moon::cat /tmp/tkm.log::Updating ISA context with ID 1 (KE 1)::YES
+moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
+moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
+moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
+moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
+moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
+moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
+moon::cat /tmp/tkm.log::Creating new child ISA context with ID 2 (Parent Isa 1, KE 1 #1 / 2, nonce 1, spi_loc.*::YES
+moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 2, Sp 1, Ea 1, Ke_Id 1 #1 / 2, Nc_Loc_Id 1, Initiator TRUE, spi_loc.*::YES
+moon::swanctl --terminate --ike conn1 && sleep 1::no output expected::NO
+moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES
+moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
+moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
--- /dev/null
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon-tkm {
+ ke_mapping {
+ 15 = 1
+ 16 = 2
+ }
+ ca_mapping {
+ strongswan_ca {
+ id = 1
+ fingerprint = CA_SPK_HEX
+ }
+ }
+ start-scripts {
+ swanctl = /usr/local/sbin/swanctl --load-all --noprompt
+ }
+}
--- /dev/null
+# pre-generated and modified as tkm_cfgtool doesn't support multiple KEs yet
+
+connections {
+ conn1 {
+ local_addrs=192.168.0.1
+ remote_addrs=192.168.0.2
+ proposals=aes256-sha512-modp3072-ke1_modp4096
+ local {
+ id=moon.strongswan.org
+ certs=moonCert.pem
+ }
+ remote {
+ id=sun.strongswan.org
+ }
+ children {
+ conn1 {
+ reqid=1
+ life_time=60
+ rekey_time=30
+ mode=transport
+ esp_proposals=aes256-sha512-modp3072-ke1_modp4096
+ start_action=trap
+ }
+ }
+ }
+}
--- /dev/null
+<tkmconfig>
+ <local_identity id="1">
+ <identity>moon.strongswan.org</identity>
+ <certificate>moonCert.pem</certificate>
+ </local_identity>
+ <policy id="1">
+ <mode>transport</mode>
+ <local>
+ <identity_id>1</identity_id>
+ <ip>192.168.0.1</ip>
+ </local>
+ <remote>
+ <identity>sun.strongswan.org</identity>
+ <ip>192.168.0.2</ip>
+ </remote>
+ <lifetime>
+ <soft>30</soft>
+ <hard>60</hard>
+ </lifetime>
+ </policy>
+</tkmconfig>
--- /dev/null
+connections {
+
+ host-host {
+ proposals = aes256-sha512-modp3072-ke1_modp4096
+
+ local {
+ auth = pubkey
+ certs = sunCert.pem
+ id = sun.strongswan.org
+ }
+ remote {
+ auth = pubkey
+ id = moon.strongswan.org
+ }
+ children {
+ host-host {
+ mode = transport
+ esp_proposals = aes256-sha512-modp3072-ke1_modp4096
+ }
+ }
+ }
+}
--- /dev/null
+moon::service charon-tkm stop
+moon::killall tkm_keymanager
+moon::rm -f /tmp/swanctl.conf /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
+sun::systemctl stop strongswan
--- /dev/null
+moon::rm /etc/swanctl/rsa/*
+# swanctl.conf is not generated as tkm_cfgtool doesn't support multiple KEs yet
+moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /tmp/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
+moon::cat /etc/swanctl/swanctl.conf
+moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
+moon::expect-file /tmp/tkm.rpc.ike
+moon::service charon-tkm start
+sun::systemctl start strongswan
+sun::expect-connection host-host
+moon::expect-connection conn1
+moon::swanctl --initiate --child conn1 2> /dev/null
--- /dev/null
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="moon winnetou sun"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
+
+# charon controlled by swanctl
+#
+SWANCTL=1
--- /dev/null
+A connection between the hosts <b>moon</b> and <b>sun</b> is set up using
+multiple key exchanges. The host <b>moon</b> uses the Trusted Key Manager (TKM)
+and is the responder of the transport connection. The authentication is based
+on X.509 certificates. Rekeyings are initiated by <b>sun</b> for both the IKE
+and the ESP SA to test rekeying with multiple key exchanges.
--- /dev/null
+moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
+sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072 ake1=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
+sun::swanctl --rekey --ike host-host
+sun::sleep 1
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
+sun::swanctl --rekey --child host-host
+sun::sleep 1
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::3
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::3
+moon::cat /tmp/tkm.log::Updating ISA context with ID 1 (KE 1)::YES
+moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
+moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
+moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
+moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
+moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
+moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::YES
+moon::cat /tmp/tkm.log::Creating new child ISA context with ID 2 (Parent Isa 1, KE 1 #1 / 2, nonce 1, spi_loc.*::YES
+moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 2, Sp 1, Ea 1, Ke_Id 1 #1 / 2, Nc_Loc_Id 1, Initiator FALSE, spi_loc.*::YES
--- /dev/null
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon-tkm {
+ ke_mapping {
+ 15 = 1
+ 16 = 2
+ }
+ ca_mapping {
+ strongswan_ca {
+ id = 1
+ fingerprint = CA_SPK_HEX
+ }
+ }
+ start-scripts {
+ swanctl = /usr/local/sbin/swanctl --load-all --noprompt
+ }
+}
--- /dev/null
+# pre-generated and modified as tkm_cfgtool doesn't support multiple KEs yet
+
+connections {
+ conn1 {
+ local_addrs=192.168.0.1
+ remote_addrs=192.168.0.2
+ proposals=aes256-sha512-modp3072-ke1_modp4096
+ local {
+ id=moon.strongswan.org
+ certs=moonCert.pem
+ }
+ remote {
+ id=sun.strongswan.org
+ }
+ children {
+ conn1 {
+ reqid=1
+ life_time=60
+ rekey_time=30
+ mode=transport
+ esp_proposals=aes256-sha512-modp3072-ke1_modp4096
+ start_action=trap
+ }
+ }
+ }
+}
--- /dev/null
+<tkmconfig>
+ <local_identity id="1">
+ <identity>moon.strongswan.org</identity>
+ <certificate>moonCert.pem</certificate>
+ </local_identity>
+ <policy id="1">
+ <mode>transport</mode>
+ <local>
+ <identity_id>1</identity_id>
+ <ip>192.168.0.1</ip>
+ </local>
+ <remote>
+ <identity>sun.strongswan.org</identity>
+ <ip>192.168.0.2</ip>
+ </remote>
+ <lifetime>
+ <soft>30</soft>
+ <hard>60</hard>
+ </lifetime>
+ </policy>
+</tkmconfig>
--- /dev/null
+connections {
+
+ host-host {
+ local_addrs = PH_IP_SUN
+ remote_addrs = PH_IP_MOON
+
+ proposals = aes256-sha512-modp3072-ke1_modp4096
+
+ local {
+ auth = pubkey
+ certs = sunCert.pem
+ id = sun.strongswan.org
+ }
+ remote {
+ auth = pubkey
+ id = moon.strongswan.org
+ }
+ children {
+ host-host {
+ mode = transport
+ esp_proposals = aes256-sha512-modp3072-ke1_modp4096
+ }
+ }
+ }
+}
--- /dev/null
+moon::service charon-tkm stop
+moon::killall tkm_keymanager
+moon::cat /tmp/tkm.log
+moon::rm -f /tmp/swanctl.conf /tmp/tkm.rpc.ike /tmp/tkm.rpc.ees /tmp/tkm.log
+sun::systemctl stop strongswan
--- /dev/null
+moon::rm /etc/swanctl/rsa/*
+# swanctl.conf is not generated as tkm_cfgtool doesn't support multiple KEs yet
+moon::tkm_cfgtool -c /etc/tkm/tkm.conf -i /tmp/swanctl.conf -t /etc/tkm/tkm.bin -s /usr/local/share/tkm/tkmconfig.xsd
+moon::cat /etc/swanctl/swanctl.conf
+moon::tkm_keymanager -c /etc/tkm/tkm.bin -k /etc/tkm/moonKey.der -r /etc/tkm/strongswanCert.der:1 >/tmp/tkm.log 2>&1 &
+moon::expect-file /tmp/tkm.rpc.ike
+moon::service charon-tkm start
+sun::systemctl start strongswan
+sun::expect-connection host-host
+moon::expect-connection conn1
+sun::swanctl --initiate --child host-host 2> /dev/null
--- /dev/null
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="moon winnetou sun"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
+
+# charon controlled by swanctl
+#
+SWANCTL=1
projects / thirdparty / strongswan.git / commitdiff
