testing: Add a failing client to the ikev2/rw-eap-tls-only scenario

diff --git a/testing/tests/ikev2/rw-eap-tls-only/description.txt b/testing/tests/ikev2/rw-eap-tls-only/description.txt
index b3e0450a41809a23efbb62060b516dd426d5b4c7..5eb08a8b3a01d8edd4fbb1530b039e945d398339 100644 (file)
--- a/testing/tests/ikev2/rw-eap-tls-only/description.txt
+++ b/testing/tests/ikev2/rw-eap-tls-only/description.txt
@@ -2,3 +2,6 @@ The roadwarrior <b>carol</b> sets up a connection to gateway <b>moon</b>.
 The strong mutual authentication of both peers is based on <b>EAP-TLS</b> only
 (without a separate IKEv2 authentication), using TLS client and server certificates,
 respectively.
+<br>
+The roadwarrior <b>dave</b> doesn't have the appropriate CA certificate installed
+and, therefore, doesn't trust gateway <b>moon</b>'s certificate and rejects it.

diff --git a/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat
index c9f34629307b4c45d88513635d89f8f963d704b5..c63f91b7424423b6a67d1aacf5b0e74e7ed0c388 100644 (file)
--- a/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat
@@ -2,7 +2,11 @@ carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
 carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
 carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384::YES
 carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
+dave::cat /var/log/daemon.log::no issuer certificate found for \"C=CH, O=strongSwan Project, CN=moon.strongswan.org\"::YES
+dave::cat /var/log/daemon.log::no TLS public key found for server 'C=CH, O=strongSwan Project, CN=moon.strongswan.org'::YES
+dave::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::NO
 moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org' with EAP successful::YES
+moon:: cat /var/log/daemon.log::EAP method EAP_TLS failed for peer C=CH, O=strongSwan Project, OU=Accounting, CN=dave@strongswan.org::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
 carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=C=CH, O=strongSwan Project, CN=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
 moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-eap.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=C=CH, O=strongSwan Project, CN=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES

diff --git a/testing/tests/ikev2/rw-eap-tls-only/hosts/dave/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-tls-only/hosts/dave/etc/strongswan.conf
new file mode 100644 (file)
index 0000000..f6a7f57
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-tls-only/hosts/dave/etc/strongswan.conf
@@ -0,0 +1,16 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 mgf1 gmp x509 curl revocation hmac kdf gcm vici kernel-netlink socket-default eap-tls updown
+
+  multiple_authentication=no
+  syslog {
+    daemon {
+      tls = 2
+    }
+  }
+}

diff --git a/testing/tests/ikev2/rw-eap-tls-only/hosts/dave/etc/swanctl/swanctl.conf b/testing/tests/ikev2/rw-eap-tls-only/hosts/dave/etc/swanctl/swanctl.conf
new file mode 100755 (executable)
index 0000000..0a5b3af
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-tls-only/hosts/dave/etc/swanctl/swanctl.conf
@@ -0,0 +1,27 @@
+connections {
+
+   home {
+      local_addrs  = 192.168.0.200
+      remote_addrs = 192.168.0.1
+
+      local {
+         auth = eap-tls
+         certs = daveCert.pem
+      }
+      remote {
+         auth = eap-tls
+         id = "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
+      }
+      children {
+         home {
+            remote_ts = 10.1.0.0/16
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      send_certreq = no
+      proposals = aes128-sha256-x25519
+   }
+}

diff --git a/testing/tests/ikev2/rw-eap-tls-only/posttest.dat b/testing/tests/ikev2/rw-eap-tls-only/posttest.dat
index af9cda6cafd7428b45e9ab69dc8f50856ff4c707..d73e56aa9c970718460b8fe86a45dc73bed11dc7 100644 (file)
--- a/testing/tests/ikev2/rw-eap-tls-only/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-only/posttest.dat
@@ -1,5 +1,7 @@
+dave::systemctl stop strongswan
 carol::swanctl --terminate --ike home
 carol::systemctl stop strongswan
 moon::systemctl stop strongswan
-moon::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
+moon::iptables-restore < /etc/iptables.flush

diff --git a/testing/tests/ikev2/rw-eap-tls-only/pretest.dat b/testing/tests/ikev2/rw-eap-tls-only/pretest.dat
index 1e8e27fdf4f14df5fb1744766230da810fdedd96..dc2fb7872681711e49955766dac364fdb951d849 100644 (file)
--- a/testing/tests/ikev2/rw-eap-tls-only/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-only/pretest.dat
@@ -1,7 +1,12 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+dave::rm /etc/swanctl/x509ca/*
 moon::systemctl start strongswan
 carol::systemctl start strongswan
+dave::systemctl start strongswan
 moon::expect-connection rw-eap
 carol::expect-connection home
+dave::expect-connection home
 carol::swanctl --initiate --child home 2> /dev/null
+dave::swanctl --initiate --child home 2> /dev/null

diff --git a/testing/tests/ikev2/rw-eap-tls-only/test.conf b/testing/tests/ikev2/rw-eap-tls-only/test.conf
index 97b89cb611f3c503b17a66dd80ef8258006eada8..9e490833463c94c9e06687659c3a3eb4a2564743 100644 (file)
--- a/testing/tests/ikev2/rw-eap-tls-only/test.conf
+++ b/testing/tests/ikev2/rw-eap-tls-only/test.conf
@@ -5,11 +5,11 @@
 
 # All guest instances that are required for this test
 #
-VIRTHOSTS="alice carol moon"
+VIRTHOSTS="alice carol dave moon"
 
 # Corresponding block diagram
 #
-DIAGRAM="a-m-c.png"
+DIAGRAM="a-m-c-w-d.png"
 
 # Guest instances on which tcpdump is to be started
 #
@@ -18,7 +18,7 @@ TCPDUMPHOSTS="moon"
 # Guest instances on which IPsec is started
 # Used for IPsec logging purposes
 #
-IPSECHOSTS="moon carol"
+IPSECHOSTS="moon carol dave"
 
 # charon controlled by swanctl
 #