diff options
author | Andreas Steffen <andreas.steffen@strongswan.org> | 2007-03-21 22:19:00 +0000 |
---|---|---|
committer | Andreas Steffen <andreas.steffen@strongswan.org> | 2007-03-21 22:19:00 +0000 |
commit | d8d948a7e015d33d7834ba78a914e597b98d44ee (patch) | |
tree | e929c3d30925129481f4667e9935dcb3ca76fa08 /testing/tests/ikev2 | |
parent | 878aecdf126b9741d2cda58fa9cc21dc3497b797 (diff) | |
download | strongswan-d8d948a7e015d33d7834ba78a914e597b98d44ee.tar.bz2 strongswan-d8d948a7e015d33d7834ba78a914e597b98d44ee.tar.xz |
added
Diffstat (limited to 'testing/tests/ikev2')
7 files changed, 99 insertions, 0 deletions
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt new file mode 100644 index 000000000..d17534b1b --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt @@ -0,0 +1,7 @@ +This scenario is based on <a href="../ocsp-signer-cert">ikev2/ocsp-signer-cert</a> +and tests the timeouts of the <b>libcurl</b> library used for http-based OCSP fetching +by adding an ocspuri1 in <b>moon</b>'s strongswan ca section on which no OCSP +server is listening and an ocspuri2 that cannot be resolved by <b>DNS</b>. +Since the certificate status is <b>unknown</b> the connection setup is aborted by +<b>moon</b> with an <b>AUTHORIZATION_FAILED</b> notification sent to <b>carol</b>. + diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat new file mode 100644 index 000000000..802e0b905 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::http post request to.*using libcurl failed::YES +moon::cat /var/log/daemon.log::certificate status unknown::YES +carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO + diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..cdc1560ae --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri1=http://bob.strongswan.org:8800 + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..e759d1d79 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri1=http://bob.strongswan.org:8800 + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat new file mode 100644 index 000000000..220bc2c1d --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" |