Commit c122a4fab1 for strongswan.org
commit c122a4fab19ec9be95b3324afa6d2d7216120940
Author: Tobias Brunner <tobias@strongswan.org>
Date: Fri Aug 28 14:42:38 2026 +0200
testing: Update TKM refs and tkm/multiple-clients scenario
In the updated scenario one client uses the legacy signature scheme with
SHA-1 while the other uses signature authentication with SHA-256.
Also changed Git URIs for codelabs repositories to their canonical form
and also switched two HTTP URIs to HTTPS.
diff --git a/src/charon-tkm/src/tkm/tkm.h b/src/charon-tkm/src/tkm/tkm.h
index 865f184c80..a730774219 100644
--- a/src/charon-tkm/src/tkm/tkm.h
+++ b/src/charon-tkm/src/tkm/tkm.h
@@ -54,7 +54,7 @@
* Since the charon-tkm code uses the tkm-rpc library written in Ada, the daemon
* has to be built using an Ada-aware toolchain. The integration of Ada code
* into the strongSwan codebase is explained in the TKM documentation, section
- * 5.4.1: http://www.codelabs.ch/tkm#anchor-doc.
+ * 5.4.1: https://www.codelabs.ch/tkm#anchor-doc.
*
* The Trusted Key Manager (TKM) is a minimal Trusted Computing Base which
* implements security-critical functions of the IKEv2 protocol.
@@ -65,7 +65,7 @@
* The underlying concept of IKE disaggregation and the design of TKM and all
* related components, of which charon-tkm is one component, is presented in
* detail in the project documentation found at
- * http://www.codelabs.ch/tkm#anchor-doc.
+ * https://www.codelabs.ch/tkm#anchor-doc.
*/
#ifndef TKM_H_
diff --git a/testing/scripts/recipes/005_anet.mk b/testing/scripts/recipes/005_anet.mk
index 2943f8ea43..b543172a2d 100644
--- a/testing/scripts/recipes/005_anet.mk
+++ b/testing/scripts/recipes/005_anet.mk
@@ -1,7 +1,7 @@
#!/usr/bin/make
PKG = anet
-SRC = https://git.codelabs.ch/git/$(PKG).git
+SRC = https://git.codelabs.ch/$(PKG).git
REV = 15b469b1e47fde41822543da5be717df195c87dc
PREFIX = /usr/local/ada
diff --git a/testing/scripts/recipes/006_tkm-rpc.mk b/testing/scripts/recipes/006_tkm-rpc.mk
index 3f930dc76d..24a766baad 100644
--- a/testing/scripts/recipes/006_tkm-rpc.mk
+++ b/testing/scripts/recipes/006_tkm-rpc.mk
@@ -1,8 +1,8 @@
#!/usr/bin/make
PKG = tkm-rpc
-SRC = https://git.codelabs.ch/git/$(PKG).git
-REV = c43c7d2a070d37e4063b83be0dc01425bf890206
+SRC = https://git.codelabs.ch/$(PKG).git
+REV = cbb96b9b834e0c9ed7ee42f369d4d6b8ef7ee64e
PREFIX = /usr/local/ada
diff --git a/testing/scripts/recipes/007_x509-ada.mk b/testing/scripts/recipes/007_x509-ada.mk
index 27f894eabd..bfc1b3ecd8 100644
--- a/testing/scripts/recipes/007_x509-ada.mk
+++ b/testing/scripts/recipes/007_x509-ada.mk
@@ -1,7 +1,7 @@
#!/usr/bin/make
PKG = x509-ada
-SRC = https://git.codelabs.ch/git/$(PKG).git
+SRC = https://git.codelabs.ch/$(PKG).git
REV = v0.1.3
PREFIX = /usr/local/ada
diff --git a/testing/scripts/recipes/008_xfrm-ada.mk b/testing/scripts/recipes/008_xfrm-ada.mk
index 6202d7bb67..50c1f5719e 100644
--- a/testing/scripts/recipes/008_xfrm-ada.mk
+++ b/testing/scripts/recipes/008_xfrm-ada.mk
@@ -1,7 +1,7 @@
#!/usr/bin/make
PKG = xfrm-ada
-SRC = https://git.codelabs.ch/git/$(PKG).git
+SRC = https://git.codelabs.ch/$(PKG).git
REV = e0590c6bb3c6a5b7f2edd8f95dce9e8c77e22230
PREFIX = /usr/local/ada
diff --git a/testing/scripts/recipes/009_xfrm-proxy.mk b/testing/scripts/recipes/009_xfrm-proxy.mk
index 094c7e27fa..04ca6b2abe 100644
--- a/testing/scripts/recipes/009_xfrm-proxy.mk
+++ b/testing/scripts/recipes/009_xfrm-proxy.mk
@@ -1,7 +1,7 @@
#!/usr/bin/make
PKG = xfrm-proxy
-SRC = https://git.codelabs.ch/git/$(PKG).git
+SRC = https://git.codelabs.ch/$(PKG).git
REV = v0.1
export ADA_PROJECT_PATH=/usr/local/ada/lib/gnat
diff --git a/testing/scripts/recipes/010_tkm.mk b/testing/scripts/recipes/010_tkm.mk
index d82f6a95c9..2356532628 100644
--- a/testing/scripts/recipes/010_tkm.mk
+++ b/testing/scripts/recipes/010_tkm.mk
@@ -1,9 +1,9 @@
#!/usr/bin/make
PKG = tkm
-SRC = https://git.codelabs.ch/git/$(PKG).git
+SRC = https://git.codelabs.ch/$(PKG).git
ifeq (,$(filter $(BASEIMG),bullseye bookworm))
-REV = 85d49c9255360663c344ccf3175092524dc66eae
+REV = f188a901f43890c58beb030c50cc953c3b47c3a7
else
REV = v0.3
endif
diff --git a/testing/tests/tkm/multiple-clients/description.txt b/testing/tests/tkm/multiple-clients/description.txt
index c8e72d51d0..59376e9268 100644
--- a/testing/tests/tkm/multiple-clients/description.txt
+++ b/testing/tests/tkm/multiple-clients/description.txt
@@ -1,5 +1,7 @@
Two transport connections to gateway <b>sun</b> are set up, one from client
<b>carol</b> and the other from client <b>dave</b>. The gateway <b>sun</b> uses
the Trusted Key Manager (TKM) and is the responder for both connections. The
-authentication is based on X.509 certificates. In order to test the connections,
-both <b>carol</b> and <b>dave</b> ping gateway <b>sun</b>.
+authentication is based on X.509 certificates. While <b>carol</b> enables
+signature authentication, <b>dave</b> does not and uses legacy signatures.
+In order to test the connections, both <b>carol</b> and <b>dave</b> ping
+gateway <b>sun</b>.
diff --git a/testing/tests/tkm/multiple-clients/evaltest.dat b/testing/tests/tkm/multiple-clients/evaltest.dat
index 52484fcde0..acd1f62964 100644
--- a/testing/tests/tkm/multiple-clients/evaltest.dat
+++ b/testing/tests/tkm/multiple-clients/evaltest.dat
@@ -8,6 +8,10 @@ carol::tcpdump::IP carol.strongswan.org > sun.strongswan.org: ESP::YES
carol::tcpdump::IP sun.strongswan.org > carol.strongswan.org: ESP::YES
dave::tcpdump::IP dave.strongswan.org > sun.strongswan.org: ESP::YES
dave::tcpdump::IP sun.strongswan.org > dave.strongswan.org: ESP::YES
+sun::cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with RSA_EMSA_PKCS1_SHA2_256 successful::YES
+sun::cat /var/log/daemon.log::authentication of 'sun.strongswan.org' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful::YES
+sun::cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES
+sun::cat /var/log/daemon.log::authentication of 'sun.strongswan.org' (myself) with RSA signature successful::YES
sun::cat /tmp/tkm.log::RSA private key '/etc/tkm/sunKey.der' loaded::YES
sun::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.2 <-> 192.168.0.100 \]::YES
sun::cat /tmp/tkm.log::Adding policy \[ 2, 192.168.0.2 <-> 192.168.0.200 \]::YES
diff --git a/testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf b/testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf
index 93762cf24a..d55fd9ddee 100644
--- a/testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf
+++ b/testing/tests/tkm/multiple-clients/hosts/dave/etc/strongswan.conf
@@ -1,9 +1,11 @@
# /etc/strongswan.conf - strongSwan configuration file
- swanctl {
+swanctl {
load = pem pkcs1 openssl random
}
charon-systemd {
load = pem pkcs1 random nonce openssl curl revocation xcbc vici kernel-netlink socket-default updown
+ # test legacy signature handling in TKM
+ signature_authentication = no
}