From f95d5122513ab34cd1b3cffc7bb49d69932cd51c Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Thu, 28 Nov 2019 10:25:20 +0100 Subject: [PATCH] testing: Use identity based CA restrictions in rw-hash-and-url-multi-level This is a prominent example where the identity based CA constraint is benefical. While the description of the test claims a strict binding of the client to the intermediate CA, this is not fully true if CA operators are not fully trusted: A rogue OU=Sales intermediate may issue certificates containing a OU=Research. By binding the connection to the CA, we can avoid this, and using the identity based constraint still allows moon to receive the intermediate over IKE or hash-and-url. --- .../hosts/moon/etc/swanctl/swanctl.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf index 334ecb62f..a690cf2b1 100755 --- a/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf +++ b/testing/tests/swanctl/rw-hash-and-url-multi-level/hosts/moon/etc/swanctl/swanctl.conf @@ -10,7 +10,7 @@ connections { } remote { auth = pubkey - id = "C=CH, O=strongSwan Project, OU=Research, CN=*" + ca_id = "C=CH, O=strongSwan Project, OU=Research, CN=Research CA" } children { alice { @@ -32,7 +32,7 @@ connections { } remote { auth = pubkey - id = "C=CH, O=strongSwan Project, OU=Sales, CN=*" + ca_id = "C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA" } children { venus {