一. linux配置

1.编译配置：

   1.1 安装依赖库

apt install gcc make pkg-config gprbuild

apt install libsystemd-dev libtss2-dev libtss2-tcti-tabrmd-dev libcurl4-openssl-dev libssl-dev libgmp-dev

   1.2 配置

./configure --prefix=/usr --sysconfdir=/etc --disable-defaults --enable-silent-rules  \

    --enable-charon --enable-systemd --enable-ikev2 --enable-vici --enable-swanctl    \

    --enable-nonce --enable-random --enable-drbg --enable-openssl --enable-curl       \

    --enable-pem --enable-x509 --enable-constraints --enable-revocation --enable-pki  \

    --enable-pubkey --enable-socket-default --enable-kernel-netlink --enable-resolve  \

    --enable-eap-identity --enable-eap-md5 --enable-eap-dynamic --enable-eap-tls      \

    --enable-updown --enable-tss-tss2 --enable-tpm --enable-aes --enable-sha1         \

--enable-sha2 --enable-hmac --enable-kdf --enable-curve25519 --enable-des         \

--enable-md4 --enable-pkcs1 --enable-gmp --enable-stroke --enable-fips-prf        \

--enable-eap-mschapv2 --enable-sha3 --enable-chapoly --enable-mgf1 --enable-ntru  \

--enable-newhope --enable-pkcs8 --enable-xcbc --enable-cmac --enable-ctr          \

--enable-ccm --enable-gcm

  1.3 编译

 make

  1.4 安装

 sudo make install

 

2.证书生成

  2.1：生成CA证书

    pki --gen --type rsa --size 3072 --outform pem > strongswanKey.pem

pki --self --type rsa --in strongswanKey.pem --lifetime 3652 \

 --ca --pathlen 1 --dn "C=CH, O=strongSwan Project, CN=strongSwan Root CA" \

 --outform pem > strongswanCert.pem

  2.2：生成moon证书：（用一样的CA证书）

    pki --gen --type rsa --size 3072 --outform pem > moonKey.pem

pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --type rsa \

 --in moonKey.pem --lifetime 1826 --san moon.strongswan.org \

 --serial 03 --dn "C=CH, O=strongSwan Project, CN=moon.strongswan.org" \

 --outform pem > moonCert.pem

  2.3：生成carol证书：（用一样的CA证书）

    pki --gen --type rsa --size 3072 --outform pem > carolKey.pem

pki --issue --cakey strongswanKey.pem --cacert strongswanCert.pem --type rsa \

 --in carolKey.pem --lifetime 1826 --san carol@strongswan.org \

 --serial 01 --dn "C=CH, O=strongSwan Project, CN=carol@strongswan.org" \

 --outform pem > carolCert.pem

 

 

二. Linux操作流程：ipsec命令

1. moon

   1.1、将strongswanCert.pem推到/etc/ipsec.d/cacerts/目录下

      eg：sudo cp strongswanCert.pem /etc/ipsec.d/cacerts/

   1.2、将moonCert.pem推到/etc/ipsec.d/certs/目录下

      eg：sudo cp moonCert.pem /etc/ipsec.d/certs/

   1.3、将moonKey.pem推到/etc/ipsec.d/private/目录下

 

        eg：sudo cp moonKey.pem /etc/ipsec.d/private/

   1.4、rsa的按照moon的ipsec.conf、ipsec.secrets、strongwan.conf来配置文件，在/etc目录下，链接：

      https://www.strongswan.org/testing/testresults/ikev2-stroke/rw-cert/

   1.5、psk的按照moon的ipsec.conf、ipsec.secrets、strongwan.conf来配置文件，在/etc目录下，链接：

      https://www.strongswan.org/testing/testresults/ikev2-stroke/rw-psk-ipv4/ 

   1.6、mschapv2的按照moon的ipsec.conf、ipsec.secrets、strongwan.conf来配置文件，在/etc目录下，链接：

     https://www.strongswan.org/testing/testresults/ikev2-stroke/rw-eap-mschapv2-id-rsa/ 

   1.7、启动ipsec

      sudo ipsec restart

 

2. carol：

   2.1、将strongswanCert.pem推到/etc/ipsec.d/cacerts/目录下

      eg：sudo cp strongswanCert.pem /etc/ipsec.d/cacerts/

   2.2、将carolCert.pem推到/etc/ipsec.d/certs/目录下

      eg：sudo cp carolCert.pem /etc/ipsec.d/certs/

   2.3、将carolKey.pem推到/etc/ipsec.d/private/目录下

      eg：sudo cp carolKey.pem /etc/ipsec.d/private/

   2.4、rsa的按照carol的ipsec.conf、ipsec.secrets、strongwan.conf来配置文件，在/etc目录下，链接：

      https://www.strongswan.org/testing/testresults/ikev2-stroke/rw-cert/

   2.5、psk的按照carol的ipsec.conf、ipsec.secrets、strongwan.conf来配置文件，在/etc目录下，链接：

      https://www.strongswan.org/testing/testresults/ikev2-stroke/rw-psk-ipv4/ 

   2.6、mschapv2的按照carol的ipsec.conf、ipsec.secrets、strongwan.conf来配置文件，在/etc目录下，链接：

     https://www.strongswan.org/testing/testresults/ikev2-stroke/rw-eap-mschapv2-id-rsa/ 

   2.7、启动ipsec

      sudo ipsec restart

      sudo ipsec up home

      然后测试ping 10.1.0.1可以ping通

3. 7885手机操作流程

1. 将CA证书推到/data/service/el1/public/vpn/目录下

   eg：hdc file send E:\vpn\strongswanCert.pem /data/service/el1/public/vpn/

2. 在/system/etc/strongswan/创建ipsec.d目录，并在其目录下创建certs cacerts private acerts reqs ocspcerts aacerts crls目录

hdc shell mount -o rw,remount /

hdc shell

mkdir /system/etc/strongswan/ipsec.d

cd /system/etc/strongswan/ipsec.d

mkdir certs cacerts private acerts reqs ocspcerts aacerts crls

exit

3. 将carolCert.pem证书放到/system/etc/strongswan/ipsec.d/certs目录下

   eg：hdc file send E:\vpn\carolCert.pem /system/etc/strongswan/ipsec.d/certs

4. 将carolKey.pem证书放到/system/etc/strongswan/ipsec.d/certs目录下

   eg：hdc file send E:\vpn\carolKey.pem /system/etc/strongswan/ipsec.d/private

5. 需要测试哪个协议，就将rsa、psk、mschapv2对应目录下的ipsec.conf、ipsec.secrets.conf、strongswan.conf三个文件推到/data/service/el1/public/vpn/目录下（记得修改对应的ip地址）

   eg：

hdc file send E:\vpn\carol\mschapv2\ipsec.conf /data/service/el1/public/vpn/

hdc file send E:\vpn\carol\mschapv2\ipsec.secrets.conf /data/service/el1/public/vpn/

hdc file send E:\vpn\carol\mschapv2\strongswan.conf /data/service/el1/public/vpn/

6. 启动ipsec

ipsec restart

    ipsec up home

    然后测试ping 10.1.0.1可以ping通