denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'debian-testing'

Browse Source 
These changes update the integration test system.  It previously was based
on a pretty much unmaintainable Gentoo root image and the dated UML
virtualization technology.  Among many other changes the test environment
is now based on KVM and uses reproducible Debian-based guest images.

Conflicts:
	NEWS
This commit is contained in:
Tobias Brunner
2013-01-17 17:00:05 +01:00
parent 1449e6dd55 737912239f
commit 0c006341f3
1400 changed files with 18241 additions and 41136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+4 -1
View File
@@ -46,6 +46,9 @@ strongswan-5.0.2
- The new rdrand plugin provides a high quality / high performance random
source using the Intel rdrand instruction found on Ivy Bridge processors.
- The integration test environment was updated and now uses KVM and reproducible
guest images based on Debian.
strongswan-5.0.1
----------------
@@ -422,7 +425,7 @@ strongswan-4.5.1
./configure switch.
- The new libstrongswan constraints plugin provides advanced X.509 constraint
checking. In addition to X.509 pathLen constraints, the plugin checks for
checking. In additon to X.509 pathLen constraints, the plugin checks for
nameConstraints and certificatePolicies, including policyMappings and
policyConstraints. The x509 certificate plugin and the pki tool have been
enhanced to support these extensions. The new left/rightcertpolicy ipsec.conf
testing/INSTALL
-145
View File
@@ -1,145 +0,0 @@
-------------------------------
strongSwan UML - Installation
-------------------------------
Contents
--------
1. Making the host system UML-capable
2. Installing the required files
3. Creating the UML testing environment
1. Making the host system UML-capable
----------------------------------
UML instances can be run on both Linux 2.4 and Linux 2.6 kernels.
If you are using a vanilla kernel from kernel.org then you must first
apply the host SKAS patch available from
http://www.user-mode-linux.org/~blaisorblade/patches/
and recompile and reboot your host kernel. Some Linux distributions as e.g.
SuSE already include the SKAS patch in their kernels.
You will also need the UML utilities (uml_mconsole and uml_switch)
available from
http://prdownloads.sourceforge.net/user-mode-linux/uml_utilities_20040406.tar.bz2
Many Linux distributions offer the UML utilities as a package.
2. Installing the required files
-----------------------------
First create a directory where you want the strongSwan UML testing environment
to be located.The default directory is "~/strongswan-testing". If you choose a
different location, please adapt the UMLTESTDIR variable in "testing.conf"
accordingly.
mkdir ~/strongswan-testing
Now copy the "testing" subdirectory coming with the strongSwan distribution to
the UML testing environment:
cp -r testing ~/strongswan-testing
Next you need to copy several files into the ~/strongswan-testing directory that
are required for the strongSwan testing environment:
* A vanilla Linux kernel on which the UML kernel will be based on.
We recommend the use of
http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.36.tar.bz2
* The Linux kernel 2.6.36 does not require any patches for the uml guest kernel
to successfully start up.
* The matching .config file required to compile the UML kernel:
http://download.strongswan.org/uml/.config-2.6.36
* A gentoo-based UML file system (compressed size 130 MBytes) found at
http://download.strongswan.org/uml/gentoo-fs-20100830.tar.bz2
* The latest strongSwan distribution
http://download.strongswan.org/strongswan-4.5.1.tar.bz2
3. Creating the environment
------------------------
Now change into the testing subdirectory
cd ~/strongswan-testing/testing
and make the UML testing environment:
./make-testing <hosts>
The "make-testing" script calls a series of subscripts which can be
enabled or disabled individually by setting the corresponding flags
in "testing.conf":
if [ $ENABLE_BUILD_UMLKERNEL = "yes" ]
then
scripts/build-umlkernel
fi
builds an UML kernel out of the vanilla Linux kernel and the corresponding
UML kernel patch.
if [ $ENABLE_BUILD_HOSTCONFIG = "yes" ]
then
scripts/build-hostconfig
fi
generates the default configurations for the UML hosts alice, venus, moon,
carol, winnetou, dave, sun, and bob by replacing the wildcards PH_IP_ALICE,
etc. by the actual IP addresses defined in "testing.conf".
if [ $ENABLE_BUILD_UMLROOTFS = "yes" ]
then
scripts/build-umlrootfs
fi
takes the gentoo-based UML file system and compiles the latest strongSwan
distribution into it.
if [ $ENABLE_BUILD_SSHKEYS = "yes" ]
then
scripts/build-sshkeys
fi
adds the common RSA public key of the UML instances to your ~/.ssh/known_hosts
directory so that you can log onto the UML instances using ssh without typing
in a password. The "scripts/build-sshkeys" script should only be run once.
if [ $ENABLE_BUILD_UMLHOSTFS = "yes" ]
then
scripts/build-umlhostfs <hosts>
fi
creates the customized UML file systems for the instances given as command line
arguments by adding the default host configurations to the UML root file system.
If the "make-starting" scripts is called without any arguments then by default
the UML file systems are created for the hosts alice, venus, moon, carol,
winnetou, dave, sun, and bob. Each UML root file system has as size defined by
the ROOTFSSIZE in testing.conf which by default is 544 MBytes. Thus all 8 UML
hosts plus the master copy will require a total of 5 GBytes of disk space.
if [ $ENABLE_START_TESTING = "yes" ]
then
./start-testing <hosts>
fi
starts the automated testing. More details on the tests you'll find in the
README document.
-----------------------------------------------------------------------------
testing/Makefile.am
+3 -10
View File
@@ -1,11 +1,4 @@
noinst_SCRIPTS = do-tests
CLEANFILES = do-tests
EXTRA_DIST = do-tests.in make-testing start-testing stop-testing \
testing.conf ssh_config hosts images scripts tests INSTALL README
do-tests : do-tests.in
sed \
-e "s:\@routing_table\@:$(routing_table):" \
$(srcdir)/$@.in > $@
chmod +x $@
EXTRA_DIST = do-tests make-testing start-testing stop-testing \
testing.conf ssh_config config hosts images scripts tests \
INSTALL README
testing/README
+50 -120
View File
@@ -1,158 +1,88 @@
------------------------------------
strongSwan UML - Running the Tests
------------------------------------
------------------------------
strongSwan Integration Tests
------------------------------
Contents
--------
1. Starting up the UML testing environment
2. Running the automated tests
3. Manual testing
1. Building the testing environment
2. Starting up the testing environment
3. Running the automated tests
4. Manual testing
1. Starting up the UML testing environment
---------------------------------------
When the strongSwan UML testing environment has been put into place by
running the "make-testing" script then you are ready to start up the
UML instances by calling
1. Building the testing environment
--------------------------------
./start-testing <hosts>
This main script first calls the subscript
scripts/start-switches
that starts the three UML switches umlswitch0, umlswitch1, and umlswitch2
which are connecting the UML instances among each other and via tun/tap
devices also make them accessible from the host system.
Then depending on the setting of the UMLSTARTMODE variable defined
in "testing.conf", the UML instances given on the command line are started
up with different terminals:
If you are running the KDE graphical environment then by setting
UMLSTARTMODE=konsole
the script
scripts/kstart-umls <hosts>
is called which starts up each of the UML instances defined by <hosts> in
a KDE konsole. If
UMLSTARTMODE=xterm
is set then
scripts/xstart-umls <hosts>
starts up the UML instances in an xterm each. And with the choice
UMLSTARTMODE=screen
the instances are started up by
scripts/start-umls <hosts>
in the background but the Linux command "screen -r <host>" can be used to
connect a terminal to the UML instance <host> if desired.
The testing environment can be built with the "make-testing" script after
adjusting the variables in the testing.conf file. By default everything is
built when executing the script. Setting any of the ENABLE_BUILD_* variables
in the configuration file to "no" will not build those parts.
if [ $ENABLE_DO_TESTS = "yes" ]
then
do-tests
fi
2. Starting up the testing environment
-----------------------------------
either executes all the tests defined in the "testing/tests" directory
if the variable SELECTEDTESTSONLY in "testing.conf" is set to "no" or the
selected tests defined by the string in SELELECTEDTESTS if SELECTEDTESTSONLY
is set to "yes".
if [ $ENABLE_STOP_TESTING = "yes" ]
then
stop-testing <hosts>
fi
stops the both the UML switches and the UML instances designated by the
<hosts> argument.
When the strongSwan testing environment has been put into place by running
the "make-testing" script you are ready to start up the KVM instances by
executing the "start-testing" script.
2. Running the automated tests
3. Running the automated tests
---------------------------
The script
./do-tests <testnames>
runs the automated tests. With an empty <testnames> argument the tests
as defined in "testing.conf" are executed, otherwise the tests enumerated
by the <testnames> argument will be run as shown in the example below.
runs the automated tests. If the <testnames> argument is omitted all tests
are executed, otherwise only the tests listed will be run as shown in the
example below:
./do-tests net2net-psk net2net-cert
./do-tests ikev2/net2net-psk ikev2/net2net-cert
Each test is divided into the following phases:
* scripts/load-testconfig <testname>
loads the UML hosts with test specific settings if such are provided.
* next the "pretest.dat" script found in each test directory is executed.
* Load the test-specific guest configuration if any is provided.
* Next the "pretest.dat" script found in each test directory is executed.
Among other commands, strongSwan is started on the IPsec hosts.
* the "evaltest.dat" script evaluates if the test has been successful.
* the "posttest.dat" script terminates the test e.g. by stopping
strongSwan on the IPsec hosts.
* The "evaltest.dat" script evaluates if the test has been successful.
* scripts/restore-defaults <testname>
restores the default settings on the UML hosts.
* The "posttest.dat" script terminates the test e.g. by stopping
strongSwan on the IPsec hosts. It is also responsible to cleaning up
things (e.g. firewall rules) set up in "pretest.dat".
The test results and configuration settings for all tests settings are stored
in a folder labeled with the current date in the directory
~/strongswan-testing/testresults
the same results are also automatically transferred to the Apache server
running on UML instance "winnetou" and can be accessed via the URL
* Restore the default configuration on every host (new files have to be
deleted manually in "posttest.dat").
The test results and configuration files for all tests are stored in a
folder labeled with the current date and time in the $TESTRESULTSDIR directory.
The same results are also automatically transferred to the Apache server
running on guest "winnetou" and can be accessed via the URL
http://192.168.0.150/testresults/
3. Manual testing
4. Manual testing
--------------
The greates flexibility can be achieved with manual testing. Just set
ENABLE_DO_TESTS="no"
ENABLE_STOP_TESTING="no"
in "testing.conf" and start the UML instances that you want to experiment with
by calling
./start-testing <hosts>
If you want to preload a test scenario with configurations differing from
the default values, e.g. when using Preshared Keys then you can do this
with the command
Instead of running tests automatically with "do-tests" it is possible to
preload a test scenario with the script:
scripts/load-testconfig net2net-psk
You can then log onto any UML instance using its konsole, xterm or screen
terminal as root with the default password
scripts/load-testconfig <testname>
tuxmux
You can then execute any commands the UML instances, including changing
and recompiling the strongSwan source code located in the /root directory.
Individual configuration files can be changed and any command can be executed by
logging into a guest host directly (via SSH or a console window). No password
is required to login as root. The sources for every software built during
"make-testing" are mounted at /root/shared/, which allows you to change and
recompile these components.
After you have finished testing, the default configuration settings can
restored with the command
scripts/restore-defaults net2net-psk
-----------------------------------------------------------------------------
After you have finished testing, the default configuration can be restored
with the following command (newly created files have to be deleted manually)
scripts/restore-defaults
testing/config/kernel/config-3.5
+1817
View File
File diff suppressed because it is too large Load Diff
testing/config/kernel/config-3.6
+1830
View File
File diff suppressed because it is too large Load Diff
testing/config/kvm/alice.xml
+70
View File
@@ -0,0 +1,70 @@
<domain type='kvm'>
<name>alice</name>
<uuid>1f35c25d-6a7b-4ee1-2461-d7e530e7b2a9</uuid>
<memory unit='KiB'>131072</memory>
<currentMemory unit='KiB'>131072</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='pc-1.1'>hvm</type>
<kernel>/var/run/kvm-swan-kernel</kernel>
<cmdline>root=/dev/vda1 loglevel=1</cmdline>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writethrough'/>
<source file='/var/lib/libvirt/images/alice.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<filesystem type='mount' accessmode='mapped'>
<source dir='/var/run/kvm-swan-hostfs'/>
<target dir='/hostshare'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</filesystem>
<interface type='network'>
<mac address='52:54:00:9a:e2:de'/>
<source network='vnet2'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<interface type='network'>
<mac address='52:54:00:3b:0c:d7'/>
<source network='vnet1'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
</interface>
<serial type='pty'>
<target port='0'/>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes'/>
<sound model='ich6'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</sound>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</memballoon>
</devices>
</domain>
testing/config/kvm/bob.xml
+64
View File
@@ -0,0 +1,64 @@
<domain type='kvm'>
<name>bob</name>
<uuid>72728516-377f-f5be-ea1d-b1f1e851538f</uuid>
<memory unit='KiB'>131072</memory>
<currentMemory unit='KiB'>131072</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='pc-1.1'>hvm</type>
<kernel>/var/run/kvm-swan-kernel</kernel>
<cmdline>root=/dev/vda1 loglevel=1</cmdline>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writethrough'/>
<source file='/var/lib/libvirt/images/bob.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<filesystem type='mount' accessmode='mapped'>
<source dir='/var/run/kvm-swan-hostfs'/>
<target dir='/hostshare'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</filesystem>
<interface type='network'>
<mac address='52:54:00:40:85:6b'/>
<source network='vnet3'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<serial type='pty'>
<target port='0'/>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes'/>
<sound model='ich6'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</sound>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</memballoon>
</devices>
</domain>
testing/config/kvm/carol.xml
+64
View File
@@ -0,0 +1,64 @@
<domain type='kvm'>
<name>carol</name>
<uuid>6bc2eef5-7faf-cde0-5f27-6fc29f93bc3d</uuid>
<memory unit='KiB'>131072</memory>
<currentMemory unit='KiB'>131072</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='pc-1.1'>hvm</type>
<kernel>/var/run/kvm-swan-kernel</kernel>
<cmdline>root=/dev/vda1 loglevel=1</cmdline>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writethrough'/>
<source file='/var/lib/libvirt/images/carol.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<filesystem type='mount' accessmode='mapped'>
<source dir='/var/run/kvm-swan-hostfs'/>
<target dir='/hostshare'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</filesystem>
<interface type='network'>
<mac address='52:54:00:ae:f1:f8'/>
<source network='vnet1'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<serial type='pty'>
<target port='0'/>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes'/>
<sound model='ich6'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</sound>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</memballoon>
</devices>
</domain>
testing/config/kvm/dave.xml
+64
View File
@@ -0,0 +1,64 @@
<domain type='kvm'>
<name>dave</name>
<uuid>05f1debe-4e38-4f3d-10a0-c07fbb70d816</uuid>
<memory unit='KiB'>131072</memory>
<currentMemory unit='KiB'>131072</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='pc-1.1'>hvm</type>
<kernel>/var/run/kvm-swan-kernel</kernel>
<cmdline>root=/dev/vda1 loglevel=1</cmdline>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writethrough'/>
<source file='/var/lib/libvirt/images/dave.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<filesystem type='mount' accessmode='mapped'>
<source dir='/var/run/kvm-swan-hostfs'/>
<target dir='/hostshare'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</filesystem>
<interface type='network'>
<mac address='52:54:00:b9:15:a9'/>
<source network='vnet1'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<serial type='pty'>
<target port='0'/>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes'/>
<sound model='ich6'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</sound>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</memballoon>
</devices>
</domain>
testing/config/kvm/moon.xml
+70
View File
@@ -0,0 +1,70 @@
<domain type='kvm'>
<name>moon</name>
<uuid>b5e00ad3-1c81-3b2a-7f66-cdf8727b3c65</uuid>
<memory unit='KiB'>131072</memory>
<currentMemory unit='KiB'>131072</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='pc-1.1'>hvm</type>
<kernel>/var/run/kvm-swan-kernel</kernel>
<cmdline>root=/dev/vda1 loglevel=1</cmdline>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writethrough'/>
<source file='/var/lib/libvirt/images/moon.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<filesystem type='mount' accessmode='mapped'>
<source dir='/var/run/kvm-swan-hostfs'/>
<target dir='/hostshare'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</filesystem>
<interface type='network'>
<mac address='52:54:00:43:e3:35'/>
<source network='vnet2'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
</interface>
<interface type='network'>
<mac address='52:54:00:c7:b8:b0'/>
<source network='vnet1'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<serial type='pty'>
<target port='0'/>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes'/>
<sound model='ich6'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</sound>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</memballoon>
</devices>
</domain>
testing/config/kvm/sun.xml
+70
View File
@@ -0,0 +1,70 @@
<domain type='kvm'>
<name>sun</name>
<uuid>35341843-346c-a63a-786b-9df0fd5e6264</uuid>
<memory unit='KiB'>131072</memory>
<currentMemory unit='KiB'>131072</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='pc-1.1'>hvm</type>
<kernel>/var/run/kvm-swan-kernel</kernel>
<cmdline>root=/dev/vda1 loglevel=1</cmdline>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writethrough'/>
<source file='/var/lib/libvirt/images/sun.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<filesystem type='mount' accessmode='mapped'>
<source dir='/var/run/kvm-swan-hostfs'/>
<target dir='/hostshare'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</filesystem>
<interface type='network'>
<mac address='52:54:00:77:43:ea'/>
<source network='vnet1'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<interface type='network'>
<mac address='52:54:00:0f:97:db'/>
<source network='vnet3'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
</interface>
<serial type='pty'>
<target port='0'/>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes'/>
<sound model='ich6'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</sound>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</memballoon>
</devices>
</domain>
testing/config/kvm/venus.xml
+64
View File
@@ -0,0 +1,64 @@
<domain type='kvm'>
<name>venus</name>
<uuid>f0838df9-7cc0-84f5-6c14-2d16ab002e8d</uuid>
<memory unit='KiB'>131072</memory>
<currentMemory unit='KiB'>131072</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='pc-1.1'>hvm</type>
<kernel>/var/run/kvm-swan-kernel</kernel>
<cmdline>root=/dev/vda1 loglevel=1</cmdline>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writethrough'/>
<source file='/var/lib/libvirt/images/venus.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<filesystem type='mount' accessmode='mapped'>
<source dir='/var/run/kvm-swan-hostfs'/>
<target dir='/hostshare'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</filesystem>
<interface type='network'>
<mac address='52:54:00:69:d3:80'/>
<source network='vnet2'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<serial type='pty'>
<target port='0'/>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes'/>
<sound model='ich6'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</sound>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</memballoon>
</devices>
</domain>
testing/config/kvm/vnet1.xml
+11
View File
@@ -0,0 +1,11 @@
<network>
<name>vnet1</name>
<uuid>1d6ac7c7-60d9-56c1-a7df-210d3d0cc6d1</uuid>
<forward dev='lo' mode='route'>
<interface dev='lo'/>
</forward>
<bridge name='virbr1' stp='on' delay='0' />
<mac address='52:54:00:97:F9:FD'/>
<ip address='192.168.0.254' netmask='255.255.255.0'>
</ip>
</network>
testing/config/kvm/vnet2.xml
+11
View File
@@ -0,0 +1,11 @@
<network>
<name>vnet2</name>
<uuid>b5147a7d-e184-5c9e-3838-4621796ba95c</uuid>
<forward dev='lo' mode='route'>
<interface dev='lo'/>
</forward>
<bridge name='virbr2' stp='on' delay='0' />
<mac address='52:54:00:05:F3:34'/>
<ip address='10.1.0.254' netmask='255.255.0.0'>
</ip>
</network>
testing/config/kvm/vnet3.xml
+11
View File
@@ -0,0 +1,11 @@
<network>
<name>vnet3</name>
<uuid>5c537abc-c116-90e9-a0ef-886340d4c356</uuid>
<forward dev='lo' mode='route'>
<interface dev='lo'/>
</forward>
<bridge name='virbr3' stp='on' delay='0' />
<mac address='52:54:00:62:4C:69'/>
<ip address='10.2.0.254' netmask='255.255.0.0'>
</ip>
</network>
testing/config/kvm/winnetou.xml
+64
View File
@@ -0,0 +1,64 @@
<domain type='kvm'>
<name>winnetou</name>
<uuid>b1d3d2f7-e20b-ab95-277e-66d4cac33cc3</uuid>
<memory unit='KiB'>131072</memory>
<currentMemory unit='KiB'>131072</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='pc-1.1'>hvm</type>
<kernel>/var/run/kvm-swan-kernel</kernel>
<cmdline>root=/dev/vda1 loglevel=1</cmdline>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writethrough'/>
<source file='/var/lib/libvirt/images/winnetou.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<filesystem type='mount' accessmode='mapped'>
<source dir='/var/run/kvm-swan-hostfs'/>
<target dir='/hostshare'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</filesystem>
<interface type='network'>
<mac address='52:54:00:4b:23:fa'/>
<source network='vnet1'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<serial type='pty'>
<target port='0'/>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes'/>
<sound model='ich6'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</sound>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</memballoon>
</devices>
</domain>
testing/do-tests.in → testing/do-tests
+90 -98
View File
@@ -14,23 +14,16 @@
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
DIR=`dirname $0`
DIR=$(dirname `readlink -f $0`)
. $DIR/testing.conf
. $DIR/scripts/function.sh
source $DIR/scripts/function.sh
[ -f $DIR/testing.conf ] || die "Configuration file 'testing.conf' not found"
[ -d $DIR/hosts ] || die "Directory 'hosts' not found"
[ -d $DIR/tests ] || die "Directory 'tests' not found"
[ -d $BUILDDIR ] ||
die "Directory '$BUILDDIR' does not exist, please run make-testing first"
source $DIR/testing.conf
##############################################################################
# test if UMLs have been built at all
#
[ -d $BUILDDIR ] || die "Directory '$BUILDDIR' does not exist. Please run 'make-testing'first."
ln -sfT $DIR $TESTDIR/testing
##############################################################################
# take care of new path and file variables
@@ -38,15 +31,15 @@ source $DIR/testing.conf
[ -d $TESTRESULTSDIR ] || mkdir $TESTRESULTSDIR
TESTDATE=`date +%Y%m%d-%H%M`
TESTDATE=`date +%Y%m%d-%H%M-%S`
TODAYDIR=$TESTRESULTSDIR/$TESTDATE
mkdir $TODAYDIR
TESTRESULTSHTML=$TODAYDIR/all.html
INDEX=$TODAYDIR/index.html
DEFAULTTESTSDIR=$UMLTESTDIR/testing/tests
DEFAULTTESTSDIR=$TESTDIR/testing/tests
SOURCEIP_ROUTING_TABLE=@routing_table@
SOURCEIP_ROUTING_TABLE=220
testnumber="0"
failed_cnt="0"
@@ -105,8 +98,9 @@ done
#
for host in $STRONGSWANHOSTS
do
ssh $SSHCONF -N root@`eval echo \\\$ipv4_$host` &
ssh $SSHCONF -N root@`eval echo \\\$ipv4_$host` >/dev/null 2>&1 &
eval ssh_pid_$host="`echo $!`"
do_on_exit kill `eval echo \\\$ssh_pid_$host`
done
@@ -114,30 +108,27 @@ done
# create header for the results html file
#
KERNEL_VERSION=`basename $KERNEL .tar.bz2`
IPSEC_VERSION=`basename $STRONGSWAN .tar.bz2`
ENVIRONMENT_HEADER=$(cat <<@EOF
<table border="0" cellspacing="2">
<table border="0" cellspacing="2" cellpadding="2">
<tr valign="top">
<td><b>Host:</b></td>
<td><b>Host</b></td>
<td colspan="3">`uname -a`</td>
</tr>
<tr valign="top">
<td><b>UML kernel: &nbsp;</b></td>
<td colspan="3">$KERNEL_VERSION</td>
<td><b>Guest kernel</b></td>
<td colspan="3">$KERNELVERSION</td>
</tr>
<tr valign="top">
<td><b>IPsec:</b></td>
<td colspan="3">$IPSEC_VERSION</td>
<td><b>strongSwan</b></td>
<td colspan="3">$SWANVERSION</td>
</tr>
<tr valign="top">
<td><b>Date:</b></td>
<td><b>Date</b></td>
<td colspan="3">$TESTDATE</td>
</tr>
<tr>
<td width="100">&nbsp;</td>
<td width="200">&nbsp;</td>
<td width="300">&nbsp;</td>
<td width=" 50">&nbsp;</td>
<td >&nbsp;</td>
</tr>
@@ -147,20 +138,20 @@ ENVIRONMENT_HEADER=$(cat <<@EOF
cat > $INDEX <<@EOF
<html>
<head>
<title>strongSwan UML Tests</title>
<title>strongSwan KVM Tests</title>
</head>
<body>
<h2>strongSwan UML Tests</h2>
<h2>strongSwan KVM Tests</h2>
$ENVIRONMENT_HEADER
@EOF
cat > $TESTRESULTSHTML <<@EOF
<html>
<head>
<title>strongSwan UML Tests - All Tests</title>
<title>strongSwan KVM Tests - All Tests</title>
</head>
<body>
<div><a href="index.html">strongSwan UML Tests</a> / All Tests</div>
<div><a href="index.html">strongSwan KVM Tests</a> / All Tests</div>
<h2>All Tests</h2>
$ENVIRONMENT_HEADER
<tr align="left">
@@ -170,10 +161,10 @@ cat > $TESTRESULTSHTML <<@EOF
</tr>
@EOF
cecho "UML kernel: $KERNEL_VERSION"
cecho "IPsec: $IPSEC_VERSION"
cecho "Date: $TESTDATE"
cecho ""
echo "Guest kernel : $KERNELVERSION"
echo "strongSwan : $SWANVERSION"
echo "Date : $TESTDATE"
echo
##############################################################################
@@ -183,10 +174,6 @@ cecho ""
if [ $# -gt 0 ]
then
TESTS=$*
elif [ $SELECTEDTESTSONLY = "yes" ]
then
# set internal field seperator
TESTS=$SELECTEDTESTS
else
# set internal field seperator
TESTS="`ls $DEFAULTTESTSDIR`"
@@ -208,7 +195,7 @@ do
mkdir $TODAYDIR/$SUBDIR
if [ $testnumber == 0 ]
then
FIRST="<b>Category:</b"
FIRST="<b>Category</b>"
else
FIRST="&nbsp;"
fi
@@ -225,24 +212,24 @@ do
<title>strongSwan $SUBDIR Tests</title>
</head>
<body>
<div><a href="../index.html">strongSwan UML Tests</a> / $SUBDIR</div>
<div><a href="../index.html">strongSwan KVM Tests</a> / $SUBDIR</div>
<h2>strongSwan $SUBDIR Tests</h2>
<table border="0" cellspacing="2">
<table border="0" cellspacing="2" cellpadding="2">
<tr valign="top">
<td><b>UML kernel: &nbsp;</b></td>
<td colspan="3">$KERNEL_VERSION</td>
<td><b>Guest kernel</b></td>
<td colspan="3">$KERNELVERSION</td>
</tr>
<tr valign="top">
<td><b>IPsec:</b></td>
<td colspan="3">$IPSEC_VERSION</td>
<td><b>strongSwan</b></td>
<td colspan="3">$SWANVERSION</td>
</tr>
<tr valign="top">
<td><b>Date:</b></td>
<td><b>Date</b></td>
<td colspan="3">$TESTDATE</td>
</tr>
<tr>
<td width="100">&nbsp;</td>
<td width="200">&nbsp;</td>
<td width="300">&nbsp;</td>
<td width=" 50">&nbsp;</td>
<td >&nbsp;</td>
</tr>
@@ -258,11 +245,11 @@ do
do
let "testnumber += 1"
testname=$SUBDIR/$name
cecho-n " $testnumber $testname.."
log_action " $testnumber $testname:"
if [ ! -d $DEFAULTTESTSDIR/${testname} ]
then
cecho "is missing..skipped"
echo "is missing..skipped"
continue
fi
@@ -390,7 +377,7 @@ do
# execute pre-test commands
#
cecho-n "pre.."
echo -n "pre.."
echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1
eval `awk -F "::" '{
@@ -419,7 +406,7 @@ do
# get and evaluate test results
#
cecho-n "test.."
echo -n "test.."
echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1
STATUS="passed"
@@ -476,7 +463,7 @@ do
<body>
<table border="0" cellpadding="0" cellspacing="0" width="600">
<tr><td>
<div><a href="../../index.html">strongSwan UML Tests</a> / <a href="../index.html">$SUBDIR</a> / $name</div>
<div><a href="../../index.html">strongSwan KVM Tests</a> / <a href="../index.html">$SUBDIR</a> / $name</div>
<h2>Test $testname</h2>
<h3>Description</h3>
@EOF
@@ -487,7 +474,7 @@ do
<ul>
<li><a href="console.log">console.log</a></li>
</ul>
<img src="../../images/$DIAGRAM" alt="$UMLHOSTS">
<img src="../../images/$DIAGRAM" alt="$VIRTHOSTS">
@EOF
for host in $IPSECHOSTS
@@ -507,7 +494,7 @@ do
done
scp $SSHCONF $HOSTLOGIN:/etc/ipsec.d/ipsec.sql \
$TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1
$TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1
ssh $SSHCONF $HOSTLOGIN ip -s xfrm policy \
> $TESTRESULTDIR/${host}.ip.policy 2>/dev/null
@@ -558,15 +545,18 @@ do
for file in clients.conf eap.conf radiusd.conf proxy.conf users
do
scp $SSHCONF $HOSTLOGIN:/etc/raddb/$file \
scp $SSHCONF $HOSTLOGIN:/etc/freeradius/$file \
$TESTRESULTDIR/${host}.$file > /dev/null 2>&1
done
scp $SSHCONF $HOSTLOGIN:/etc/strongswan.conf \
$TESTRESULTDIR/${host}.strongswan.conf > /dev/null 2>&1
scp $SSHCONF $HOSTLOGIN:/var/log/radius/radius.log \
$TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1
scp $SSHCONF $HOSTLOGIN:/var/log/freeradius/radius.log \
$TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1
ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \
>> $TESTRESULTDIR/${host}.daemon.log
chmod a+r $TESTRESULTDIR/*
cat >> $TESTRESULTDIR/index.html <<@EOF
@@ -599,6 +589,28 @@ do
done
cat >> $TESTRESULTDIR/index.html <<@EOF
<h3>tcpdump</h3>
<ul>
@EOF
for host in $TCPDUMPHOSTS
do
eval HOSTLOGIN=root@\$ipv4_${host}
scp $SSHCONF $HOSTLOGIN:/tmp/tcpdump.log \
$TESTRESULTDIR/${host}.tcpdump.log > /dev/null 2>&1
cat >> $TESTRESULTDIR/index.html <<@EOF
<li><a href="$host.tcpdump.log">$host tcpdump.log</a></li>
@EOF
done
cat >> $TESTRESULTDIR/index.html <<@EOF
</ul>
@EOF
cat >> $TESTRESULTDIR/index.html <<@EOF
</td></tr>
</table>
@@ -611,7 +623,7 @@ do
# execute post-test commands
#
cecho-n "post.."
echo -n "post"
echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1
eval `awk -F "::" '{
@@ -648,18 +660,6 @@ do
done
##########################################################################
# get a copy of /var/log/daemon.log
#
for host in $RADIUSHOSTS
do
eval HOSTLOGIN=root@\$ipv4_${host}
ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \
>> $TESTRESULTDIR/${host}.daemon.log
done
##########################################################################
# stop tcpdump if necessary
#
@@ -688,11 +688,11 @@ do
if [ $STATUS = "passed" ]
then
COLOR="green"
cecho "\033[1;32m$STATUS"
COLOR="green"
log_status 0
else
COLOR="red"
cecho "$STATUS"
COLOR="red"
log_status 1
fi
cat >> $TESTRESULTSHTML << @EOF
@@ -737,10 +737,10 @@ cat >> $TESTRESULTSHTML << @EOF
<td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td>
</tr>
<tr>
<td><b>Passed:</b></td><td><b><font color="green">$passed_cnt</font></b></td><td>&nbsp;</td><td>&nbsp;</td>
<td><b>Passed</b></td><td><b><font color="green">$passed_cnt</font></b></td><td>&nbsp;</td><td>&nbsp;</td>
</tr>
<tr>
<td><b>Failed:</b></td><td><b><font color="red">$failed_cnt</font></b></td><td>&nbsp;</td><td>&nbsp;</td>
<td><b>Failed</b></td><td><b><font color="red">$failed_cnt</font></b></td><td>&nbsp;</td><td>&nbsp;</td>
</tr>
</table>
</body>
@@ -757,7 +757,7 @@ cat >> $INDEX << @EOF
<td>&nbsp;</td>
</tr>
<tr>
<td><b>Failed:</b></td>
<td><b>Failed</b></td>
<td>&nbsp;</td>
<td align="right"><b><font color="red">$failed_cnt</font></b></td>
<td>&nbsp;</td>
@@ -767,33 +767,25 @@ cat >> $INDEX << @EOF
</html>
@EOF
cecho ""
cecho "\033[1;32mPassed: $passed_cnt"
cecho "Failed: $failed_cnt"
cecho ""
echo
echo_ok "Passed : $passed_cnt"
echo_failed "Failed : $failed_cnt"
echo
##############################################################################
# copy the test results to the apache server
#
HTDOCS="/var/www/localhost/htdocs"
HTDOCS="/var/www"
cecho-n "Copying test results to winnetou.."
ssh $SSHCONF root@${ipv4_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1
scp $SSHCONF -r $TODAYDIR root@${ipv4_winnetou}:$HTDOCS/testresults > /dev/null 2>&1
ssh $SSHCONF root@${ipv4_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1
cgecho "done"
cecho ""
cecho "The results are available in $TODAYDIR"
cecho "or via the link http://$ipv4_winnetou/testresults/$TESTDATE"
##########################################################################
# close ssh sessions
#
for host in $STRONGSWANHOSTS
do
kill `eval echo \\\$ssh_pid_$host`
done
echo
echo "The results are available in $TODAYDIR"
echo "or via the link http://$ipv4_winnetou/testresults/$TESTDATE"
ENDDATE=`date +%Y%m%d-%H%M`
echo
echo "Finished : $ENDDATE"
testing/hosts/alice/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=alice
testing/hosts/alice/etc/conf.d/net
-12
View File
@@ -1,12 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_ALICE broadcast 10.1.255.255 netmask 255.255.0.0"
"PH_IP6_ALICE/16" )
config_eth1=( "PH_IP_ALICE1 broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_ALICE1/16" )
# For setting the default gateway
#
routes_eth0=( "default via PH_IP_MOON1" )
testing/hosts/alice/etc/freeradius/clients.conf
+4
View File
@@ -0,0 +1,4 @@
client 10.1.0.1 {
secret = gv6URkSs
shortname = moon
}
testing/hosts/alice/etc/freeradius/dictionary
+32
View File
@@ -0,0 +1,32 @@
#
# This is the master dictionary file, which references the
# pre-defined dictionary files included with the server.
#
# Any new/changed attributes MUST be placed in this file, as
# the pre-defined dictionaries SHOULD NOT be edited.
#
# $Id$
#
#
# The filename given here should be an absolute path.
#
$INCLUDE /usr/local/share/freeradius/dictionary
#
# Place additional attributes or $INCLUDEs here. They will
# over-ride the definitions in the pre-defined dictionaries.
#
# See the 'man' page for 'dictionary' for information on
# the format of the dictionary files.
#
# If you want to add entries to the dictionary file,
# which are NOT going to be placed in a RADIUS packet,
# add them here. The numbers you pick should be between
# 3000 and 4000.
#
#ATTRIBUTE My-Local-String 3000 string
#ATTRIBUTE My-Local-IPAddr 3001 ipaddr
#ATTRIBUTE My-Local-Integer 3002 integer
testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf → testing/hosts/alice/etc/freeradius/radiusd.conf
+9 -9
View File
@@ -5,16 +5,16 @@ exec_prefix = ${prefix}
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
logdir = ${localstatedir}/log/freeradius
raddbdir = ${sysconfdir}/freeradius
radacctdir = ${logdir}/radacct
# name of the running server. See also the "-n" command-line option.
name = radiusd
name = freeradius
# Location of config and logfiles.
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/radiusd
run_dir = ${localstatedir}/run
# Should likely be ${localstatedir}/lib/radiusd
db_dir = ${raddbdir}
@@ -37,7 +37,7 @@ max_requests = 1024
# listen: Make the server listen on a particular IP address, and send
listen {
type = auth
ipaddr = PH_IP_ALICE
ipaddr = 10.1.0.10
port = 0
}
@@ -46,7 +46,7 @@ listen {
#
listen {
type = acct
ipaddr = PH_IP_ALICE
ipaddr = 10.1.0.10
port = 0
}
@@ -66,9 +66,9 @@ log {
file = ${logdir}/radius.log
syslog_facility = daemon
stripped_names = no
auth = yes
auth_badpass = yes
auth_goodpass = yes
auth = yes
auth_badpass = yes
auth_goodpass = yes
}
# The program to execute to do concurrency checks.
testing/hosts/alice/etc/hostname
+1
View File
@@ -0,0 +1 @@
alice
testing/hosts/alice/etc/init.d/iptables
-74
View File
@@ -1,74 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/alice/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/alice/etc/init.d/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/alice/etc/init.d/radiusd
-64
View File
@@ -1,64 +0,0 @@
#!/sbin/runscript
opts="${opts} reload"
depend() {
need net
use dns
}
checkconfig() {
# set the location of log files
if ! cd /var/log/radius ; then
eerror "Failed to change current directory to /var/log/radius"
return 1
fi
if [ ! -d /var/run/radiusd ] && ! mkdir /var/run/radiusd ; then
eerror "Failed to create /var/run/radiusd"
return 1
fi
if [ ! -f /etc/raddb/radiusd.conf ] ; then
eerror "No /etc/raddb/radiusd.conf file exists!"
return 1
fi
RADIUSD_OPTS="-xx"
RADIUSD_USER=`grep '^ *user *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3`
RADIUSD_GROUP=`grep '^ *group *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3`
if [ -n "${RADIUSD_USER}" ] && ! getent passwd ${RADIUSD_USER} > /dev/null ; then
eerror "${RADIUSD_USER} user missing!"
return 1
fi
if [ -n "${RADIUSD_GROUP}" ] && ! getent group ${RADIUSD_GROUP} > /dev/null ; then
eerror "${RADIUSD_GROUP} group missing!"
return 1
fi
# radius.log is created before privileges are dropped - need to set proper permissions on it
[ -f radius.log ] || touch radius.log || return 1
chown -R "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" . /var/run/radiusd && \
chmod -R u+rwX,g+rX . /var/run/radiusd || return 1
}
start() {
checkconfig || return 1
ebegin "Starting radiusd"
start-stop-daemon --start --quiet --exec /usr/sbin/radiusd -- ${RADIUSD_OPTS} >/dev/null
eend $?
}
stop () {
ebegin "Stopping radiusd"
start-stop-daemon --stop --quiet --pidfile=/var/run/radiusd/radiusd.pid
eend $?
}
reload () {
ebegin "Reloading radiusd"
kill -HUP `</var/run/radiusd/radiusd.pid`
eend $?
}
testing/hosts/alice/etc/ipsec.conf
Executable → Regular
+1 -1
View File
@@ -13,7 +13,7 @@ conn nat-t
leftcert=aliceCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_SUN
right=192.168.0.2
[email protected]
rightsubnet=10.2.0.0/16
auto=add
testing/hosts/alice/etc/network/interfaces
+20
View File
@@ -0,0 +1,20 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 10.1.0.10
netmask 255.255.0.0
broadcast 10.1.255.255
gateway 10.1.0.1
iface eth0 inet6 static
address fec1::10
netmask 16
iface eth1 inet static
address 192.168.0.50
netmask 255.255.255.0
broadcast 192.168.0.255
iface eth1 inet6 static
address fec0::5
netmask 16
testing/hosts/alice/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/bob/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=bob
testing/hosts/bob/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_BOB broadcast 10.2.255.255 netmask 255.255.0.0"
"PH_IP6_BOB/16" )
# For setting the default gateway
#
routes_eth0=( "default via PH_IP_SUN1" )
testing/hosts/bob/etc/hostname
+1
View File
@@ -0,0 +1 @@
bob
testing/hosts/bob/etc/init.d/iptables
-74
View File
@@ -1,74 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow IKE
iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/bob/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/bob/etc/ipsec.conf
Executable → Regular
View File
testing/hosts/bob/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 10.2.0.10
netmask 255.255.0.0
broadcast 10.2.255.255
gateway 10.2.0.1
iface eth0 inet6 static
address fec2::10
netmask 16
testing/hosts/bob/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/carol/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=carol
testing/hosts/carol/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_CAROL broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_CAROL/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/carol/etc/hostname
+1
View File
@@ -0,0 +1 @@
carol
testing/hosts/carol/etc/init.d/iptables
-77
View File
@@ -1,77 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/carol/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/carol/etc/ipsec.conf
Executable → Regular
+2 -2
View File
@@ -9,11 +9,11 @@ conn %default
keyingtries=1
conn home
left=PH_IP_CAROL
left=192.168.0.100
leftcert=carolCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
right=192.168.0.1
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/hosts/carol/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.0.100
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address fec0::10
netmask 16
testing/hosts/carol/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/dave/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=dave
testing/hosts/dave/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_DAVE broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_DAVE/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/dave/etc/hostname
+1
View File
@@ -0,0 +1 @@
dave
testing/hosts/dave/etc/init.d/iptables
-77
View File
@@ -1,77 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/dave/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/dave/etc/ipsec.conf
Executable → Regular
+2 -2
View File
@@ -9,11 +9,11 @@ conn %default
keyingtries=1
conn home
left=PH_IP_DAVE
left=192.168.0.200
leftcert=daveCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
right=192.168.0.1
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/hosts/dave/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.0.200
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address fec0::20
netmask 16
testing/hosts/dave/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/default/etc/default/slapd
+45
View File
@@ -0,0 +1,45 @@
# Default location of the slapd.conf file or slapd.d cn=config directory. If
# empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to
# /etc/ldap/slapd.conf).
SLAPD_CONF=/etc/ldap/slapd.conf
# System account to run the slapd server under. If empty the server
# will run as root.
SLAPD_USER="openldap"
# System group to run the slapd server under. If empty the server will
# run in the primary group of its user.
SLAPD_GROUP="openldap"
# Path to the pid file of the slapd server. If not set the init.d script
# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf by
# default)
SLAPD_PIDFILE=
# slapd normally serves ldap only on all TCP-ports 389. slapd can also
# service requests on TCP-port 636 (ldaps) and requests via unix
# sockets.
# Example usage:
# SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
SLAPD_SERVICES="ldap:///"
# If SLAPD_NO_START is set, the init script will not start or restart
# slapd (but stop will still work). Uncomment this if you are
# starting slapd via some other means or if you don't want slapd normally
# started at boot.
#SLAPD_NO_START=1
# If SLAPD_SENTINEL_FILE is set to path to a file and that file exists,
# the init script will not start or restart slapd (but stop will still
# work). Use this for temporarily disabling startup of slapd (when doing
# maintenance, for example, or through a configuration management system)
# when you don't want to edit a configuration file.
SLAPD_SENTINEL_FILE=/etc/ldap/noslapd
# For Kerberos authentication (via SASL), slapd by default uses the system
# keytab file (/etc/krb5.keytab). To use a different keytab file,
# uncomment this line and change the path.
#export KRB5_KTNAME=/etc/krb5.keytab
# Additional options to pass to slapd
SLAPD_OPTIONS=""
testing/hosts/default/etc/fstab
+1
View File
@@ -0,0 +1 @@
/hostshare /root/shared 9p trans=virtio,version=9p2000.L 0 0
testing/hosts/default/etc/ip6tables.flush
+15
View File
@@ -0,0 +1,15 @@
*filter
-F
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P FORWARD ACCEPT
COMMIT
*mangle
-F
COMMIT
testing/hosts/default/etc/ip6tables.rules
+39
View File
@@ -0,0 +1,39 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow esp
-A INPUT -i eth0 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow last UDP fragment
-A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT
# allow ICMPv6 neighbor-solicitations
-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
# allow ICMPv6 neighbor-advertisements
-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
# allow crl and certficate fetch from winnetou
-A INPUT -i eth0 -p tcp --sport 80 -s fec0::15 -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d fec0::15 -j ACCEPT
# log dropped packets
-A INPUT -j LOG --log-prefix " IN: "
-A OUTPUT -j LOG --log-prefix " OUT: "
COMMIT
testing/hosts/default/etc/iptables.drop
+12
View File
@@ -0,0 +1,12 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
COMMIT
testing/hosts/default/etc/iptables.flush
+21
View File
@@ -0,0 +1,21 @@
*filter
-F
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P FORWARD ACCEPT
COMMIT
*nat
-F
COMMIT
*mangle
-F
COMMIT
testing/hosts/default/etc/iptables.rules
+28
View File
@@ -0,0 +1,28 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow esp
-A INPUT -i eth0 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
# allow crl fetch from winnetou
-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
COMMIT
testing/hosts/default/etc/profile.d/coredumps.sh
+5
View File
@@ -0,0 +1,5 @@
#!/bin/sh -e
ulimit -c unlimited >/dev/null 2>&1
install -m 1777 -d /var/local/dumps >/dev/null 2>&1
echo "/var/local/dumps/core.%e.%p" > /proc/sys/kernel/core_pattern
testing/hosts/default/etc/rsyslog.conf
+125
View File
@@ -0,0 +1,125 @@
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#################
#### MODULES ####
#################
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
#$ModLoad immark # provides --MARK-- message capability
# Don't drop messages
$SystemLogRateLimitInterval 0
$RepeatedMsgReduction off
# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
###############
#### RULES ####
###############
#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* /var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
#
# Logging for INN news system.
#
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice
#
# Some "catch-all" log files.
#
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg :omusrmsg:*
#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
# news.=crit;news.=err;news.=notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn /dev/tty8
# The named pipe /dev/xconsole is for the `xconsole' utility. To use it,
# you must invoke `xconsole' with the `-file' option:
#
# $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
# busy site..
#
daemon.*;mail.*;\
news.err;\
*.=debug;*.=info;\
*.=notice;*.=warn |/dev/xconsole
testing/hosts/default/etc/security/limits.conf
+58
View File
@@ -0,0 +1,58 @@
# /etc/security/limits.conf
#
#Each line describes a limit for a user in the form:
#
#<domain> <type> <item> <value>
#
#Where:
#<domain> can be:
# - an user name
# - a group name, with @group syntax
# - the wildcard *, for default entry
# - the wildcard %, can be also used with %group syntax,
# for maxlogin limit
# - NOTE: group and wildcard limits are not applied to root.
# To apply a limit to the root user, <domain> must be
# the literal username root.
#
#<type> can have the two values:
# - "soft" for enforcing the soft limits
# - "hard" for enforcing hard limits
#
#<item> can be one of the following:
# - core - limits the core file size (KB)
# - data - max data size (KB)
# - fsize - maximum filesize (KB)
# - memlock - max locked-in-memory address space (KB)
# - nofile - max number of open files
# - rss - max resident set size (KB)
# - stack - max stack size (KB)
# - cpu - max CPU time (MIN)
# - nproc - max number of processes
# - as - address space limit (KB)
# - maxlogins - max number of logins for this user
# - maxsyslogins - max number of logins on the system
# - priority - the priority to run user process with
# - locks - max number of file locks the user can hold
# - sigpending - max number of pending signals
# - msgqueue - max memory used by POSIX message queues (bytes)
# - nice - max nice priority allowed to raise to values: [-20, 19]
# - rtprio - max realtime priority
# - chroot - change root to directory (Debian-specific)
#
#<domain> <type> <item> <value>
#
#* soft core 0
#root hard core 100000
#* hard rss 10000
#@student hard nproc 20
#@faculty soft nproc 20
#@faculty hard nproc 50
#ftp hard nproc 0
#ftp - chroot /ftp
#@student - maxlogins 4
* soft core unlimited
# End of file
testing/hosts/default/etc/ssh/sshd_config
+13
View File
@@ -0,0 +1,13 @@
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
UsePrivilegeSeparation no
PermitRootLogin yes
StrictModes no
PubkeyAuthentication no
PermitEmptyPasswords yes
PrintMotd no
PrintLastLog no
UsePAM no
testing/hosts/default/etc/sysctl.conf
+62
View File
@@ -0,0 +1,62 @@
#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additonal system variables
# See sysctl.conf (5) for information.
#
#kernel.domainname = example.com
# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3
##############################################################3
# Functions previously found in netbase
#
# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1
# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
#net.ipv4.tcp_syncookies=1
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
# Uncomment the next line to enable packet forwarding for IPv6
# Enabling this option disables Stateless Address Autoconfiguration
# based on Router Advertisements for this host
net.ipv6.conf.all.forwarding=1
###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv6.conf.all.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
#net.ipv4.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
#net.ipv4.conf.all.log_martians = 1
# Enable coredump for suid binaries
fs.suid_dumpable = 1
testing/hosts/default/root/.ssh/config
+3
View File
@@ -0,0 +1,3 @@
Host *
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
testing/hosts/default/usr/local/bin/expect-connection
Executable
+27
View File
@@ -0,0 +1,27 @@
#!/bin/bash
#
# Wait until a given IPsec connection becomes available
#
# Params:
# $1 - connection name
# $2 - maximum time to wait in seconds, default is 5 seconds
if [[ $# -lt 1 || $# -gt 2 ]]
then
echo "invalid arguments"
exit 1
fi
secs=$2
[ ! $secs ] && secs=5
let steps=$secs*10
for i in `seq 1 $steps`
do
ipsec statusall 2>&1 | grep ^[[:space:]]*$1: >/dev/null
[ $? -eq 0 ] && exit 0
sleep 0.1
done
echo "Connection '$1' not available after $secs second(s)"
exit 1
testing/hosts/moon/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=moon
testing/hosts/moon/etc/conf.d/net
-12
View File
@@ -1,12 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_MOON broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_MOON/16" )
config_eth1=( "PH_IP_MOON1 broadcast 10.1.255.255 netmask 255.255.0.0"
"PH_IP6_MOON1/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/moon/etc/hostname
+1
View File
@@ -0,0 +1 @@
moon
testing/hosts/moon/etc/init.d/iptables
-80
View File
@@ -1,80 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/moon/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/moon/etc/init.d/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/moon/etc/ipsec.conf
Executable → Regular
+4 -4
View File
@@ -7,20 +7,20 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
left=PH_IP_MOON
left=192.168.0.1
leftcert=moonCert.pem
[email protected]
leftfirewall=yes
conn net-net
leftsubnet=10.1.0.0/16
right=PH_IP_SUN
right=192.168.0.2
rightsubnet=10.2.0.0/16
[email protected]
auto=add
conn host-host
right=PH_IP_SUN
right=192.168.0.2
[email protected]
auto=add
testing/hosts/moon/etc/network/interfaces
+21
View File
@@ -0,0 +1,21 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.0.1
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address fec0::1
netmask 16
auto eth1
iface eth1 inet static
address 10.1.0.1
netmask 255.255.0.0
broadcast 10.1.255.255
iface eth1 inet6 static
address fec1::1
netmask 16
testing/hosts/moon/etc/rc.local
Executable
+20
View File
@@ -0,0 +1,20 @@
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# Disable checksum offloading on eth1 because it does not currently work with
# libvirt and isc-dhcp-server running on venus, see [1]
# [1] - https://bugs.mageia.org/show_bug.cgi?id=1243
ethtool --offload eth1 tx off >/dev/null 2>&1
ethtool --offload eth1 rx off >/dev/null 2>&1
exit 0
testing/hosts/moon/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/moon/etc/runlevels/default/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/ssh_host_rsa_key.pub
-1
View File
@@ -1 +0,0 @@
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsxKfTm05po6leGD8C+M0eAR5EE4s1pQXc0D/dVlqrmfZ65h5BFQY9lnwpCvapV6OVqKWx8ICmeIH3OhaPxPPNKlU81f3d0xgh8BRJpWh459DYkRVa5f7ax5eeFE1lelj9s1d0seUl/IZolpJ8Wmt9TN1hwJ0mrkwN4670rb3urc=
testing/hosts/sun/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=sun
testing/hosts/sun/etc/conf.d/net
-14
View File
@@ -1,14 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_SUN broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_SUN/16" )
config_eth1=( "PH_IP_SUN1 broadcast 10.2.255.255 netmask 255.255.0.0"
"PH_IP6_SUN1/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
testing/hosts/sun/etc/hostname
+1
View File
@@ -0,0 +1 @@
sun
testing/hosts/sun/etc/init.d/iptables
-80
View File
@@ -1,80 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/sun/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/sun/etc/init.d/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/sun/etc/ipsec.conf
Executable → Regular
+3 -3
View File
@@ -7,20 +7,20 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
left=PH_IP_SUN
left=192.168.0.2
leftcert=sunCert.pem
[email protected]
leftfirewall=yes
conn net-net
leftsubnet=10.2.0.0/16
right=PH_IP_MOON
right=192.168.0.1
rightsubnet=10.1.0.0/16
[email protected]
auto=add
conn host-host
right=PH_IP_MOON
right=192.168.0.1
[email protected]
auto=add
testing/hosts/sun/etc/network/interfaces
+21
View File
@@ -0,0 +1,21 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.0.2
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address fec0::2
netmask 16
auto eth1
iface eth1 inet static
address 10.2.0.1
netmask 255.255.0.0
broadcast 10.2.255.255
iface eth1 inet6 static
address fec2::1
netmask 16
testing/hosts/sun/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/sun/etc/runlevels/default/net.eth1
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/venus/etc/conf.d/hostname
-1
View File
@@ -1 +0,0 @@
HOSTNAME=venus
testing/hosts/venus/etc/conf.d/net
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_VENUS broadcast 10.1.255.255 netmask 255.255.0.0"
"PH_IP6_VENUS/16" )
# For setting the default gateway
#
routes_eth0=( "default via PH_IP_MOON1" )
testing/hosts/venus/etc/hostname
+1
View File
@@ -0,0 +1 @@
venus
testing/hosts/venus/etc/init.d/iptables
-74
View File
@@ -1,74 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/hosts/venus/etc/init.d/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/venus/etc/ipsec.conf
Executable → Regular
+1 -1
View File
@@ -13,7 +13,7 @@ conn nat-t
leftcert=venusCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_SUN
right=192.168.0.2
[email protected]
rightsubnet=10.2.0.0/16
auto=add
testing/hosts/venus/etc/network/interfaces
+12
View File
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 10.1.0.20
netmask 255.255.0.0
broadcast 10.1.255.255
gateway 10.1.0.1
iface eth0 inet6 static
address fec1::20
netmask 16
testing/hosts/venus/etc/runlevels/default/net.eth0
-1124
View File
File diff suppressed because it is too large Load Diff
testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text
+1
View File
@@ -0,0 +1 @@
AddType text/plain .iptables .log .sql

Some files were not shown because too many files have changed in this diff Show More