denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Enable firewall for ikev2/compress scenario

Browse Source 
Additionally, send a regular (small) ping as the kernel does not
compress small packets and handles those differently inbound.
This commit is contained in:
Tobias Brunner
2014-01-23 10:27:13 +01:00
parent fe2a2d1885
commit 1fde30cc23
8 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/compress/description.txt
+4 -3
View File
@@ -1,3 +1,4 @@
This scenario enables IPCOMP compression between roadwarrior <b>carol</b> and This scenario enables IPComp compression between roadwarrior <b>carol</b> and
gateway <b>moon</b>. Two pings from <b>carol</b> to <b>alice</b> checks gateway <b>moon</b>. Two pings from <b>carol</b> to <b>alice</b> check
the established tunnel with compression. the established tunnel with compression. The packet sizes of the two pings
are different because the kernel does not compress small packets.
testing/tests/ikev2/compress/evaltest.dat
+2 -2
View File
@@ -6,7 +6,7 @@ moon:: cat /var/log/daemon.log::IKE_AUTH request.*N(IPCOMP_SUP)::YES
moon:: cat /var/log/daemon.log::IKE_AUTH response.*N(IPCOMP_SUP)::YES moon:: cat /var/log/daemon.log::IKE_AUTH response.*N(IPCOMP_SUP)::YES
moon:: ip xfrm state::proto comp spi::YES moon:: ip xfrm state::proto comp spi::YES
carol::ip xfrm state::proto comp spi::YES carol::ip xfrm state::proto comp spi::YES
carol::ping -n -c 2 -s 8184 -p deadbeef PH_IP_ALICE::8192 bytes from PH_IP_ALICE::YES carol::ping -n -c 1 -s 8184 -p deadbeef PH_IP_ALICE::8192 bytes from PH_IP_ALICE::YES
carol::ping -n -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE::YES
moon::tcpdump::carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::moon.strongswan.org > carol.strongswan.org: ESP::YES moon::tcpdump::moon.strongswan.org > carol.strongswan.org: ESP::YES
testing/tests/ikev2/compress/hosts/carol/etc/ipsec.conf
+1
View File
@@ -9,6 +9,7 @@ conn %default
keyingtries=1 keyingtries=1
keyexchange=ikev2 keyexchange=ikev2
compress=yes compress=yes
leftfirewall=yes
conn home conn home
left=PH_IP_CAROL left=PH_IP_CAROL
testing/tests/ikev2/compress/hosts/carol/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
} }
testing/tests/ikev2/compress/hosts/moon/etc/ipsec.conf
+1
View File
@@ -9,6 +9,7 @@ conn %default
keyingtries=1 keyingtries=1
keyexchange=ikev2 keyexchange=ikev2
compress=yes compress=yes
leftfirewall=yes
conn rw conn rw
left=PH_IP_MOON left=PH_IP_MOON
testing/tests/ikev2/compress/hosts/moon/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file # /etc/strongswan.conf - strongSwan configuration file
charon { charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
} }
testing/tests/ikev2/compress/posttest.dat
+2
View File
@@ -1,2 +1,4 @@
moon::ipsec stop moon::ipsec stop
carol::ipsec stop carol::ipsec stop
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/compress/pretest.dat
+2
View File
@@ -1,3 +1,5 @@
carol::iptables-restore < /etc/iptables.rules
moon::iptables-restore < /etc/iptables.rules
carol::ipsec start carol::ipsec start
moon::ipsec start moon::ipsec start
carol::sleep 2 carol::sleep 2