denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Migrated redirect-active scenario to vici

Browse Source
This commit is contained in:
Andreas Steffen
2021-03-30 22:12:00 +02:00
parent 511b860916
commit 2cbf7da51a
21 changed files with 152 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/swanctl/redirect-active/description.txt
+8
View File
@@ -0,0 +1,8 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
to gateway <b>alice</b>, which identifies itself as <b>mars</b>.
Host <b>venus</b> in the subnet behind this gateway uses gateway <b>moon</b> as
default gateway, so it is not fully reachable by the two roadwarriors.
Then both SAs are actively redirected with the <em>swanctl --redirect</em>
command to gateway <b>moon</b> (also identified as <b>mars</b>) using the
mechanism described in <b>RFC 5685</b> enabling the roadwarriors to
ping <b>venus</b>.
testing/tests/swanctl/redirect-active/evaltest.dat
+28
View File
@@ -0,0 +1,28 @@
alice::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
alice::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.5 remote-port=4500 remote-id=mars.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.5 remote-port=4500 remote-id=mars.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
dave:: ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
alice::swanctl --redirect --peer-ip PH_IP_CAROL --gateway 192.168.0.1::redirect completed successfully::YES
alice::swanctl --redirect --peer-id [email protected] --gateway moon.strongswan.org::redirect completed successfully::YES
carol::sleep 1::No output expected::NO
carol::cat /var/log/daemon.log::redirected to 192.168.0.1::YES
dave::cat /var/log/daemon.log::redirected to moon.strongswan.org::YES
moon::cat /var/log/daemon.log::client got redirected from 192.168.0.5::YES
moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
carol::tcpdump::IP carol.strongswan.org > mars.strongswan.org: ESP::YES
carol::tcpdump::IP mars.strongswan.org > carol.strongswan.org: ESP::NO
carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
dave::tcpdump::IP dave.strongswan.org > mars.strongswan.org: ESP::YES
dave::tcpdump::IP mars.strongswan.org > dave.strongswan.org: ESP::NO
dave::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
dave::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
venus::tcpdump::IP carol.strongswan.org > venus.strongswan.org: ICMP echo request::YES
venus::tcpdump::IP venus.strongswan.org > carol.strongswan.org: ICMP echo reply::YES
venus::tcpdump::IP dave.strongswan.org > venus.strongswan.org: ICMP echo request::YES
venus::tcpdump::IP venus.strongswan.org > dave.strongswan.org: ICMP echo reply::YES
testing/tests/swanctl/redirect-active/hosts/alice/etc/iptables.rules
+34
View File
@@ -0,0 +1,34 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# forward ESP-tunneled traffic
-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT
-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT
-A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
# allow esp
-A INPUT -p 50 -j ACCEPT
-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT
-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT
# allow IKE
-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
-A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
COMMIT
testing/tests/swanctl/redirect-active/hosts/alice/etc/strongswan.conf
+6
View File
@@ -0,0 +1,6 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown vici
}
testing/tests/swanctl/redirect-active/hosts/alice/etc/swanctl/swanctl.conf
Executable
+25
View File
@@ -0,0 +1,25 @@
connections {
rw {
local_addrs = 192.168.0.5
local {
auth = pubkey
certs = marsCert.pem
id = mars.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/swanctl/redirect-active/hosts/carol/etc/strongswan.conf
+10
View File
@@ -0,0 +1,10 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
syslog {
daemon {
knl = 2
}
}
}
testing/tests/swanctl/redirect-active/hosts/carol/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.5
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = mars.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/swanctl/redirect-active/hosts/dave/etc/strongswan.conf
+6
View File
@@ -0,0 +1,6 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
}
testing/tests/swanctl/redirect-active/hosts/dave/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.5
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = mars.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/swanctl/redirect-active/hosts/moon/etc/strongswan.conf
+6
View File
@@ -0,0 +1,6 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
}
testing/tests/swanctl/redirect-active/hosts/moon/etc/swanctl/swanctl.conf
Executable
+25
View File
@@ -0,0 +1,25 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = marsCert.pem
id = mars.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/swanctl/redirect-active/posttest.dat
+11
View File
@@ -0,0 +1,11 @@
carol::systemctl stop strongswan
dave::systemctl stop strongswan
moon::systemctl stop strongswan
alice::systemctl stop strongswan
alice::cd /etc/swanctl; rm rsa/marsKey.pem x509/marsCert.pem
moon::iptables-restore < /etc/iptables.flush
alice::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
alice::ip addr del 192.168.0.5/24 dev eth1
alice::ifdown eth1
testing/tests/swanctl/redirect-active/pretest.dat
+17
View File
@@ -0,0 +1,17 @@
alice::ifup eth1
alice::ip addr add 192.168.0.5/24 dev eth1
moon::iptables-restore < /etc/iptables.rules
alice::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
alice::cd /etc/swanctl; rm rsa/aliceKey.pem x509/aliceCert.pem
moon::systemctl start strongswan
alice::systemctl start strongswan
carol::systemctl start strongswan
dave::systemctl start strongswan
moon::expect-connection rw
alice::expect-connection rw
carol::expect-connection home
carol::swanctl --initiate --child home
dave::expect-connection home
dave::swanctl --initiate --child home
testing/tests/swanctl/redirect-active/test.conf
+25
View File
@@ -0,0 +1,25 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="venus carol dave"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice moon carol dave"
# charon controlled by swanctl
#
SWANCTL=1