testing: Add ikev2/shunt-policies-nat-rw scenario

testing/tests/ikev2/shunt-policies-nat-rw/hosts/alice/etc/ipsec.conf

@@ -0,0 +1,27 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn nat-t
+	left=%any
+	leftcert=aliceCert.pem
+	[email protected]
+	leftsourceip=%config
+	right=PH_IP_SUN
+	[email protected]
+	rightsubnet=0.0.0.0/0
+	auto=add
+
+conn local-net
+	leftsubnet=10.1.0.0/16
+	rightsubnet=10.1.0.0/16
+	authby=never
+	type=pass
+	auto=route

testing/tests/ikev2/shunt-policies-nat-rw/hosts/alice/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown
+
+  keep_alive = 5
+}

testing/tests/ikev2/shunt-policies-nat-rw/hosts/sun/etc/ipsec.conf

@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn nat-t
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	[email protected]
+	leftfirewall=yes
+	leftsubnet=0.0.0.0/0
+	right=%any
+	rightsourceip=10.3.0.0/28
+	auto=add

testing/tests/ikev2/shunt-policies-nat-rw/hosts/sun/etc/iptables.rules

@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT  -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT  -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT  -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT

testing/tests/ikev2/shunt-policies-nat-rw/hosts/sun/etc/strongswan.conf

@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown
+}

testing/tests/ikev2/shunt-policies-nat-rw/hosts/venus/etc/ipsec.conf

@@ -0,0 +1,27 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn nat-t
+	left=%any
+	leftcert=venusCert.pem
+	[email protected]
+	leftsourceip=%config
+	right=PH_IP_SUN
+	[email protected]
+	rightsubnet=0.0.0.0/0
+	auto=add
+
+conn local-net
+	leftsubnet=10.1.0.0/16
+	rightsubnet=10.1.0.0/16
+	authby=never
+	type=pass
+	auto=route

testing/tests/ikev2/shunt-policies-nat-rw/hosts/venus/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown
+
+  keep_alive = 5
+}