denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Add ikev2/per-cpu-sas-encap scenario

Browse Source 
Basically the same as the one without UDP encapsulation, but here the
outbound SAs use random source ports.
This commit is contained in:
Tobias Brunner
2025-05-28 16:35:27 +02:00
parent d83fbe82e4
commit 3b2f8cf282
9 changed files with 237 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/per-cpu-sas-encap/pretest.dat
Executable
+16
View File
@@ -0,0 +1,16 @@
sun::iptables-restore < /etc/iptables.rules
moon::iptables-restore < /etc/iptables.rules
sun::systemctl start strongswan
moon::systemctl start strongswan
sun::expect-connection gw-gw
moon::expect-connection gw-gw
# allow UDP encap from any source to 4500
moon::iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
moon::iptables -A OUTPUT -o eth0 -p udp --dport 4500 -j ACCEPT
sun:: iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
sun:: iptables -A OUTPUT -o eth0 -p udp --dport 4500 -j ACCEPT
# triggering packet apparently goes via lo
moon::iptables -A OUTPUT -o lo -d 10.2.0.0/16 -j ACCEPT
# trigger the creation of the fallback SA, use -I so no UDP socket is used to
# determine the source address and trigger the acqurie (this packet is lost)
moon::ping -c 1 -W 1 -I PH_IP_MOON1 PH_IP_BOB