From 5061a2af1ac5489a58ce30a777656c2c6449d27f Mon Sep 17 00:00:00 2001 From: Andreas Steffen Date: Tue, 4 Jul 2006 06:13:54 +0000 Subject: [PATCH] added --- testing/tests/ikev2/wildcards/description.txt | 8 +++++ testing/tests/ikev2/wildcards/evaltest.dat | 8 +++++ .../wildcards/hosts/carol/etc/ipsec.conf | 25 ++++++++++++++++ .../ikev2/wildcards/hosts/dave/etc/ipsec.conf | 25 ++++++++++++++++ .../ikev2/wildcards/hosts/moon/etc/ipsec.conf | 29 +++++++++++++++++++ testing/tests/ikev2/wildcards/posttest.dat | 3 ++ testing/tests/ikev2/wildcards/pretest.dat | 10 +++++++ testing/tests/ikev2/wildcards/test.conf | 21 ++++++++++++++ 8 files changed, 129 insertions(+) create mode 100644 testing/tests/ikev2/wildcards/description.txt create mode 100644 testing/tests/ikev2/wildcards/evaltest.dat create mode 100755 testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf create mode 100755 testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf create mode 100755 testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ikev2/wildcards/posttest.dat create mode 100644 testing/tests/ikev2/wildcards/pretest.dat create mode 100644 testing/tests/ikev2/wildcards/test.conf diff --git a/testing/tests/ikev2/wildcards/description.txt b/testing/tests/ikev2/wildcards/description.txt new file mode 100644 index 000000000..e485f7066 --- /dev/null +++ b/testing/tests/ikev2/wildcards/description.txt @@ -0,0 +1,8 @@ +The VPN gateway moon controls the access to the hosts alice and +venus by means of wildcard parameters that must match the subject +Distinguished Name contained in the peer's X.509 certificate. Access to +alice is granted for DNs containing a OU=Research field whereas venus +can only be reached with a DN containing OU=Accounting. The roadwarriors +carol and dave belong to the departments 'Research' and 'Accounting', +respectively. Therefore carol can access alice and dave +can reach venus. diff --git a/testing/tests/ikev2/wildcards/evaltest.dat b/testing/tests/ikev2/wildcards/evaltest.dat new file mode 100644 index 000000000..2bc83eacd --- /dev/null +++ b/testing/tests/ikev2/wildcards/evaltest.dat @@ -0,0 +1,8 @@ +carol::ipsec status::alice.*PH_IP_CAROL.*PH_IP_ALICE::YES +moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_CAROL::YES +carol::ipsec status::venus.*PH_IP_CAROL.*PH_IP_VENUS::NO +moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_CAROL::NO +dave::ipsec status::venus.*PH_IP_DAVE.*PH_IP_VENUS::YES +moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_DAVE::YES +dave::ipsec status::alice.*PH_IP_DAVE.*PH_IP_ALICE::NO +moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_DAVE::NO diff --git a/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..739642776 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..886d64339 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..ec252a864 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn alice + leftsubnet=PH_IP_ALICE/32 + right=%any + rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*" + auto=add + +conn venus + leftsubnet=PH_IP_VENUS/32 + right=%any + rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*" + auto=add + diff --git a/testing/tests/ikev2/wildcards/posttest.dat b/testing/tests/ikev2/wildcards/posttest.dat new file mode 100644 index 000000000..ed530f6d9 --- /dev/null +++ b/testing/tests/ikev2/wildcards/posttest.dat @@ -0,0 +1,3 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop diff --git a/testing/tests/ikev2/wildcards/pretest.dat b/testing/tests/ikev2/wildcards/pretest.dat new file mode 100644 index 000000000..d42d935ab --- /dev/null +++ b/testing/tests/ikev2/wildcards/pretest.dat @@ -0,0 +1,10 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 1 +carol::ipsec up alice +carol::ipsec up venus +dave::ipsec up venus +dave::ipsec up alice +carol::sleep 1 diff --git a/testing/tests/ikev2/wildcards/test.conf b/testing/tests/ikev2/wildcards/test.conf new file mode 100644 index 000000000..08e5cc145 --- /dev/null +++ b/testing/tests/ikev2/wildcards/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave"