denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adapt test configurations

Browse Source 
Adapt test configurations to the new Debian-based system.
This commit is contained in:
Reto Buerki
2013-01-17 15:22:07 +01:00
committed by Tobias Brunner
parent 766466b8d1
commit 533177003c
394 changed files with 791 additions and 2576 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/nat-rw-mark/description.txt
+1 -1
View File
@@ -1,7 +1,7 @@
The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up
tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT
after ESP decryption to map these subnets to 10.3.0.10 and 10.3.0.20, respectively.
after ESP decryption to map these subnets to PH_IP_CAROL10 and PH_IP_DAVE10, respectively.
<p/>
In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively,
<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using
testing/tests/ikev2/nat-rw-mark/evaltest.dat
+10 -10
View File
@@ -6,13 +6,13 @@ sun:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*sun.strongswan.org.*alice@
sun:: ipsec status 2> /dev/null::venus.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES
sun:: ipsec statusall 2> /dev/null::alice.*10.2.0.0/16 === 10.1.0.0/25::YES
sun:: ipsec statusall 2> /dev/null::venus.*10.2.0.0/16 === 10.1.0.0/25::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.4510.*: UDP::YES
moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.4520.*: UDP::YES
bob::tcpdump::10.3.0.10 > bob.strongswan.org: ICMP echo request::YES
bob::tcpdump::10.3.0.20 > bob.strongswan.org: ICMP echo request::YES
bob::tcpdump::bob.strongswan.org > 10.3.0.10: ICMP echo reply::YES
bob::tcpdump::bob.strongswan.org > 10.3.0.20: ICMP echo reply::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.4500: UDP::YES
moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.4500: UDP::YES
moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.4510.*: UDP::YES
moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.4520.*: UDP::YES
bob::tcpdump::PH_IP_CAROL10 > bob.strongswan.org: ICMP echo request::YES
bob::tcpdump::PH_IP_DAVE10 > bob.strongswan.org: ICMP echo request::YES
bob::tcpdump::bob.strongswan.org > PH_IP_CAROL10: ICMP echo reply::YES
bob::tcpdump::bob.strongswan.org > PH_IP_DAVE10: ICMP echo reply::YES
testing/tests/ikev2/nat-rw-mark/posttest.dat
+2 -1
View File
@@ -5,7 +5,8 @@ venus::ipsec stop
alice::/etc/init.d/iptables stop 2> /dev/null
venus::/etc/init.d/iptables stop 2> /dev/null
sun::/etc/init.d/iptables stop 2> /dev/null
moon::iptables -t nat -F
moon::iptables-restore < /etc/iptables.flush
moon::conntrack -F
sun::iptables-restore < /etc/iptables.flush
sun::conntrack -F
sun::rm /etc/mark_updown
testing/tests/ikev2/nat-rw-mark/pretest.dat
+6 -7
View File
@@ -1,21 +1,20 @@
sun::/etc/init.d/iptables start 2> /dev/null
alice::/etc/init.d/iptables start 2> /dev/null
venus::/etc/init.d/iptables start 2> /dev/null
moon::echo 1 > /proc/sys/net/ipv4/ip_forward
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to PH_IP_MOON
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 500 -j SNAT --to PH_IP_MOON:510
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 500 -j SNAT --to PH_IP_MOON:520
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4510
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4520
sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to 10.3.0.10
sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to 10.3.0.20
sun::iptables -t mangle -A PREROUTING -d 10.3.0.10 -j MARK --set-mark 10
sun::iptables -t mangle -A PREROUTING -d 10.3.0.20 -j MARK --set-mark 20
sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to PH_IP_CAROL10
sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to PH_IP_DAVE10
sun::iptables -t mangle -A PREROUTING -d PH_IP_CAROL10 -j MARK --set-mark 10
sun::iptables -t mangle -A PREROUTING -d PH_IP_DAVE10 -j MARK --set-mark 20
sun::ipsec start
alice::ipsec start
venus::ipsec start
alice::sleep 2
alice::sleep 2
alice::ipsec up nat-t
venus::sleep 2
venus::sleep 2
venus::ipsec up nat-t
venus::sleep 2