denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Add ikev2/host2host-transport-nat scenario

Browse Source
This commit is contained in:
Tobias Brunner
2014-01-23 10:27:13 +01:00
parent 62e050e0ef
commit 571025a609
9 changed files with 146 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/host2host-transport-nat/description.txt
+13
View File
@@ -0,0 +1,13 @@
An IPsec <b>transport-mode</b> connection between the natted host <b>alice</b> and gateway <b>sun</b>
is successfully set up. <b>leftfirewall=yes</b> automatically inserts iptables-based firewall
rules that let pass the decrypted IP packets. In order to test the host-to-host connection
<b>alice</b> pings <b>sun</b>.<br/>
<b>Note:</b> This scenario also demonstrates two problems with transport-mode and NAT traversal:
<ol>
<li>The client <b>venus</b> behind the same NAT as client <b>alice</b> is not able to ping <b>sun</b>
(even with ICMP explicitly allowed there) because the request arrives unencrypted and thus gets
dropped when the IPsec policies are consulted (increases the <em>XfrmInTmplMismatch</em> counter
in <em>/proc/net/xfrm_stat</em>).</li>
<li>A similar issue arises when <b>venus</b> also establishes an IPsec <b>transport-mode</b> connection to
<b>sun</b>, due to the conflicting IPsec policies <b>sun</b> declines such a connection.</li>
</ol>