denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Add libipsec scenarios that exchange raw ESP packets

Browse Source
This commit is contained in:
Tobias Brunner
2023-05-23 13:19:47 +02:00
parent e306fa5f73
commit 5db9b26e32
44 changed files with 825 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/libipsec/net2net-cert-ip6-in-ip4/description.txt
+14
View File
@@ -0,0 +1,14 @@
A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
The authentication is based on <b>X.509 certificates</b> and the <b>kernel-libipsec</b>
plugin is used for userland IPsec ESP encryption.
<p/>
Upon the successful establishment of the IPsec tunnel, an updown script automatically
inserts iptables-based firewall rules that let pass the traffic tunneled via the
<b>ipsec0</b> tun interface. In order to test both tunnel and firewall, client <b>alice</b>
behind gateway <b>moon</b> pings client <b>bob</b> located behind gateway <b>sun</b>.
<p/>
This scenario is mainly to test how fragmented IPv6 packets are handled (e.g. determining
the protocol via IPv6 extension headers). Three pings are required due to PMTUD, the first
is rejected by <b>moon</b>, so <b>alice</b> adjusts the MTU. The second gets through,
but the response is rejected by <b>sun</b>, so <b>bob</b> will adjust the MTU. The third
finally is successful.