testing: Migrated p2pnat/medsrv-psk scenario to vici

2021-03-30 22:12:00 +02:00
parent 03e1272ff2
commit 66ba50b217
16 changed files with 166 additions and 132 deletions
@@ -1,34 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	keyexchange=ikev2
-	mobike=no
-	dpdaction=restart
-	dpddelay=60s
-	left=%defaultroute
-	leftfirewall=yes
-
-conn medsrv
-	[email protected]
-	leftauth=psk
-	right=PH_IP_CAROL
-	[email protected]
-	rightauth=pubkey
-	mediation=yes
-	auto=start
-
-conn peer
-	leftcert=bobCert.pem
-	[email protected]
-	right=%any
-	[email protected]
-	rightsubnet=PH_IP_ALICE/32
-	mediated_by=medsrv
-	[email protected]
-	auto=add
@@ -1,7 +0,0 @@
-# /etc/ipsec.secrets - strongSwan IPsec secrets file
-
-: RSA bobKey.pem
-
-# secret used for mediation connection
-
-[email protected] : PSK "ZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt"
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file

 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
 }
@@ -0,0 +1,57 @@
+connections {
+
+   medsrv {
+      remote_addrs  = 192.168.0.100
+
+      local {
+         auth = psk
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = [email protected]
+      }
+      children {
+         medserv {
+           start_action = start
+         }
+      }
+      version = 2
+      mobike = no
+      mediation = yes
+      proposals = aes128-sha256-x25519
+   }
+
+   peer {
+      local {
+         auth = pubkey
+         certs = bobCert.pem
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = [email protected]
+      }
+      children {
+         peer {
+            remote_ts = 10.1.0.10
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128gcm128-x25519
+          }
+      }
+      version = 2
+      mobike = no
+      mediated_by = medsrv
+      mediation_peer = [email protected]
+      proposals = aes128-sha256-x25519
+   }
+}
+
+secrets {
+
+   ike-medsrv {
+      id = [email protected]
+      secret = 0sZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt
+   }
+}