testing: Converted tnc scenarios to swanctl

2015-12-11 18:26:54 +01:00
parent 74270c8c86
commit 6aa7703122
386 changed files with 5091 additions and 2383 deletions
@@ -1,6 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file

 libimcv {
+  load = random nonce sha1 sha2 md5 gmp pubkey x509
  debug_level = 3 
  assessment_result = no
  plugins {
@@ -1 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
@@ -1 +0,0 @@
-# /etc/ipsec.secrets - strongSwan IPsec secrets file
@@ -1,6 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file

 libimcv {
+  load = random nonce sha1 sha2 md5 gmp pubkey x509
  debug_level = 3
  plugins {
    imc-test {
@@ -0,0 +1 @@
+# The strongSwan IMCs are loaded by the WPA supplicant
@@ -1 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
@@ -1 +0,0 @@
-# /etc/ipsec.secrets - strongSwan IPsec secrets file
@@ -1,6 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file

 libimcv {
+  load = random nonce sha1 sha2 md5 gmp pubkey x509
  debug_level = 3
  plugins {
    imc-test {
@@ -0,0 +1 @@
+# The strongSwan IMCs are loaded by the WPA supplicant
@@ -1,33 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	keyexchange=ikev2
-
-conn rw-allow
-	rightgroups=allow
-	leftsubnet=10.1.0.0/28
-	also=rw-eap
-	auto=add
-
-conn rw-isolate
-	rightgroups=isolate
-	leftsubnet=10.1.0.16/28
-	also=rw-eap
-	auto=add
-
-conn rw-eap
-	left=PH_IP_MOON
-	leftcert=moonCert.pem
-	[email protected]
-	leftauth=pubkey
-	leftfirewall=yes
-	rightauth=eap-radius
-	rightid=*@strongswan.org
-	rightsendcert=never
-	right=%any
@@ -1,3 +0,0 @@
-# /etc/ipsec.secrets - strongSwan IPsec secrets file
-
-: RSA moonKey.pem
@@ -1,32 +0,0 @@
-*filter
-
-# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
-
-# allow esp
-A INPUT  -i eth0 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT
-
-# allow IKE
-A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
-# allow MobIKE
-A INPUT  -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
-# allow ssh
-A INPUT  -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
-
-# allow crl fetch from winnetou
-A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
-# allow RADIUS protocol with alice
-A INPUT  -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
-COMMIT
@@ -1,13 +0,0 @@
-# /etc/strongswan.conf - strongSwan configuration file
-
-charon {
-  load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default eap-radius updown
-  multiple_authentication=no
-  plugins {
-    eap-radius {
-      secret = gv6URkSs 
-      server = PH_IP_ALICE
-      filter_id = yes
-    }
-  }
-}
@@ -13,14 +13,17 @@ DIAGRAM="a-v-m-c-w-d.png"

 # Guest instances on which tcpdump is to be started
 #
-TCPDUMPHOSTS="moon"
+TCPDUMPHOSTS=

 # Guest instances on which IPsec is started
 # Used for IPsec logging purposes
 #
-IPSECHOSTS="moon carol dave"
+IPSECHOSTS="carol dave"

 # Guest instances on which FreeRadius is started
 #
 RADIUSHOSTS="alice"

+# charon controlled by swanctl
+#
+SWANCTL=1
				`@@ -1 +0,0 @@`
				`# /etc/ipsec.conf - strongSwan IPsec configuration file`
				`@@ -1 +0,0 @@`
				`# /etc/ipsec.secrets - strongSwan IPsec secrets file`
				`@@ -0,0 +1 @@`
				`# The strongSwan IMCs are loaded by the WPA supplicant`