testing: Migrate ikev2/host2host-transport-nat scenario to vici

This also restores the test as it was before the referenced commit so it again, as written in the description, demonstrates that venus is unable to ping sun without IPsec tunnel. Fixes: f27fb58ae0 ("testing: Update description and test evaluation of host2host-transport-nat")
2021-06-21 12:03:36 +02:00
parent 2b5c743952
commit 6d8890767c
19 changed files with 133 additions and 73 deletions
@@ -0,0 +1,18 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn nat-t
+	leftcert=venusCert.pem
+	[email protected]
+	leftfirewall=yes
+	right=192.168.0.2
+	[email protected]
+	type=transport
+	auto=add
@@ -0,0 +1,9 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
+}
@@ -0,0 +1,26 @@
+connections {
+
+   host-host {
+      remote_addrs = 192.168.0.2
+
+      local {
+         auth = pubkey
+         certs = venusCert.pem
+         id = venus.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = sun.strongswan.org
+      }
+      children {
+         host-host {
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128gcm128-x25519
+            mode = transport
+         }
+      }
+      version = 2
+      mobike = no
+      proposals = aes128-sha256-x25519
+   }
+}