denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Reorganizing IKEv1 and IKEv2 examples

Browse Source 
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen
2021-05-21 09:42:50 +02:00
parent db93938297
commit 7c5a2974b9
4054 changed files with 16375 additions and 15209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev1/protoport-dual/description.txt
+8 -6
View File
@@ -1,6 +1,8 @@
Using the <b>left|rightprotoport</b> selectors, two IPsec tunnels
between the roadwarrior <b>carol</b> and the gateway <b>moon</b> are
defined. The first IPsec SA is restricted to ICMP packets and the second
covers TCP-based SSH connections. The established tunnels are tested
by <b>carol</b> by first pinging <b>alice</b> behind <b>moon</b> and
then setting up an SSH session to the same client.
Using <b>[&lt;protocol&gt;/&lt;port&gt;]</b> selectors in the
<b>local_ts</b> and <b>remote_ts</b> child parameters, two IPsec tunnels
between the roadwarrior <b>carol</b> and the gateway <b>moon</b> are defined.
The first CHILD_SA is restricted to ICMP packets and the second
covers TCP-based SSH connections.
<p/>
The established tunnels are tested by <b>carol</b> by first pinging <b>alice</b>
behind <b>moon</b> and then setting up an SSH session to the same client.
testing/tests/ikev1/protoport-dual/evaltest.dat
+2 -4
View File
@@ -1,9 +1,7 @@
carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_.eq=1::YES
carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=1 state=ESTABLISHED local-host=192.168.0.100 local-port=500 [email protected] remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*icmp.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32\[icmp]] remote-ts=\[10.1.0.0/16\[icmp]].*ssh.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128 dh-group=CURVE_25519.*local-ts=\[192.168.0.100/32\[tcp]] remote-ts=\[10.1.0.0/16\[tcp/ssh]::YES
moon::swanctl --list-sas --raw 2> /dev/null::rw.*version=1 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*icmp.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16\[icmp]] remote-ts=\[192.168.0.100/32\[icmp]].*ssh.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128 dh-group=CURVE_25519.*local-ts=\[10.1.0.0/16\[tcp/ssh]] remote-ts=\[192.168.0.100/32\[tcp]]::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
testing/tests/ikev1/protoport-dual/hosts/carol/etc/ipsec.conf
-26
View File
@@ -1,26 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
left=PH_IP_CAROL
leftcert=carolCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
[email protected]
auto=add
conn home-icmp
leftprotoport=icmp
rightprotoport=icmp
conn home-ssh
leftprotoport=tcp
rightprotoport=tcp/ssh
testing/tests/ikev1/protoport-dual/hosts/carol/etc/strongswan.conf
+2 -2
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
}
testing/tests/ikev1/protoport-dual/hosts/carol/etc/swanctl/swanctl.conf
Executable
+35
View File
@@ -0,0 +1,35 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
icmp {
local_ts = dynamic[icmp]
remote_ts = 10.1.0.0/16[icmp]
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
ssh {
local_ts = dynamic[tcp]
remote_ts = 10.1.0.0/16[tcp/ssh]
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 1
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev1/protoport-dual/hosts/moon/etc/ipsec.conf
-26
View File
@@ -1,26 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
left=PH_IP_MOON
leftcert=moonCert.pem
[email protected]
leftfirewall=yes
leftsubnet=10.1.0.0/16
right=%any
auto=add
conn rw-icmp
lefthostaccess=yes
leftprotoport=icmp
rightprotoport=icmp
conn rw-ssh
leftprotoport=tcp/ssh
rightprotoport=tcp
testing/tests/ikev1/protoport-dual/hosts/moon/etc/strongswan.conf
+2 -2
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
}
testing/tests/ikev1/protoport-dual/hosts/moon/etc/swanctl/swanctl.conf
Executable
+35
View File
@@ -0,0 +1,35 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
icmp {
local_ts = 10.1.0.0/16[icmp]
remote_ts = dynamic[icmp]
hostaccess = yes
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
ssh {
local_ts = 10.1.0.0/16[tcp/ssh]
remote_ts = dynamic[tcp]
hostaccess = yes
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 1
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev1/protoport-dual/posttest.dat
+3 -2
View File
@@ -1,4 +1,5 @@
moon::ipsec stop
carol::ipsec stop
carol::swanctl --terminate --ike home
carol::systemctl stop strongswan
moon::systemctl stop strongswan
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/ikev1/protoport-dual/pretest.dat
+8 -8
View File
@@ -1,10 +1,10 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
moon::expect-connection rw-icmp
moon::expect-connection rw-ssh
carol::expect-connection home-icmp
carol::expect-connection home-ssh
carol::ipsec up home-icmp
carol::ipsec up home-ssh
moon::systemctl start strongswan
carol::systemctl start strongswan
moon::expect-connection icmp
moon::expect-connection ssh
carol::expect-connection icmp
carol::expect-connection ssh
carol::swanctl --initiate --child icmp 2> /dev/null
carol::swanctl --initiate --child ssh 2> /dev/null
testing/tests/ikev1/protoport-dual/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
# charon controlled by swanctl
#
SWANCTL=1