denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Reorganizing IKEv1 and IKEv2 examples

Browse Source 
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen
2021-05-21 09:42:50 +02:00
parent db93938297
commit 7c5a2974b9
4054 changed files with 16375 additions and 15209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/ip-pool-db/description.txt
Regular → Executable
+6 -5
View File
@@ -1,10 +1,11 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>.
Both <b>carol</b> and <b>dave</b> request a <b>virtual IP</b> via the IKEv2 configuration payload
by using the <b>leftsourceip=%config</b> parameter. The gateway <b>moon</b> assigns virtual IP
addresses from a pool named <b>bigpool</b> that was created in an SQL database by the command
Both <b>carol</b> and <b>dave</b> request a <b>virtual IP</b> via the IKEv2 configuration
payload by using the <b>vips = 0.0.0.0</b> parameter.
<b>moon</b> assigns virtual IP addresses from a pool named <b>bigpool</b> that was created in
an SQL database by the command
<b>ipsec pool --name bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0</b>.
<p>
<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass the
The updown script automatically inserts iptables-based firewall rules that let pass the
tunneled traffic. In order to test the tunnels, <b>carol</b> and <b>dave</b> then ping the client
<b>alice</b> behind the gateway <b>moon</b>. The source IP addresses of the two pings will be the
virtual IPs <b>carol1</b> and <b>dave1</b>, respectively.
virtual IPs <b>10.3.0.1</b> and <b>10.3.0.2</b>, respectively.
testing/tests/ikev2/ip-pool-db/evaltest.dat
Regular → Executable
+15 -30
View File
@@ -1,38 +1,23 @@
carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*local-vips=\[10.3.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*local-vips=\[10.3.0.2] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.2/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*remote-vips=\[10.3.0.1] child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.1/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*remote-vips=\[10.3.0.2] child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.2/32]::YES
moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer.*[email protected]::YES
moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.2 to peer.*[email protected]::YES
moon:: ipsec pool --status 2> /dev/null::big_pool.*10.3.0.1.*10.3.3.232.*static.*2::YES
moon:: ipsec pool --leases --filter pool=big_pool,addr=10.3.0.1,[email protected] 2> /dev/null::online::YES
moon:: ipsec pool --leases --filter pool=big_pool,addr=10.3.0.2,[email protected] 2> /dev/null::online::YES
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
carol::cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES
carol::cat /var/log/daemon.log::installing DNS server PH_IP_VENUS::YES
carol::cat /var/log/daemon.log::handling INTERNAL_IP4_NBNS attribute failed::YES
carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_VENUS::YES
dave:: cat /var/log/daemon.log::handling INTERNAL_IP4_NBNS attribute failed::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
moon::ipsec pool --status 2> /dev/null::dns servers: PH_IP_WINNETOU PH_IP_VENUS::YES
moon::ipsec pool --status 2> /dev/null::nbns servers: PH_IP_VENUS::YES
moon::ipsec pool --status 2> /dev/null::bigpool.*10.3.0.1.*10.3.3.232.*static.*2::YES
moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,[email protected] 2> /dev/null::online::YES
moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,[email protected] 2> /dev/null::online::YES
moon::ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
moon::ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
moon::ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon::ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
alice::ping -c 1 10.3.0.1::64 bytes from 10.3.0.1: icmp_.eq=1::YES
alice::ping -c 1 10.3.0.2::64 bytes from 10.3.0.2: icmp_.eq=1::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/ikev2/ip-pool-db/hosts/carol/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=PH_IP_CAROL
leftsourceip=%config
leftcert=carolCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/tests/ikev2/ip-pool-db/hosts/carol/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default resolve updown vici
}
testing/tests/ikev2/ip-pool-db/hosts/carol/etc/swanctl/swanctl.conf
Executable
+28
View File
@@ -0,0 +1,28 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
vips = 0.0.0.0
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ip-pool-db/hosts/dave/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=PH_IP_DAVE
leftsourceip=%config
leftcert=daveCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
[email protected]
auto=add
testing/tests/ikev2/ip-pool-db/hosts/dave/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default resolve updown vici
}
testing/tests/ikev2/ip-pool-db/hosts/dave/etc/swanctl/swanctl.conf
Executable
+28
View File
@@ -0,0 +1,28 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
vips = 0.0.0.0
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ip-pool-db/hosts/moon/etc/ipsec.conf
-20
View File
@@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn rw
left=PH_IP_MOON
leftsubnet=10.1.0.0/16
leftcert=moonCert.pem
[email protected]
leftfirewall=yes
right=%any
rightsourceip=%bigpool
auto=add
testing/tests/ikev2/ip-pool-db/hosts/moon/etc/strongswan.conf
Regular → Executable
+7 -2
View File
@@ -1,7 +1,11 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default sqlite attr-sql updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown sqlite attr-sql vici
plugins {
attr-sql {
@@ -12,4 +16,5 @@ charon {
pool {
load = sqlite
database = sqlite:///etc/db.d/ipsec.db
}
testing/tests/ikev2/ip-pool-db/hosts/moon/etc/swanctl/swanctl.conf
Executable
+26
View File
@@ -0,0 +1,26 @@
connections {
rw {
local_addrs = 192.168.0.1
pools = big_pool
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ip-pool-db/posttest.dat
Regular → Executable
+6 -4
View File
@@ -1,9 +1,11 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
carol::swanctl --terminate --ike home
dave::swanctl --terminate --ike home
carol::systemctl stop strongswan
dave::systemctl stop strongswan
moon::systemctl stop strongswan
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
moon::ipsec pool --del bigpool 2> /dev/null
moon::ipsec pool --del big_pool 2> /dev/null
moon::ipsec pool --del dns 2> /dev/null
moon::ipsec pool --del nbns 2> /dev/null
testing/tests/ikev2/ip-pool-db/pretest.dat
Regular → Executable
+6 -6
View File
@@ -1,17 +1,17 @@
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql > /etc/db.d/ipsec.sql
moon::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2> /dev/null
moon::ipsec pool --add big_pool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2> /dev/null
moon::ipsec pool --addattr dns --server PH_IP_WINNETOU 2> /dev/null
moon::ipsec pool --addattr dns --server PH_IP_VENUS 2> /dev/null
moon::ipsec pool --addattr nbns --server PH_IP_VENUS 2> /dev/null
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
moon::systemctl start strongswan
carol::systemctl start strongswan
dave::systemctl start strongswan
moon::expect-connection rw
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home
dave::ipsec up home
dave::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/ip-pool-db/test.conf
Regular → Executable
+5 -1
View File
@@ -13,7 +13,7 @@ DIAGRAM="a-m-c-w-d.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
@@ -23,3 +23,7 @@ IPSECHOSTS="moon carol dave"
# Guest instances on which databases are used
#
DBHOSTS="moon"
# charon controlled by swanctl
#
SWANCTL=1