denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Reorganizing IKEv1 and IKEv2 examples

Browse Source 
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen
2021-05-21 09:42:50 +02:00
parent db93938297
commit 7c5a2974b9
4054 changed files with 16375 additions and 15209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/ip-two-pools-db/description.txt
Regular → Executable
+7 -7
View File
@@ -1,14 +1,14 @@
The hosts <b>alice</b>, <b>venus</b>, <b>carol</b>, and <b>dave</b> set up tunnel connections
to gateway <b>moon</b> in a <b>hub-and-spoke</b> fashion. Each host requests a <b>virtual IP</b>
with the <b>leftsourceip=%config</b> parameter. Gateway <b>moon</b> assigns virtual
IP addresses from a pool named <b>extpool</b> [10.3.0.1..10.3.1.244] to hosts connecting
to the <b>eth0</b> (PH_IP_MOON) interface and virtual IP addresses from a pool named <b>intpool</b>
[10.4.0.1..10.4.1.244] to hosts connecting to the <b>eth1</b> (PH_IP_MOON1) interface.
to gateway <b>moon</b> in a <b>hub-and-spoke</b> fashion. Each host requests a <b>virtual IP</b>
from gateway <b>moon</b> which assigns virtual IP addresses from a pool named <b>extpool</b>
[10.3.0.1..10.3.1.244] to hosts connecting to the <b>eth0</b> (PH_IP_MOON) interface and virtual
IP addresses from a pool named <b>intpool</b> [10.4.0.1..10.4.1.244] to hosts connecting to
the <b>eth1</b> (PH_IP_MOON1) interface.
Thus <b>carol</b> and <b>dave</b> are assigned <b>PH_IP_CAROL1</b> and <b>PH_IP_DAVE1</b>,
respectively, whereas <b>alice</b> and <b>venus</b> get <b>10.4.0.1</b> and <b>10.4.0.2</b>,
respectively.
<p>
By defining the composite IPsec SA: <b>rightsubnet=10.3.0.0/16,10.4.0.0/16</b>, each of the four
<p>
By defining the composite traffic selector <b>10.3.0.0/16,10.4.0.0/16</b>, each of the four
spokes can securely reach any other spoke via the central hub <b>moon</b>. This is
demonstrated by <b>alice</b> and <b>dave</b> pinging the assigned virtual IP addresses
of <b>carol</b> and <b>venus</b>.
testing/tests/ikev2/ip-two-pools-db/evaltest.dat
Regular → Executable
+8 -16
View File
@@ -1,19 +1,3 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
alice::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
venus::ipsec status 2> /dev/null::home.*ESTABLISHED.*venus.strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
alice::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
venus::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::ext\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
moon:: ipsec status 2> /dev/null::ext\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
moon:: ipsec status 2> /dev/null::int\[3]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
moon:: ipsec status 2> /dev/null::int\[4]: ESTABLISHED.*moon.strongswan.org.*venus.strongswan.org::YES
moon:: ipsec status 2> /dev/null::ext[{]1}.*INSTALLED. TUNNEL::YES
moon:: ipsec status 2> /dev/null::ext[{]2}.*INSTALLED. TUNNEL::YES
moon:: ipsec status 2> /dev/null::int[{]3}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::int[{]4}.*INSTALLED, TUNNEL::YES
moon:: ipsec pool --status 2> /dev/null::extpool.*10.3.0.1.*10.3.1.244.*48h.*2::YES
moon:: ipsec pool --status 2> /dev/null::intpool.*10.4.0.1.*10.4.1.244.*static.*2::YES
moon:: ipsec pool --leases --filter pool=extpool,addr=10.3.0.1,[email protected] 2> /dev/null::online::YES
@@ -32,6 +16,14 @@ alice::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_.eq=1::YES
dave:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_.eq=1::YES
alice::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_.eq=1::YES
dave:: ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_.eq=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*local-vips=\[10.3.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.3.0.0/16 10.4.0.0/16]::YES
dave::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*local-vips=\[10.3.0.2] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.2/32] remote-ts=\[10.3.0.0/16 10.4.0.0/16]::YES
alice:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 [email protected] remote-host=10.1.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*local-vips=\[10.4.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.4.0.1/32] remote-ts=\[10.3.0.0/16 10.4.0.0/16]::YES
venus:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=10.1.0.20 local-port=4500 local-id=venus.strongswan.org remote-host=10.1.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*local-vips=\[10.4.0.2] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.4.0.2/32] remote-ts=\[10.3.0.0/16 10.4.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ext.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*remote-vips=\[10.3.0.1] child-sas.*ext.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.0/16 10.4.0.0/16] remote-ts=\[10.3.0.1/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::ext.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*remote-vips=\[10.3.0.2] child-sas.*ext.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.0/16 10.4.0.0/16] remote-ts=\[10.3.0.2/32]::YES
moon:: swanctl --list-sas --ike-id 3 --raw 2> /dev/null::int.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=10.1.0.10 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*remote-vips=\[10.4.0.1] child-sas.*int.*reqid=3 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.0/16 10.4.0.0/16] remote-ts=\[10.4.0.1/32]::YES
moon:: swanctl --list-sas --ike-id 4 --raw 2> /dev/null::int.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=10.1.0.20 remote-port=4500 remote-id=venus.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*remote-vips=\[10.4.0.2] child-sas.*int.*reqid=4 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.0/16 10.4.0.0/16] remote-ts=\[10.4.0.2/32]::YES
alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES
alice::tcpdump::IP moon1.strongswan.org > alice.strongswan.org: ESP::YES
dave::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=%defaultroute
leftsourceip=%config
leftcert=aliceCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON1
[email protected]
rightsubnet=10.3.0.0/16,10.4.0.0/16
auto=add
testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici resolve
}
testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 10.1.0.10
remote_addrs = 10.1.0.1
vips = 0.0.0.0
local {
auth = pubkey
certs = aliceCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.3.0.0/16,10.4.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ip-two-pools-db/hosts/carol/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=PH_IP_CAROL
leftsourceip=%config
leftcert=carolCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
[email protected]
rightsubnet=10.3.0.0/16,10.4.0.0/16
auto=add
testing/tests/ikev2/ip-two-pools-db/hosts/carol/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici resolve
}
testing/tests/ikev2/ip-two-pools-db/hosts/carol/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
vips = 0.0.0.0
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.3.0.0/16,10.4.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=PH_IP_DAVE
leftsourceip=%config
leftcert=daveCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON
[email protected]
rightsubnet=10.3.0.0/16,10.4.0.0/16
auto=add
testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici resolve
}
testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
vips = 0.0.0.0
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.3.0.0/16,10.4.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/ipsec.conf
-26
View File
@@ -1,26 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
leftcert=moonCert.pem
[email protected]
leftfirewall=yes
right=%any
conn int
left=PH_IP_MOON1
leftsubnet=10.3.0.0/16,10.4.0.0/16
rightsourceip=%intpool
auto=add
conn ext
left=PH_IP_MOON
leftsubnet=10.3.0.0/16,10.4.0.0/16
rightsourceip=%extpool
auto=add
testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/strongswan.conf
Regular → Executable
+8 -3
View File
@@ -1,7 +1,11 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke sqlite attr-sql kernel-netlink socket-default updown
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl sqlite attr-sql kernel-netlink socket-default updown vici
plugins {
attr-sql {
@@ -12,4 +16,5 @@ charon {
pool {
load = sqlite
}
database = sqlite:///etc/db.d/ipsec.db
}
testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/swanctl/swanctl.conf
Executable
+48
View File
@@ -0,0 +1,48 @@
connections {
ext {
local_addrs = 192.168.0.1
pools = extpool
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
ext {
local_ts = 10.3.0.0/16,10.4.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
int {
local_addrs = 10.1.0.1
pools = intpool
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
int {
local_ts = 10.3.0.0/16,10.4.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/ipsec.conf
-21
View File
@@ -1,21 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=%defaultroute
leftsourceip=%config
leftcert=venusCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_MOON1
[email protected]
rightsubnet=10.3.0.0/16,10.4.0.0/16
auto=add
testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/strongswan.conf
Regular → Executable
+6 -2
View File
@@ -1,5 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown resolve
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici resolve
}
testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/swanctl/swanctl.conf
Executable
+27
View File
@@ -0,0 +1,27 @@
connections {
home {
local_addrs = 10.1.0.20
remote_addrs = 10.1.0.1
vips = 0.0.0.0
local {
auth = pubkey
certs = venusCert.pem
id = venus.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.3.0.0/16,10.4.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
testing/tests/ikev2/ip-two-pools-db/posttest.dat
Regular → Executable
+8 -7
View File
@@ -1,13 +1,13 @@
alice::ipsec stop
venus::ipsec stop
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
alice::iptables-restore < /etc/iptables.flush
venus::iptables-restore < /etc/iptables.flush
carol::systemctl stop strongswan
dave::systemctl stop strongswan
alice::systemctl stop strongswan
venus::systemctl stop strongswan
moon::systemctl stop strongswan
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
alice::iptables-restore < /etc/iptables.flush
venus::iptables-restore < /etc/iptables.flush
moon::ip route del 10.3.0.0/16 via PH_IP_MOON
moon::ip route del 10.4.0.0/16 via PH_IP_MOON1
moon::ipsec pool --del extpool 2> /dev/null
@@ -15,3 +15,4 @@ moon::ipsec pool --del intpool 2> /dev/null
moon::ipsec pool --delattr dns --server PH_IP_VENUS --pool intpool --identity venus.strongswan.org 2> /dev/null
moon::ipsec pool --delattr dns --server PH_IP_ALICE --pool intpool --identity [email protected] 2> /dev/null
moon::ipsec pool --delattr dns --server PH_IP_WINNETOU --pool extpool 2> /dev/null
testing/tests/ikev2/ip-two-pools-db/pretest.dat
Regular → Executable
+11 -11
View File
@@ -8,23 +8,23 @@ moon::ipsec pool --addattr dns --server PH_IP_WINNETOU --pool extpool 2> /dev/nu
moon::ipsec pool --statusattr 2> /dev/null
moon::ip route add 10.3.0.0/16 via PH_IP_MOON
moon::ip route add 10.4.0.0/16 via PH_IP_MOON1
alice::iptables-restore < /etc/iptables.rules
venus::iptables-restore < /etc/iptables.rules
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
alice::ipsec start
venus::ipsec start
carol::ipsec start
dave::ipsec start
alice::iptables-restore < /etc/iptables.rules
venus::iptables-restore < /etc/iptables.rules
moon::systemctl start strongswan
carol::systemctl start strongswan
dave::systemctl start strongswan
alice::systemctl start strongswan
venus::systemctl start strongswan
moon::expect-connection int
moon::expect-connection ext
carol::expect-connection home
carol::ipsec up home
carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home
dave::ipsec up home
dave::swanctl --initiate --child home 2> /dev/null
alice::expect-connection home
alice::ipsec up home
alice::swanctl --initiate --child home 2> /dev/null
venus::expect-connection home
venus::ipsec up home
venus::swanctl --initiate --child home 2> /dev/null
testing/tests/ikev2/ip-two-pools-db/test.conf
Regular → Executable
+4
View File
@@ -23,3 +23,7 @@ IPSECHOSTS="alice venus moon carol dave"
# Guest instances on which databases are used
#
DBHOSTS="moon"
# charon controlled by swanctl
#
SWANCTL=1