denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Reorganizing IKEv1 and IKEv2 examples

Browse Source 
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
This commit is contained in:
Andreas Steffen
2021-05-21 09:42:50 +02:00
parent db93938297
commit 7c5a2974b9
4054 changed files with 16375 additions and 15209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/nat-rw-psk/description.txt
+3 -2
View File
@@ -2,6 +2,7 @@ The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>
tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
Each roadwarrior shares its own Pre-Shared Key (PSK) with the gateway <b>sun</b>.
<p/>
<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass
the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b>
Upon the successful establishment of the IPsec tunnels, the updown script automatically
inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b>
ping the client <b>bob</b> behind the gateway <b>sun</b>.
testing/tests/ikev2/nat-rw-psk/evaltest.dat
+12 -7
View File
@@ -1,9 +1,14 @@
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL.*ESP in UDP::YES
venus::ipsec status 2> /dev/null::nat-t.*INSTALLED. TUNNEL.*ESP in UDP::YES
sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL.*ESP in UDP::YES
sun:: ipsec status 2> /dev/null::nat-t.*\[PH_IP_ALICE\]::YES
sun:: ipsec status 2> /dev/null::nat-t.*\[PH_IP_VENUS\]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.\(4500\|ipsec-nat-t\): UDP::YES
moon::tcpdump::IP sun.strongswan.org.\(4500\|ipsec-nat-t\) > moon.strongswan.org.*: UDP::YES
moon:: sleep 6::no output expected::NO
bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
alice::swanctl --list-sas --raw 2> /dev/null::nat-t.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 local-id=10.1.0.10 remote-host=192.168.0.2 remote-port=4500 remote-id=192.168.0.2 initiator=yes.*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*nat-t.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32] remote-ts=\[10.2.0.0/16]::YES
venus::swanctl --list-sas --raw 2> /dev/null::nat-t.*version=2 state=ESTABLISHED local-host=10.1.0.20 local-port=4500 local-id=10.1.0.20 remote-host=192.168.0.2 remote-port=4500 remote-id=192.168.0.2 initiator=yes.*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*nat-t.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.20/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw --ike-id 1 2> /dev/null::nat-t.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=192.168.0.2 remote-host=192.168.0.1.*remote-id=10.1.0.10.*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*name=nat-t.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.10/32]::YES
sun:: swanctl --list-sas --raw --ike-id 2 2> /dev/null::nat-t.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=192.168.0.2 remote-host=192.168.0.1.*remote-id=10.1.0.20.*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*name=nat-t.*reqid=2 state=INSTALLED mode=TUNNEL protocol=ESP encap=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.20/32]:YES
moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.\(4500\|ipsec-nat-t\): UDP-encap: ESP::YES
moon::tcpdump::IP sun.strongswan.org.\(4500\|ipsec-nat-t\) > moon.strongswan.org.*: UDP-encap: ESP::YES
moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.\(4500\|ipsec-nat-t\): isakmp-nat-keep-alive::YES
alice::cat /var/log/daemon.log::sending keep alive::YES
venus::cat /var/log/daemon.log::sending keep alive::YES
testing/tests/ikev2/nat-rw-psk/hosts/alice/etc/ipsec.conf
-18
View File
@@ -1,18 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
authby=secret
conn nat-t
left=%defaultroute
leftfirewall=yes
right=PH_IP_SUN
rightsubnet=10.2.0.0/16
auto=add
testing/tests/ikev2/nat-rw-psk/hosts/alice/etc/ipsec.secrets
-3
View File
@@ -1,3 +0,0 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
PH_IP_ALICE : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
testing/tests/ikev2/nat-rw-psk/hosts/alice/etc/strongswan.conf
+3 -1
View File
@@ -1,5 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 hmac stroke kernel-netlink socket-default updown
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
keep_alive = 5
}
testing/tests/ikev2/nat-rw-psk/hosts/alice/etc/swanctl/swanctl.conf
Executable
+33
View File
@@ -0,0 +1,33 @@
connections {
nat-t {
local_addrs = 10.1.0.10
remote_addrs = 192.168.0.2
local {
auth = psk
id = 10.1.0.10
}
remote {
auth = psk
id = 192.168.0.2
}
children {
nat-t {
remote_ts = 10.2.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
secrets {
ike-sun {
id = 192.168.0.2
secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
}
}
testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/ipsec.conf
-19
View File
@@ -1,19 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
authby=secret
conn nat-t
left=PH_IP_SUN
leftsubnet=10.2.0.0/16
leftfirewall=yes
right=%any
rightsubnet=10.1.0.0/16
auto=add
testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/ipsec.secrets
-5
View File
@@ -1,5 +0,0 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
PH_IP_ALICE : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
PH_IP_VENUS : PSK 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br
testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/strongswan.conf
+1 -1
View File
@@ -1,5 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 hmac stroke kernel-netlink socket-default updown
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
}
testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/swanctl/swanctl.conf
Executable
+36
View File
@@ -0,0 +1,36 @@
connections {
nat-t {
local_addrs = 192.168.0.2
local {
auth = psk
id = 192.168.0.2
}
remote {
auth = psk
}
children {
nat-t {
local_ts = 10.2.0.0/16
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
secrets {
ike-alice {
id = 10.1.0.10
secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
}
ike-venus {
id = 10.1.0.20
secret = 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br
}
}
testing/tests/ikev2/nat-rw-psk/hosts/venus/etc/ipsec.conf
-18
View File
@@ -1,18 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
authby=secret
conn nat-t
left=%defaultroute
leftfirewall=yes
right=PH_IP_SUN
rightsubnet=10.2.0.0/16
auto=add
testing/tests/ikev2/nat-rw-psk/hosts/venus/etc/ipsec.secrets
-3
View File
@@ -1,3 +0,0 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
PH_IP_VENUS : PSK 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br
testing/tests/ikev2/nat-rw-psk/hosts/venus/etc/strongswan.conf
+3 -1
View File
@@ -1,5 +1,7 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 hmac stroke kernel-netlink socket-default updown
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
keep_alive = 5
}
testing/tests/ikev2/nat-rw-psk/hosts/venus/etc/swanctl/swanctl.conf
Executable
+34
View File
@@ -0,0 +1,34 @@
connections {
nat-t {
local_addrs = 10.1.0.20
remote_addrs = 192.168.0.2
local {
auth = psk
id = 10.1.0.20
}
remote {
auth = psk
id = 192.168.0.2
}
children {
nat-t {
remote_ts = 10.2.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
proposals = aes128-sha256-x25519
}
}
secrets {
ike-sun {
id = 192.168.0.2
secret = 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br
}
}
testing/tests/ikev2/nat-rw-psk/posttest.dat
+3 -3
View File
@@ -1,6 +1,6 @@
sun::ipsec stop
alice::ipsec stop
venus::ipsec stop
sun::systemctl stop strongswan
alice::systemctl stop strongswan
venus::systemctl stop strongswan
alice::iptables-restore < /etc/iptables.flush
venus::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
testing/tests/ikev2/nat-rw-psk/pretest.dat
+8 -8
View File
@@ -1,16 +1,16 @@
alice::iptables-restore < /etc/iptables.rules
venus::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
alice::cd /etc/swanctl; rm x509ca/* x509/* rsa/*
venus::cd /etc/swanctl; rm x509ca/* x509/* rsa/*
sun::cd /etc/swanctl; rm x509ca/* x509/* rsa/*
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
alice::rm /etc/ipsec.d/cacerts/*
venus::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
sun::ipsec start
alice::ipsec start
venus::ipsec start
sun::systemctl start strongswan
alice::systemctl start strongswan
venus::systemctl start strongswan
sun::expect-connection nat-t
alice::expect-connection nat-t
alice::ipsec up nat-t
alice::swanctl --initiate --child nat-t
venus::expect-connection nat-t
venus::ipsec up nat-t
venus::swanctl --initiate --child nat-t
testing/tests/ikev2/nat-rw-psk/test.conf
+4
View File
@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus sun"
# charon controlled by swanctl
#
SWANCTL=1