denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

enabled firewall support

Browse Source
This commit is contained in:
Andreas Steffen
2006-09-18 07:41:54 +00:00
parent f9aa9e2977
commit 957115957a
36 changed files with 94 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/crl-revoked/description.txt
+3 -3
View File
@@ -1,4 +1,4 @@
By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on
both roadwarrior <b>carol</b> and gateway <b>moon</b>. <b>carol</b> initiates both roadwarrior <b>carol</b> and gateway <b>moon</b>. The remote host <b>carol</b>
the connection and presents a certificate that has been revoked by the initiates the connection and presents a certificate that has been revoked by the
current CRL.Therefore the IKE negotiation fails current CRL causing the IKE negotiation to fail.
testing/tests/ikev2/crl-strict/description.txt
+1 -1
View File
@@ -1,2 +1,2 @@
By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on By setting <b>strictcrlpolicy=yes</b>, a <b>strict CRL policy</b> is enforced on
both roadwarrior <b>carol</b> and gateway <b>moon</b>. both roadwarrior <b>carol</b> and gateway <b>moon</b>.
testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf
+2 -1
View File
@@ -9,14 +9,15 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn home conn home
left=PH_IP_CAROL left=PH_IP_CAROL
leftnexthop=%direct leftnexthop=%direct
leftcert=selfCert.der leftcert=selfCert.der
leftsendcert=never leftsendcert=never
leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
rightcert=peerCert.der rightcert=peerCert.der
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf
+2 -2
View File
@@ -9,6 +9,7 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn carol conn carol
left=PH_IP_MOON left=PH_IP_MOON
@@ -16,8 +17,7 @@ conn carol
leftcert=selfCert.der leftcert=selfCert.der
leftsendcert=never leftsendcert=never
leftsubnet=10.1.0.0/16 leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any right=%any
rightcert=peerCert.der rightcert=peerCert.der
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/default-keys/posttest.dat
+4
View File
@@ -1,5 +1,9 @@
moon::iptables -v -n -L
carol::iptables -v -n -L
moon::ipsec stop moon::ipsec stop
carol::ipsec stop carol::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/private/*
carol::rm /etc/ipsec.d/certs/* carol::rm /etc/ipsec.d/certs/*
moon::rm /etc/ipsec.d/private/* moon::rm /etc/ipsec.d/private/*
testing/tests/ikev2/default-keys/pretest.dat
+2 -1
View File
@@ -1,4 +1,5 @@
moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
carol::rm /etc/ipsec.secrets carol::rm /etc/ipsec.secrets
carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/private/*
carol::rm /etc/ipsec.d/certs/* carol::rm /etc/ipsec.d/certs/*
testing/tests/ikev2/host2host-cert/description.txt
+2 -1
View File
@@ -1,3 +1,4 @@
A connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up. A connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up.
The authentication is based on X.509 certificates. The authentication is based on X.509 certificates. <b>leftfirewall=yes</b> automatically
inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test the host-to-host tunnel <b>moon</b> pings <b>sun</b>. In order to test the host-to-host tunnel <b>moon</b> pings <b>sun</b>.
testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf
+2 -1
View File
@@ -9,13 +9,14 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn host-host conn host-host
left=PH_IP_MOON left=PH_IP_MOON
leftnexthop=%direct leftnexthop=%direct
leftcert=moonCert.pem leftcert=moonCert.pem
[email protected] [email protected]
leftfirewall=yes
right=PH_IP_SUN right=PH_IP_SUN
[email protected] [email protected]
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf
+2 -1
View File
@@ -9,13 +9,14 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn host-host conn host-host
left=PH_IP_SUN left=PH_IP_SUN
leftnexthop=%direct leftnexthop=%direct
leftcert=sunCert.pem leftcert=sunCert.pem
[email protected] [email protected]
leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
[email protected] [email protected]
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/host2host-cert/posttest.dat
+4
View File
@@ -1,2 +1,6 @@
moon::iptables -v -n -L
sun::iptables -v -n -L
moon::ipsec stop moon::ipsec stop
sun::ipsec stop sun::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
sun::/etc/init.d/iptables stop 2> /dev/null
testing/tests/ikev2/host2host-cert/pretest.dat
+2
View File
@@ -1,3 +1,5 @@
moon::/etc/init.d/iptables start 2> /dev/null
sun::/etc/init.d/iptables start 2> /dev/null
moon::ipsec start moon::ipsec start
sun::ipsec start sun::ipsec start
moon::sleep 1 moon::sleep 1
testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf
+2 -1
View File
@@ -9,13 +9,14 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn host-host conn host-host
right=PH_IP_MOON right=PH_IP_MOON
rightnexthop=%direct rightnexthop=%direct
rightcert=moonCert.pem rightcert=moonCert.pem
[email protected] [email protected]
rightfirewall=yes
left=PH_IP_SUN left=PH_IP_SUN
[email protected] [email protected]
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf
+2 -1
View File
@@ -9,13 +9,14 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn host-host conn host-host
right=PH_IP_SUN right=PH_IP_SUN
rightnexthop=%direct rightnexthop=%direct
rightcert=sunCert.pem rightcert=sunCert.pem
[email protected] [email protected]
rightfirewall=yes
left=PH_IP_MOON left=PH_IP_MOON
[email protected] [email protected]
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/host2host-swapped/posttest.dat
+4
View File
@@ -1,2 +1,6 @@
moon::iptables -v -n -L
sun::iptables -v -n -L
moon::ipsec stop moon::ipsec stop
sun::ipsec stop sun::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
sun::/etc/init.d/iptables stop 2> /dev/null
testing/tests/ikev2/host2host-swapped/pretest.dat
+2
View File
@@ -1,3 +1,5 @@
moon::/etc/init.d/iptables start 2> /dev/null
sun::/etc/init.d/iptables start 2> /dev/null
moon::ipsec start moon::ipsec start
sun::ipsec start sun::ipsec start
moon::sleep 1 moon::sleep 1
testing/tests/ikev2/net2net-cert/description.txt
+3 -1
View File
@@ -1,4 +1,6 @@
A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up. A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
The authentication is based on <b>X.509 certificates</b>. The authentication is based on <b>X.509 certificates</b>. Upon the successful
establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically
inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b> In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b>
pings client <b>bob</b> located behind gateway <b>sun</b>. pings client <b>bob</b> located behind gateway <b>sun</b>.
testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf
+3 -2
View File
@@ -9,14 +9,15 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn net-net conn net-net
left=PH_IP_MOON left=PH_IP_MOON
leftcert=moonCert.pem leftcert=moonCert.pem
[email protected] [email protected]
leftsubnet=10.1.0.0/16 leftsubnet=10.1.0.0/16
leftfirewall=yes
right=PH_IP_SUN right=PH_IP_SUN
[email protected] [email protected]
rightsubnet=10.2.0.0/16 rightsubnet=10.2.0.0/16
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf
+2 -1
View File
@@ -9,14 +9,15 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn net-net conn net-net
left=PH_IP_SUN left=PH_IP_SUN
leftcert=sunCert.pem leftcert=sunCert.pem
[email protected] [email protected]
leftsubnet=10.2.0.0/16 leftsubnet=10.2.0.0/16
leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
[email protected] [email protected]
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/net2net-cert/posttest.dat
+5 -1
View File
@@ -1,5 +1,9 @@
moon::iptables -v -n -L
sun::iptables -v -n -L
moon::ipsec stop moon::ipsec stop
sun::ipsec stop sun::ipsec stop
sun::rm /etc/ipsec.d/crls/* moon::/etc/init.d/iptables stop 2> /dev/null
sun::/etc/init.d/iptables stop 2> /dev/null
moon::rm /etc/ipsec.d/crls/* moon::rm /etc/ipsec.d/crls/*
sun::rm /etc/ipsec.d/crls/*
testing/tests/ikev2/net2net-cert/pretest.dat
+2 -2
View File
@@ -1,5 +1,5 @@
moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::/etc/init.d/iptables start 2> /dev/null
sun::echo 1 > /proc/sys/net/ipv4/ip_forward sun::/etc/init.d/iptables start 2> /dev/null
moon::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl moon::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl
sun::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl sun::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl
moon::ipsec start moon::ipsec start
testing/tests/ikev2/net2net-route/description.txt
+3
View File
@@ -4,3 +4,6 @@ on gateway <b>moon</b> by means of the setting <b>auto=route</b> in ipsec.conf.
A subsequent ping issued by client <b>alice</b> behind gateway <b>moon</b> to A subsequent ping issued by client <b>alice</b> behind gateway <b>moon</b> to
<b>bob</b> located behind gateway <b>sun</b> triggers the %trap eroute and <b>bob</b> located behind gateway <b>sun</b> triggers the %trap eroute and
leads to the automatic establishment of the subnet-to-subnet tunnel. leads to the automatic establishment of the subnet-to-subnet tunnel.
<p>
<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules
that let pass the tunneled traffic.
testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf
+1
View File
@@ -17,6 +17,7 @@ conn net-net
leftsubnet=10.1.0.0/16 leftsubnet=10.1.0.0/16
leftcert=moonCert.pem leftcert=moonCert.pem
[email protected] [email protected]
leftfirewall=yes
right=PH_IP_SUN right=PH_IP_SUN
rightsubnet=10.2.0.0/16 rightsubnet=10.2.0.0/16
[email protected] [email protected]
testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf
+2 -1
View File
@@ -9,14 +9,15 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn net-net conn net-net
left=PH_IP_SUN left=PH_IP_SUN
leftcert=sunCert.pem leftcert=sunCert.pem
[email protected] [email protected]
leftsubnet=10.2.0.0/16 leftsubnet=10.2.0.0/16
leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
[email protected] [email protected]
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/net2net-route/posttest.dat
+4
View File
@@ -1,2 +1,6 @@
moon::iptables -v -n -L
sun::iptables -v -n -L
moon::ipsec stop moon::ipsec stop
sun::ipsec stop sun::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
sun::/etc/init.d/iptables stop 2> /dev/null
testing/tests/ikev2/net2net-route/pretest.dat
+2 -2
View File
@@ -1,5 +1,5 @@
moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::/etc/init.d/iptables start 2> /dev/null
sun::echo 1 > /proc/sys/net/ipv4/ip_forward sun::/etc/init.d/iptables start 2> /dev/null
moon::ipsec start moon::ipsec start
sun::ipsec start sun::ipsec start
moon::sleep 2 moon::sleep 2
testing/tests/ikev2/net2net-start/description.txt
+3
View File
@@ -3,3 +3,6 @@ respectively, is automatically established by means of the setting
<b>auto=start</b> in ipsec.conf. The connection is tested by client <b>alice</b> <b>auto=start</b> in ipsec.conf. The connection is tested by client <b>alice</b>
behind gateway <b>moon</b> pinging the client <b>bob</b> located behind behind gateway <b>moon</b> pinging the client <b>bob</b> located behind
gateway <b>sun</b>. gateway <b>sun</b>.
<p>
<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules
that let pass the tunneled traffic.
testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf
+1 -1
View File
@@ -9,12 +9,12 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
leftnexthop=%direct
keyexchange=ikev2 keyexchange=ikev2
conn net-net conn net-net
left=PH_IP_MOON left=PH_IP_MOON
leftsubnet=10.1.0.0/16 leftsubnet=10.1.0.0/16
leftnexthop=%direct
leftcert=moonCert.pem leftcert=moonCert.pem
[email protected] [email protected]
leftfirewall=yes leftfirewall=yes
testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf
+3 -1
View File
@@ -9,14 +9,16 @@ conn %default
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2
conn net-net conn net-net
left=PH_IP_SUN left=PH_IP_SUN
leftcert=sunCert.pem leftcert=sunCert.pem
[email protected] [email protected]
leftsubnet=10.2.0.0/16 leftsubnet=10.2.0.0/16
leftnexthop=%direct
leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
[email protected] [email protected]
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/net2net-start/posttest.dat
+4
View File
@@ -1,2 +1,6 @@
moon::iptables -v -n -L
sun::iptables -v -n -L
moon::ipsec stop moon::ipsec stop
sun::ipsec stop sun::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
sun::/etc/init.d/iptables stop 2> /dev/null
testing/tests/ikev2/net2net-start/pretest.dat
+2 -2
View File
@@ -1,5 +1,5 @@
moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::/etc/init.d/iptables start 2> /dev/null
sun::echo 1 > /proc/sys/net/ipv4/ip_forward sun::/etc/init.d/iptables start 2> /dev/null
sun::ipsec start sun::ipsec start
sun::sleep 2 sun::sleep 2
moon::ipsec start moon::ipsec start
testing/tests/ikev2/rw-cert/description.txt
+6 -4
View File
@@ -1,4 +1,6 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection to gateway <b>moon</b>. The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
The authentication is based on <b>X.509 certificates</b>. to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
In order to test both tunnel and firewall, <b>carol</b> and <b>dave</b> ping the client Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
<b>alice</b> behind the gateway <b>moon</b>. automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
the client <b>alice</b> behind the gateway <b>moon</b>.
testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf
+1
View File
@@ -15,6 +15,7 @@ conn home
leftnexthop=%direct leftnexthop=%direct
leftcert=carolCert.pem leftcert=carolCert.pem
[email protected] [email protected]
leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
[email protected] [email protected]
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf
+1
View File
@@ -15,6 +15,7 @@ conn home
leftnexthop=%direct leftnexthop=%direct
leftcert=daveCert.pem leftcert=daveCert.pem
[email protected] [email protected]
leftfirewall=yes
right=PH_IP_MOON right=PH_IP_MOON
[email protected] [email protected]
rightsubnet=10.1.0.0/16 rightsubnet=10.1.0.0/16
testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf
+1
View File
@@ -16,6 +16,7 @@ conn rw
leftcert=moonCert.pem leftcert=moonCert.pem
[email protected] [email protected]
leftsubnet=10.1.0.0/16 leftsubnet=10.1.0.0/16
leftfirewall=yes
right=%any right=%any
keyexchange=ikev2 keyexchange=ikev2
auto=add auto=add
testing/tests/ikev2/rw-cert/posttest.dat
+6
View File
@@ -1,6 +1,12 @@
moon::iptables -v -n -L
carol::iptables -v -n -L
dave::iptables -v -n -L
moon::ipsec stop moon::ipsec stop
carol::ipsec stop carol::ipsec stop
dave::ipsec stop dave::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
dave::/etc/init.d/iptables stop 2> /dev/null
moon::rm /etc/ipsec.d/crls/* moon::rm /etc/ipsec.d/crls/*
carol::rm /etc/ipsec.d/crls/* carol::rm /etc/ipsec.d/crls/*
dave::rm /etc/ipsec.d/crls/* dave::rm /etc/ipsec.d/crls/*
testing/tests/ikev2/rw-cert/pretest.dat
+3 -1
View File
@@ -1,4 +1,6 @@
moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
dave::/etc/init.d/iptables start 2> /dev/null
moon::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl moon::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl
carol::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl carol::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl
dave::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl dave::wget -q http://crl.strongswan.org/strongswan.crl -O /etc/ipsec.d/crls/strongswan.crl