denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- import of strongswan-2.7.0

Browse Source 
- applied patch for charon
This commit is contained in:
Martin Willi
2006-04-28 07:14:48 +00:00
parent 52923c9acb
commit 997358a6c4
2043 changed files with 346842 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/wlan/description.txt
+15
View File
@@ -0,0 +1,15 @@
The WLAN clients <b>alice</b> and <b>venus</b> secure all their wireless traffic
by setting up an IPsec tunnel to gateway <b>moon</b>. The VPN network mask is
<b>0.0.0.0/0</b>. Traffic with destination outside the protected 10.1.0.0/10 network
is NAT-ed by router <b>moon</b>. The IPsec connections are tested by pings from
<b>alice</b> to <b>venus</b> tunneled via <b>moon</b> and to both the internal
and external interface of gateway <b>moon</b>. Access to the gateway is
set up by <b>lefthostaccess=yes</b> in conjunction with <b>leftfirewall=yes</b>.
At last <b>alice</b> and <b>venus</b> ping the external host <b>sun</b> via the NAT router.
<p>
The host system controls the UML instances <b>alice</b> and <b>carol</b> via
ssh commands sent over the virtual <b>tap1</b> interface. In order to keep up
the control flow in the presence of the all-encompassing 0.0.0.0/0 tunnel
to the gateway <b>moon</b> an auxiliary <b>passthrough</b> eroute restricted
to the ssh port is statically set up by <b>conn system</b>.
testing/tests/wlan/evaltest.dat
+11
View File
@@ -0,0 +1,11 @@
alice::ipsec status::wlan.*STATE_QUICK_I2.*IPsec SA established::YES
venus::ipsec status::wlan.*STATE_QUICK_I2.*IPsec SA established::YES
moon::ipsec status::alice.*STATE_QUICK_R2.*IPsec SA established::YES
moon::ipsec status::venus.*STATE_QUICK_R2.*IPsec SA established::YES
alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
alice::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES
alice::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES
alice::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
venus::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
moon::tcpdump::ESP::YES
sun::tcpdump::icmp::YES
testing/tests/wlan/hosts/alice/etc/init.d/iptables
Executable
+73
View File
@@ -0,0 +1,73 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/tests/wlan/hosts/alice/etc/ipsec.conf
Executable
+37
View File
@@ -0,0 +1,37 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
version 2.0 # conforms to second version of ipsec.conf specification
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
nat_traversal=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn system
left=PH_IP_ALICE
leftprotoport=tcp/ssh
leftnexthop=%direct
authby=never
type=passthrough
right=10.1.0.254
rightprotoport=tcp
auto=route
conn wlan
left=PH_IP_ALICE
leftnexthop=%direct
leftcert=aliceCert.pem
[email protected]
leftfirewall=yes
right=PH_IP1_MOON
[email protected]
rightsubnet=0.0.0.0/0
auto=add
testing/tests/wlan/hosts/moon/etc/init.d/iptables
Executable
+82
View File
@@ -0,0 +1,82 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth1 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A FORWARD -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
# enable SNAT
iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p icmp -j SNAT --to-source PH_IP_MOON
iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/tests/wlan/hosts/moon/etc/ipsec.conf
Executable
+37
View File
@@ -0,0 +1,37 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
version 2.0 # conforms to second version of ipsec.conf specification
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
nat_traversal=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn alice
right=PH_IP_ALICE
[email protected]
also=wlan
auto=add
conn venus
right=PH_IP_VENUS
[email protected]
also=wlan
auto=add
conn wlan
left=PH_IP1_MOON
leftnexthop=%direct
leftsubnet=0.0.0.0/0
leftcert=moonCert.pem
[email protected]
leftfirewall=yes
lefthostaccess=yes
testing/tests/wlan/hosts/venus/etc/init.d/iptables
Executable
+73
View File
@@ -0,0 +1,73 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
testing/tests/wlan/hosts/venus/etc/ipsec.conf
Executable
+37
View File
@@ -0,0 +1,37 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
version 2.0 # conforms to second version of ipsec.conf specification
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
nat_traversal=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn system
left=PH_IP_VENUS
leftprotoport=tcp/ssh
leftnexthop=%direct
authby=never
type=passthrough
right=10.1.0.254
rightprotoport=tcp
auto=route
conn wlan
left=PH_IP_VENUS
leftnexthop=%direct
leftcert=venusCert.pem
[email protected]
leftfirewall=yes
right=PH_IP1_MOON
[email protected]
rightsubnet=0.0.0.0/0
auto=add
testing/tests/wlan/posttest.dat
+10
View File
@@ -0,0 +1,10 @@
alice::iptables -v -n -L
venus::iptables -v -n -L
moon::iptables -t nat -v -n -L POSTROUTING
moon::iptables -v -n -L
moon::ipsec stop
alice::ipsec stop
venus::ipsec stop
alice::/etc/init.d/iptables stop 2> /dev/null
venus::/etc/init.d/iptables stop 2> /dev/null
moon::/etc/init.d/iptables stop 2> /dev/null
testing/tests/wlan/pretest.dat
+11
View File
@@ -0,0 +1,11 @@
moon::/etc/init.d/iptables start 2> /dev/null
alice::/etc/init.d/iptables start 2> /dev/null
venus::/etc/init.d/iptables start 2> /dev/null
moon::ipsec start
alice::ipsec start
venus::ipsec start
alice::sleep 2
alice::ipsec up wlan
venus::sleep 2
venus::ipsec up wlan
venus::sleep 2
testing/tests/wlan/test.conf
+21
View File
@@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# UML instances used for this test
# All UML instances that are required for this test
#
UMLHOSTS="alice venus moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon:eth1 sun"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus moon"