testing: Change sql scenarios to swanctl
This commit is contained in:
Andreas Steffen
+18
-5
@@ -520,6 +520,14 @@ do
|
||||
IPTABLES_DSP="iptables -L ; ip6tables -L"
|
||||
fi
|
||||
|
||||
for host in $DBHOSTS
|
||||
do
|
||||
eval HOSTLOGIN=root@\$ipv4_${host}
|
||||
|
||||
scp $SSHCONF $HOSTLOGIN:/etc/db.d/ipsec.sql \
|
||||
$TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1
|
||||
done
|
||||
|
||||
for host in $IPSECHOSTS
|
||||
do
|
||||
eval HOSTLOGIN=root@\$ipv4_${host}
|
||||
@@ -540,6 +548,9 @@ do
|
||||
ssh $SSHCONF $HOSTLOGIN swanctl --stats \
|
||||
> $TESTRESULTDIR/${host}.swanctl.stats 2>/dev/null
|
||||
|
||||
echo "" >> $TESTRESULTDIR/${host}.swanctl.sas
|
||||
cat $TESTRESULTDIR/${host}.swanctl.pols >> \
|
||||
$TESTRESULTDIR/${host}.swanctl.sas
|
||||
cat $TESTRESULTDIR/${host}.swanctl.algs >> \
|
||||
$TESTRESULTDIR/${host}.swanctl.stats
|
||||
else
|
||||
@@ -554,9 +565,11 @@ do
|
||||
ssh $SSHCONF $HOSTLOGIN ipsec $command \
|
||||
> $TESTRESULTDIR/${host}.$command 2>/dev/null
|
||||
done
|
||||
fi
|
||||
|
||||
scp $SSHCONF $HOSTLOGIN:/etc/ipsec.d/ipsec.sql \
|
||||
$TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1
|
||||
if (! [ -f $TESTRESULTDIR/${host}.ipsec.sql ] ) then
|
||||
scp $SSHCONF $HOSTLOGIN:/etc/ipsec.d/ipsec.sql \
|
||||
$TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1
|
||||
fi
|
||||
|
||||
ssh $SSHCONF $HOSTLOGIN ip -s xfrm policy \
|
||||
@@ -580,14 +593,14 @@ do
|
||||
<li><a href="$host.swanctl.conf">swanctl.conf</a></li>
|
||||
<li><a href="$host.swanctl.conns">swanctl --list-conns</a></li>
|
||||
<li><a href="$host.swanctl.certs">swanctl --list-certs</a></li>
|
||||
<li><a href="$host.swanctl.pools">swanctl --list-pools</a></li>
|
||||
<li><a href="$host.strongswan.conf">strongswan.conf</a></li>
|
||||
<li><a href="$host.ipsec.sql">ipsec.sql</a></li>
|
||||
</ul>
|
||||
</td>
|
||||
<td valign="top">
|
||||
<ul>
|
||||
<li><a href="$host.swanctl.sas">swanctl --list-sas</a></li>
|
||||
<li><a href="$host.swanctl.pols">swanctl --list-pols</a></li>
|
||||
<li><a href="$host.swanctl.sas">swanctl --list-sas|--list-pols</a></li>
|
||||
<li><a href="$host.swanctl.pools">swanctl --list-pools</a></li>
|
||||
<li><a href="$host.swanctl.authorities">swanctl --list-authorities</a></li>
|
||||
<li><a href="$host.swanctl.stats">swanctl --stats|--list-algs</a></li>
|
||||
<li><a href="$host.daemon.log">daemon.log</a></li>
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* strongSwan SQLite database */
|
||||
|
||||
/* configuration is read from ipsec.conf */
|
||||
/* credentials are read from ipsec.secrets */
|
||||
/* configuration is read from swanctl.conf or ipsec.conf */
|
||||
/* credentials are read from swanctl.conf or ipsec.secrets */
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* strongSwan SQLite database */
|
||||
|
||||
/* configuration is read from ipsec.conf */
|
||||
/* credentials are read from ipsec.secrets */
|
||||
/* configuration is read from swanctl.conf or ipsec.conf */
|
||||
/* credentials are read from swanctl.conf or ipsec.secrets */
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* strongSwan SQLite database */
|
||||
|
||||
/* configuration is read from ipsec.conf */
|
||||
/* credentials are read from ipsec.secrets */
|
||||
/* configuration is read from swanctl.conf or ipsec.conf */
|
||||
/* credentials are read from swanctl.conf or ipsec.secrets */
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* strongSwan SQLite database */
|
||||
|
||||
/* configuration is read from ipsec.conf */
|
||||
/* credentials are read from ipsec.secrets */
|
||||
/* configuration is read from swanctl.conf or ipsec.conf */
|
||||
/* credentials are read from swanctl.conf or ipsec.secrets */
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* strongSwan SQLite database */
|
||||
|
||||
/* configuration is read from ipsec.conf */
|
||||
/* credentials are read from ipsec.secrets */
|
||||
/* configuration is read from swanctl.conf or ipsec.conf */
|
||||
/* credentials are read from swanctl.conf or ipsec.secrets */
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* strongSwan SQLite database */
|
||||
|
||||
/* configuration is read from ipsec.conf */
|
||||
/* credentials are read from ipsec.secrets */
|
||||
/* configuration is read from swanctl.conf or ipsec.conf */
|
||||
/* credentials are read from swanctl.conf or ipsec.secrets */
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* strongSwan SQLite database */
|
||||
|
||||
/* configuration is read from ipsec.conf */
|
||||
/* credentials are read from ipsec.secrets */
|
||||
/* configuration is read from swanctl.conf or ipsec.conf */
|
||||
/* credentials are read from swanctl.conf or ipsec.secrets */
|
||||
|
||||
@@ -1,25 +1,21 @@
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES
|
||||
carol::ip addr list dev eth0::PH_IP_CAROL1::YES
|
||||
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
|
||||
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
|
||||
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.0.2] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.0.2/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
|
||||
moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES
|
||||
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.100 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.0.1] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.1/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.200 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.0.2] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.2/32]::YES
|
||||
moon:: ipsec pool --status 2> /dev/null::bigpool.*10.3.0.1.*10.3.0.6.*1h.*2::YES
|
||||
moon:: ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,7 +6,7 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
}
|
||||
|
||||
libhydra {
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,6 +1,8 @@
|
||||
carol::ipsec stop
|
||||
dave::ipsec stop
|
||||
moon::ipsec stop
|
||||
carol::swanctl --terminate --ike home
|
||||
dave::swanctl --terminate --ike home
|
||||
carol::service charon stop 2> /dev/null
|
||||
dave::service charon stop 2> /dev/null
|
||||
moon::service charon stop 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -1,6 +1,3 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
carol::rm /etc/ipsec.d/cacerts/*
|
||||
dave::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
carol::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
dave::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
@@ -11,10 +8,11 @@ moon::ipsec pool --leases 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
dave::ipsec start
|
||||
moon::service charon start 2> /dev/null
|
||||
carol::service charon start 2> /dev/null
|
||||
dave::service charon start 2> /dev/null
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
dave::expect-connection home
|
||||
dave::ipsec up home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -23,3 +23,7 @@ IPSECHOSTS="moon carol dave"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,25 +1,21 @@
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES
|
||||
carol::ip addr list dev eth0::PH_IP_CAROL1::YES
|
||||
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
|
||||
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
|
||||
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.0.2] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.0.2/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
|
||||
moon:: cat /var/log/daemon.log::acquired existing lease for address.*in pool.*bigpool::YES
|
||||
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.100 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.0.1] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.1/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.200 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.0.2] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.2/32]::YES
|
||||
moon:: ipsec pool --status 2> /dev/null::bigpool.*10.3.0.1.*10.3.0.6.*static.*2::YES
|
||||
moon:: ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,7 +6,7 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
}
|
||||
|
||||
libhydra {
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,6 +1,8 @@
|
||||
carol::ipsec stop
|
||||
dave::ipsec stop
|
||||
moon::ipsec stop
|
||||
carol::swanctl --terminate --ike home
|
||||
dave::swanctl --terminate --ike home
|
||||
carol::service charon stop 2> /dev/null
|
||||
dave::service charon stop 2> /dev/null
|
||||
moon::service charon stop 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -1,6 +1,3 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
carol::rm /etc/ipsec.d/cacerts/*
|
||||
dave::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
carol::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
dave::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
@@ -11,10 +8,11 @@ moon::ipsec pool --leases 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
dave::ipsec start
|
||||
moon::service charon start 2> /dev/null
|
||||
carol::service charon start 2> /dev/null
|
||||
dave::service charon start 2> /dev/null
|
||||
moon::expect-connection rw
|
||||
dave::expect-connection home
|
||||
dave::ipsec up home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -23,3 +23,7 @@ IPSECHOSTS="moon carol dave"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -5,9 +5,8 @@ carol::cat /var/log/daemon.log::handling INTERNAL_IP4_NBNS attribute failed::YES
|
||||
carol::cat /var/log/daemon.log::handling APPLICATION_VERSION attribute failed::YES
|
||||
carol::ip addr list dev eth0::PH_IP_CAROL1::YES
|
||||
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
|
||||
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
|
||||
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES
|
||||
@@ -16,21 +15,18 @@ dave:: cat /var/log/daemon.log::handling INTERNAL_IP4_NBNS attribute failed::YES
|
||||
dave:: cat /var/log/daemon.log::handling APPLICATION_VERSION attribute failed::YES
|
||||
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
|
||||
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
|
||||
dave:: ipsec status 2> /dev/null::.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.0.2] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.0.2/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
|
||||
moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES
|
||||
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.100 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.0.1] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.1/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.200 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.0.2] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.2/32]::YES
|
||||
moon:: ipsec pool --status 2> /dev/null::dns servers: PH_IP_WINNETOU PH_IP_VENUS::YES
|
||||
moon:: ipsec pool --status 2> /dev/null::nbns servers: PH_IP_VENUS::YES
|
||||
moon:: ipsec pool --status 2> /dev/null::bigpool.*10.3.0.1.*10.3.0.6.*static.*2::YES
|
||||
moon:: ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql resolve
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql resolve
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql resolve
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql resolve
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,7 +6,7 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
}
|
||||
|
||||
libhydra {
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,9 +1,8 @@
|
||||
carol::ipsec stop
|
||||
dave::ipsec stop
|
||||
moon::ipsec stop
|
||||
carol::swanctl --terminate --ike home
|
||||
dave::swanctl --terminate --ike home
|
||||
carol::service charon stop 2> /dev/null
|
||||
dave::service charon stop 2> /dev/null
|
||||
moon::service charon stop 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
moon::dbdir-remove
|
||||
carol::dbdir-remove
|
||||
dave::dbdir-remove
|
||||
|
||||
@@ -1,6 +1,3 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
carol::rm /etc/ipsec.d/cacerts/*
|
||||
dave::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
carol::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
dave::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
@@ -10,10 +7,11 @@ dave::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
dave::ipsec start
|
||||
moon::service charon start 2> /dev/null
|
||||
carol::service charon start 2> /dev/null
|
||||
dave::service charon start 2> /dev/null
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
dave::expect-connection home
|
||||
dave::ipsec up home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -23,3 +23,7 @@ IPSECHOSTS="moon carol dave"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
dave::cat /var/log/daemon.log::installing new virtual IP 10.3.1.1::YES
|
||||
dave::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
dave::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.1.1] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.1.1/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon:: cat /var/log/daemon.log::acquired existing lease for address 10.3.1.1 in pool.*pool1::YES
|
||||
moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.1.1 to peer::YES
|
||||
moon:: cat /var/log/daemon.log::acquired existing lease for address 10.3.0.1 in pool.*pool0::YES
|
||||
@@ -12,7 +10,5 @@ moon:: ipsec pool --status 2> /dev/null::pool0.*10.3.0.1.*10.3.0.2.*static.*2 .*
|
||||
moon:: ipsec pool --status 2> /dev/null::pool1.*10.3.1.1.*10.3.1.2.*static.*2 .*1 .*1 ::YES
|
||||
moon:: ipsec pool --leases --filter pool=pool0,addr=10.3.0.1,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec pool --leases --filter pool=pool1,addr=10.3.1.1,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.100 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.0.1] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.1/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.200 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.1.1] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.1.1/32]::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,7 +6,7 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
}
|
||||
|
||||
libhydra {
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,3 +1,5 @@
|
||||
carol::ipsec stop
|
||||
dave::ipsec stop
|
||||
moon::ipsec stop
|
||||
carol::swanctl --terminate --ike home
|
||||
dave::swanctl --terminate --ike home
|
||||
carol::service charon stop 2> /dev/null
|
||||
dave::service charon stop 2> /dev/null
|
||||
moon::service charon stop 2> /dev/null
|
||||
|
||||
@@ -1,6 +1,3 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
carol::rm /etc/ipsec.d/cacerts/*
|
||||
dave::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
carol::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
dave::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
@@ -9,10 +6,11 @@ carol::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
dave::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
moon::ipsec pool --status 2> /dev/null
|
||||
moon::ipsec pool --leases 2> /dev/null
|
||||
moon::ipsec start
|
||||
dave::ipsec start
|
||||
carol::ipsec start
|
||||
moon::service charon start 2> /dev/null
|
||||
carol::service charon start 2> /dev/null
|
||||
dave::service charon start 2> /dev/null
|
||||
moon::expect-connection rw
|
||||
dave::expect-connection home
|
||||
dave::ipsec up home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -23,3 +23,7 @@ IPSECHOSTS="moon carol dave"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.1.1::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.3.1.1] child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.3.1.1/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon:: cat /var/log/daemon.log::acquired new lease for address 10.3.0.1 in pool.*pool0::YES
|
||||
moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer::YES
|
||||
moon:: cat /var/log/daemon.log::no available address found in pool.*pool0::YES
|
||||
@@ -13,5 +12,5 @@ moon:: ipsec pool --status 2> /dev/null::pool0.*10.3.0.1.*10.3.0.1.*static.*1 .*
|
||||
moon:: ipsec pool --status 2> /dev/null::pool1.*10.3.1.1.*10.3.1.1.*static.*1 .*1 .*1 ::YES
|
||||
moon:: ipsec pool --leases --filter pool=pool0,addr=10.3.0.1,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec pool --leases --filter pool=pool1,addr=10.3.1.1,[email protected] 2> /dev/null::online::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.100 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.0.1] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.1/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.200 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.3.1.1] child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.1.1/32]::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,7 +6,7 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql attr-sql
|
||||
}
|
||||
|
||||
libhydra {
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,3 +1,5 @@
|
||||
carol::ipsec stop
|
||||
dave::ipsec stop
|
||||
moon::ipsec stop
|
||||
carol::swanctl --terminate --ike home
|
||||
dave::swanctl --terminate --ike home
|
||||
carol::service charon stop 2> /dev/null
|
||||
dave::service charon stop 2> /dev/null
|
||||
moon::service charon stop 2> /dev/null
|
||||
|
||||
@@ -1,6 +1,3 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
carol::rm /etc/ipsec.d/cacerts/*
|
||||
dave::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
carol::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
dave::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
@@ -8,10 +5,11 @@ moon::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
carol::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
dave::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
moon::ipsec pool --status 2> /dev/null
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
dave::ipsec start
|
||||
moon::service charon start 2> /dev/null
|
||||
carol::service charon start 2> /dev/null
|
||||
dave::service charon start 2> /dev/null
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
dave::expect-connection home
|
||||
dave::ipsec up home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -23,3 +23,6 @@ IPSECHOSTS="moon carol dave"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,21 +1,17 @@
|
||||
carol::cat /var/log/daemon.log::sending issuer cert.*CN=Research CA::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*state=ESTABLISHED local-host=192.168.0.100 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=[192.168.0.100/32 remote-ts=\[10.1.0.0/16]::YES
|
||||
dave:: cat /var/log/daemon.log::sending issuer cert.*CN=Sales CA::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 [email protected] remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
moon:: cat /var/log/daemon.log::fetching crl from.*http.*research.crl::YES
|
||||
moon:: cat /var/log/daemon.log::crl correctly signed by.*Research CA::YES
|
||||
moon:: cat /var/log/daemon.log::fetching crl from.*http.*sales.crl::YES
|
||||
moon:: cat /var/log/daemon.log::crl correctly signed by.*Sales CA::YES
|
||||
moon:: cat /var/log/daemon.log::fetching crl from.*http.*strongswan.crl::YES
|
||||
moon:: cat /var/log/daemon.log::crl correctly signed by.*strongSwan Root CA::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.100 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.200 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,6 +1,8 @@
|
||||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
dave::ipsec stop
|
||||
carol::swanctl --terminate --ike home
|
||||
dave::swanctl --terminate --ike home
|
||||
carol::service charon stop 2> /dev/null
|
||||
dave::service charon stop 2> /dev/null
|
||||
moon::service charon stop 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -1,6 +1,3 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
carol::rm /etc/ipsec.d/cacerts/*
|
||||
dave::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
carol::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
dave::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
@@ -10,10 +7,11 @@ dave::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
dave::ipsec start
|
||||
moon::service charon start 2> /dev/null
|
||||
carol::service charon start 2> /dev/null
|
||||
dave::service charon start 2> /dev/null
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
dave::expect-connection home
|
||||
dave::ipsec up home
|
||||
dave::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -23,3 +23,7 @@ IPSECHOSTS="moon carol dave"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_12.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
|
||||
sun:: swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_12.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
|
||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
|
||||
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
|
||||
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,4 +1,4 @@
|
||||
moon::ipsec stop
|
||||
sun::ipsec stop
|
||||
moon::service charon stop 2> /dev/null
|
||||
sun::service charon stop 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -1,12 +1,11 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
sun::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
sun::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
moon::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
sun::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
moon::ipsec start
|
||||
sun::ipsec start
|
||||
moon::expect-connection net-net
|
||||
moon::ipsec up net-net
|
||||
moon::service charon start 2> /dev/null
|
||||
sun::service charon start 2> /dev/null
|
||||
moon::expect-connection net-net
|
||||
sun::expect-connection net-net
|
||||
moon::swanctl --initiate --child net-net 2> /dev/null
|
||||
|
||||
@@ -23,3 +23,7 @@ IPSECHOSTS="moon sun"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_12.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
|
||||
sun:: swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_12.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
|
||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
|
||||
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
|
||||
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,4 +1,4 @@
|
||||
moon::ipsec stop
|
||||
sun::ipsec stop
|
||||
moon::service charon stop 2> /dev/null
|
||||
sun::service charon stop 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -1,12 +1,11 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
sun::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
sun::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
moon::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
sun::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
moon::ipsec start
|
||||
sun::ipsec start
|
||||
moon::expect-connection net-net
|
||||
moon::ipsec up net-net
|
||||
moon::service charon start 2> /dev/null
|
||||
sun::service charon start 2> /dev/null
|
||||
moon::expect-connection net-net
|
||||
sun::expect-connection net-net
|
||||
moon::swanctl --initiate --child net-net 2> /dev/null
|
||||
|
||||
@@ -23,3 +23,7 @@ IPSECHOSTS="moon sun"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,15 +1,7 @@
|
||||
moon:: ipsec status 2> /dev/null::net-1.*ROUTED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-1.*ROUTED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::net-2.*ROUTED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-2.*ROUTED, TUNNEL::YES
|
||||
moon:: cat /var/log/daemon.log::creating acquire job for policy 10.1.0.10/32\[icmp/8\] === 10.2.0.10/32\[icmp/8\] with reqid {1}::YES
|
||||
moon:: ipsec status 2> /dev/null::net-1.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-1.*INSTALLED. TUNNEL::YES
|
||||
sun:: cat /var/log/daemon.log::creating acquire job for policy 10.2.0.10/32\[icmp/8\] === 10.1.0.20/32\[icmp/8\] with reqid {2}::YES
|
||||
moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES
|
||||
moon::swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-1.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/28] remote-ts=\[10.2.0.0/23].*net-2.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 dh-group=MODP_3072.*local-ts=\[10.1.0.16/28] remote-ts=\[10.2.0.0/23]::YES
|
||||
sun:: swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-1.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.2.0.0/23] remote-ts=\[10.1.0.0/28].*net-2.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 dh-group=MODP_3072.*local-ts=\[10.2.0.0/23] remote-ts=\[10.1.0.16/28]::YES
|
||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
|
||||
bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
|
||||
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,4 +1,4 @@
|
||||
moon::ipsec stop
|
||||
sun::ipsec stop
|
||||
moon::service charon stop 2> /dev/null
|
||||
sun::service charon stop 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -1,13 +1,11 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
sun::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
sun::cat /usr/local/share/strongswan/templates/database/sql/sqlite.sql /etc/ipsec.d/data.sql > /etc/db.d/ipsec.sql
|
||||
moon::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
sun::cat /etc/db.d/ipsec.sql | sqlite3 /etc/db.d/ipsec.db
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
sun::ipsec start
|
||||
moon::ipsec start
|
||||
moon::service charon start 2> /dev/null
|
||||
sun::service charon start 2> /dev/null
|
||||
moon::expect-connection net-net
|
||||
alice::ping -c 1 -W 1 PH_IP_BOB
|
||||
bob::ping -c 1 -W 1 PH_IP_VENUS
|
||||
alice::ping -c 1 -W 1 10.2.0.10
|
||||
bob::ping -c 1 -W 1 10.1.0.20
|
||||
|
||||
@@ -23,3 +23,7 @@ IPSECHOSTS="moon sun"
|
||||
# Guest instances on which databases are used
|
||||
#
|
||||
DBHOSTS="$IPSECHOSTS"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
|
||||
@@ -1,11 +1,5 @@
|
||||
moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::net-1.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-1.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::net-3.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-3.*INSTALLED, TUNNEL::YES
|
||||
moon:: swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-1.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[10.2.0.0/23].*net-2.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=192 dh-group=MODP_8192.*local-ts=\[10.1.0.16/28] remote-ts=\[10.2.0.0/23].*net-3.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=192 dh-group=MODP_8192.*local-ts=\[10.1.2.0/23] remote-ts=\[10.2.2.0/23]::YES
|
||||
sun:: swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net-1.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/23] remote-ts=\[10.1.0.0/28].*net-2.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=192 dh-group=MODP_8192.*local-ts=\[10.2.0.0/23] remote-ts=\[10.1.0.16/28].*net-3.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=192 dh-group=MODP_8192.*local-ts=\[10.2.2.0/23] remote-ts=\[10.1.2.0/23]::YES
|
||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
|
||||
bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
|
||||
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
|
||||
|
||||
@@ -105,25 +105,25 @@ INSERT INTO private_key_identity (
|
||||
INSERT INTO proposals (
|
||||
proposal
|
||||
) VALUES (
|
||||
'aes128-sha256-modp2048'
|
||||
'aes128-sha256-modp3072'
|
||||
);
|
||||
|
||||
INSERT INTO proposals (
|
||||
proposal
|
||||
) VALUES (
|
||||
'aes192-sha384-modp3072'
|
||||
'aes192-sha384-modp8192'
|
||||
);
|
||||
|
||||
INSERT INTO proposals (
|
||||
proposal
|
||||
) VALUES (
|
||||
'aes128gcm128'
|
||||
'aes128gcm16-modp3072'
|
||||
);
|
||||
|
||||
INSERT INTO proposals (
|
||||
proposal
|
||||
) VALUES (
|
||||
'aes192gcm128'
|
||||
'aes192gcm16-modp8192'
|
||||
);
|
||||
|
||||
/* Configurations */
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -105,25 +105,25 @@ INSERT INTO private_key_identity (
|
||||
INSERT INTO proposals (
|
||||
proposal
|
||||
) VALUES (
|
||||
'aes128-sha256-modp2048'
|
||||
'aes128-sha256-modp3072'
|
||||
);
|
||||
|
||||
INSERT INTO proposals (
|
||||
proposal
|
||||
) VALUES (
|
||||
'aes192-sha384-modp3072'
|
||||
'aes192-sha384-modp8192'
|
||||
);
|
||||
|
||||
INSERT INTO proposals (
|
||||
proposal
|
||||
) VALUES (
|
||||
'aes128gcm128'
|
||||
'aes128gcm16-modp3072'
|
||||
);
|
||||
|
||||
INSERT INTO proposals (
|
||||
proposal
|
||||
) VALUES (
|
||||
'aes192gcm128'
|
||||
'aes192gcm16-modp8192'
|
||||
);
|
||||
|
||||
/* Configurations */
|
||||
|
||||
@@ -6,5 +6,5 @@ charon {
|
||||
database = sqlite:///etc/db.d/ipsec.db
|
||||
}
|
||||
}
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default updown sqlite sql
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown sqlite sql
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
# configuration is read from SQLite database
|
||||
@@ -1,4 +1,4 @@
|
||||
moon::ipsec stop
|
||||
sun::ipsec stop
|
||||
moon::service charon stop 2> /dev/null
|
||||
sun::service charon stop 2> /dev/null
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user