diff --git a/testing/tests/ikev2/net2net-icmp-forward/description.txt b/testing/tests/ikev2/net2net-icmp-forward/description.txt new file mode 100755 index 000000000..b3692f17b --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/description.txt @@ -0,0 +1,18 @@ +A connection between the gateways moon and sun is set up, which +connects alice and moon with a small subnet behind gateway sun. +A second tunnel is created between client venus and gateway moon, +which connects venus with another small subnet behind, in this case, +non-IPsec gateway sun. +The authentication is based on X.509 certificates. +

+In order to test ICMP error forwarding, which venus, moon and +sun all enabled, alice and moon ping unreachable IPs behind +IPsec gateway sun and behind host bob, respectively. The +corresponding ICMP Destination Unreachable messages, with source IP addresses +outside the IPsec tunnel traffic selectors are expected to be forwarded +by sun and moon. +

+Similar tests are run from venus, in which case the non-IPsec router +sun generates ICMP Time Exceeded (TTL expired) and Fragmentation Needed +(MTU exceeded) messages with a source IP outside of the traffic selectors. +These messages should again get forwarded by moon. diff --git a/testing/tests/ikev2/net2net-icmp-forward/evaltest.dat b/testing/tests/ikev2/net2net-icmp-forward/evaltest.dat new file mode 100755 index 000000000..45a4851c7 --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/evaltest.dat @@ -0,0 +1,18 @@ +moon::swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.16/28]::YES +sun:: swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.16/28] remote-ts=\[10.1.0.0/16]::YES +moon::swanctl --list-sas --raw 2> /dev/null::venus.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=moon.strongswan.org remote-host=10.1.0.20 remote-port=500 remote-id=venus.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.8/30] remote-ts=\[10.1.0.20/32]::YES +venus::swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=10.1.0.20 local-port=500 local-id=venus.strongswan.org remote-host=10.1.0.1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*rw.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.20/32] remote-ts=\[10.2.0.8/30]::YES +# the kernel currently sets the source incorrectly to the non-existent IP +# allow both in case it gets fixed +alice::ping -c 1 -W 4 10.2.0.25::From \(PH_IP_SUN\|10.2.0.25\) icmp_seq=1 Destination Host Unreachable::YES +moon::ping -c 1 -W 4 10.2.0.17::From PH_IP_BOB icmp_seq=1 Destination Host Unreachable::YES +# test other types of ICMPs with venus +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES +venus::ping -t 2 -c 1 PH_IP_BOB::From PH_IP_SUN.*Time to live exceeded::YES +venus::ping -M do -s 1320 -c 1 PH_IP_BOB::From PH_IP_SUN.*Frag needed and DF set (mtu = 1280)::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::2 +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::2 +sun::tcpdump::IP sun.strongswan.org > alice.strongswan.org: ICMP host 10.2.0.25 unreachable::NO +sun::tcpdump::IP bob.strongswan.org > moon1.strongswan.org: ICMP host 10.2.0.17 unreachable::NO +venus::tcpdump::IP venus.strongswan.org > moon1.strongswan.org: ESP::3 +venus::tcpdump::IP moon1.strongswan.org > venus.strongswan.org: ESP::3 diff --git a/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/iptables.rules new file mode 100644 index 000000000..a24c5a452 --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/iptables.rules @@ -0,0 +1,48 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT + +# allow decrypted ICMPs from any source IP (updown script is too specific) +-A INPUT -p icmp --icmp-type destination-unreachable -m policy --dir in -j ACCEPT +-A FORWARD -p icmp --icmp-type destination-unreachable -m policy --dir in -j ACCEPT + +# allow venus to connect and fetch crls +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT +-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT +-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT + +# forward specific errors to venus +-A FORWARD -d 10.1.0.20/32 -p icmp --icmp-type time-exceeded -j ACCEPT +-A FORWARD -d 10.1.0.20/32 -p icmp --icmp-type fragmentation-needed -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/strongswan.conf new file mode 100755 index 000000000..b3b09ab3b --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/strongswan.conf @@ -0,0 +1,9 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 pubkey openssl random +} + +charon-systemd { + load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici +} diff --git a/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/swanctl/swanctl.conf new file mode 100755 index 000000000..99bf663dd --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/hosts/moon/etc/swanctl/swanctl.conf @@ -0,0 +1,48 @@ +connections { + + gw-gw { + local_addrs = PH_IP_MOON + remote_addrs = PH_IP_SUN + + local { + auth = pubkey + certs = moonCert.pem + id = moon.strongswan.org + } + remote { + auth = pubkey + id = sun.strongswan.org + } + children { + net-net { + local_ts = 10.1.0.0/16 + remote_ts = 10.2.0.0/16 + icmp = yes + + updown = /usr/local/libexec/ipsec/_updown iptables + hostaccess = yes + esp_proposals = aes128gcm128-x25519 + } + } + version = 2 + mobike = no + proposals = aes128-sha256-x25519 + } + + venus : connections.gw-gw { + local_addrs = PH_IP_MOON1 + remote_addrs = PH_IP_VENUS + + remote { + id = venus.strongswan.org + } + children { + net-net { + # only include bob + local_ts = 10.2.0.8/30 + remote_ts = dynamic + hostaccess = no + } + } + } +} diff --git a/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/iptables.rules new file mode 100644 index 000000000..22bd33fa5 --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/iptables.rules @@ -0,0 +1,42 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +# allow crl fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT + +# explicitly allow ICMP responses we don't actually want to see as they should get encrypted +-A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT +-A FORWARD -p icmp --icmp-type destination-unreachable -j ACCEPT + +# allow only specific ICMPs from/to venus for this scenario +-A FORWARD -s 10.1.0.20/32 -p icmp --icmp-type echo-request -j ACCEPT +-A FORWARD -d 10.1.0.20/32 -p icmp --icmp-type echo-reply -j ACCEPT +-A OUTPUT -d 10.1.0.20/32 -p icmp --icmp-type time-exceeded -j ACCEPT +-A OUTPUT -d 10.1.0.20/32 -p icmp --icmp-type fragmentation-needed -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/strongswan.conf b/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/strongswan.conf new file mode 100755 index 000000000..b3b09ab3b --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/strongswan.conf @@ -0,0 +1,9 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 pubkey openssl random +} + +charon-systemd { + load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici +} diff --git a/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/swanctl/swanctl.conf b/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/swanctl/swanctl.conf new file mode 100755 index 000000000..7ddc22c81 --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/hosts/sun/etc/swanctl/swanctl.conf @@ -0,0 +1,31 @@ +connections { + + gw-gw { + local_addrs = PH_IP_SUN + remote_addrs = PH_IP_MOON + + local { + auth = pubkey + certs = sunCert.pem + id = sun.strongswan.org + } + remote { + auth = pubkey + id = moon.strongswan.org + } + children { + net-net { + # exclude sun's and bob's IPs + local_ts = 10.2.0.16/28 + remote_ts = 10.1.0.0/16 + icmp = yes + + updown = /usr/local/libexec/ipsec/_updown iptables + esp_proposals = aes128gcm128-x25519 + } + } + version = 2 + mobike = no + proposals = aes128-sha256-x25519 + } +} diff --git a/testing/tests/ikev2/net2net-icmp-forward/hosts/venus/etc/strongswan.conf b/testing/tests/ikev2/net2net-icmp-forward/hosts/venus/etc/strongswan.conf new file mode 100755 index 000000000..b3b09ab3b --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/hosts/venus/etc/strongswan.conf @@ -0,0 +1,9 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 pubkey openssl random +} + +charon-systemd { + load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici +} diff --git a/testing/tests/ikev2/net2net-icmp-forward/hosts/venus/etc/swanctl/swanctl.conf b/testing/tests/ikev2/net2net-icmp-forward/hosts/venus/etc/swanctl/swanctl.conf new file mode 100755 index 000000000..c31ae14c5 --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/hosts/venus/etc/swanctl/swanctl.conf @@ -0,0 +1,29 @@ +connections { + + rw { + remote_addrs = PH_IP_MOON1 + + local { + auth = pubkey + certs = venusCert.pem + id = venus.strongswan.org + } + remote { + auth = pubkey + id = moon.strongswan.org + } + children { + rw { + remote_ts = 10.2.0.0/16 + icmp = yes + + updown = /usr/local/libexec/ipsec/_updown iptables + hostaccess = yes + esp_proposals = aes128gcm128-x25519 + } + } + version = 2 + mobike = no + proposals = aes128-sha256-x25519 + } +} diff --git a/testing/tests/ikev2/net2net-icmp-forward/posttest.dat b/testing/tests/ikev2/net2net-icmp-forward/posttest.dat new file mode 100755 index 000000000..6d40030b3 --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/posttest.dat @@ -0,0 +1,13 @@ +moon::swanctl --terminate --ike gw-gw 2> /dev/null +moon::swanctl --terminate --ike venus 2> /dev/null +venus::systemctl stop strongswan +moon::systemctl stop strongswan +sun::systemctl stop strongswan +venus::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +sun::ip route del 10.2.0.16/30 via PH_IP_BOB +moon::ip route del 10.2.0.8/30 via PH_IP_SUN +sun::ip route del PH_IP_VENUS/32 via PH_IP_MOON +sun::ip route del 10.2.0.8/30 dev eth1 src PH_IP_SUN1 +winnetou::ip route del 10.1.0.0/16 via PH_IP_MOON diff --git a/testing/tests/ikev2/net2net-icmp-forward/pretest.dat b/testing/tests/ikev2/net2net-icmp-forward/pretest.dat new file mode 100755 index 000000000..a351598b2 --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/pretest.dat @@ -0,0 +1,21 @@ +venus::iptables-restore < /etc/iptables.rules +moon::iptables-restore < /etc/iptables.rules +sun::iptables-restore < /etc/iptables.rules +venus::systemctl start --no-block strongswan +moon::systemctl start --no-block strongswan +sun::systemctl start --no-block strongswan +# add a route for part of the private subnet via bob +sun::ip route add 10.2.0.16/30 via PH_IP_BOB +# setup routes to test with venus +winnetou::ip route add 10.1.0.0/16 via PH_IP_MOON +moon::ip route add 10.2.0.8/30 via PH_IP_SUN +sun::ip route add PH_IP_VENUS/32 via PH_IP_MOON +# force a lower MTU for traffic to bob +sun::ip route add 10.2.0.8/30 dev eth1 src PH_IP_SUN1 mtu 1280 +# allow decrypted ICMPs from any source IP (rules for sun and moon are in iptables.rules) +venus::iptables -A INPUT -p icmp -m policy --dir in -j ACCEPT +venus::expect-connection rw +moon::expect-connection gw-gw +sun::expect-connection gw-gw +moon::swanctl --initiate --child net-net 2> /dev/null +venus::swanctl --initiate --child rw 2> /dev/null diff --git a/testing/tests/ikev2/net2net-icmp-forward/test.conf b/testing/tests/ikev2/net2net-icmp-forward/test.conf new file mode 100755 index 000000000..5bd305062 --- /dev/null +++ b/testing/tests/ikev2/net2net-icmp-forward/test.conf @@ -0,0 +1,25 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="venus sun" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="venus moon sun" + +# charon controlled by swanctl +# +SWANCTL=1 diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/description.txt b/testing/tests/ipv6/net2net-icmp-forward-ikev2/description.txt new file mode 100644 index 000000000..3c2cbc498 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/description.txt @@ -0,0 +1,18 @@ +A connection between the gateways moon and sun is set up, which +connects alice and moon with a small subnet behind gateway sun. +A second tunnel is created between client venus and gateway moon, +which connects venus with another small subnet behind, in this case, +non-IPsec gateway sun. +The authentication is based on X.509 certificates. +

+In order to test ICMPv6 error forwarding, which venus, moon and +sun all enabled, alice and moon ping unreachable IPs behind +IPsec gateway sun and behind host bob, respectively. The +corresponding ICMPv6 Destination Unreachable messages, with source IP addresses +outside the IPsec tunnel traffic selectors are expected to be forwarded +by sun and moon. +

+Similar tests are run from venus, in which case the non-IPsec router +sun generates ICMPv6 Time Exceeded (TTL expired) and Packet too big +(MTU exceeded) messages with a source IP outside of the traffic selectors. +These messages should again get forwarded by moon. diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/evaltest.dat b/testing/tests/ipv6/net2net-icmp-forward-ikev2/evaltest.dat new file mode 100644 index 000000000..7c0f82fc2 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/evaltest.dat @@ -0,0 +1,16 @@ +moon::swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=fec0:\:1 local-port=500 local-id=moon.strongswan.org remote-host=fec0:\:2 remote-port=500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[fec1:\:/16] remote-ts=\[fec2:\:20/124]::YES +sun ::swanctl --list-sas --raw 2> /dev/null::net-net.*version=2 state=ESTABLISHED local-host=fec0:\:2 local-port=500 local-id=sun.strongswan.org remote-host=fec0:\:1 remote-port=500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[fec2:\:20/124] remote-ts=\[fec1:\:/16]::YES +moon::swanctl --list-sas --raw 2> /dev/null::venus.*version=2 state=ESTABLISHED local-host=fec1:\:1 local-port=500 local-id=moon.strongswan.org remote-host=fec1:\:20 remote-port=500 remote-id=venus.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*reqid=2 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[fec2:\:10/124] remote-ts=\[fec1:\:20/128]::YES +venus::swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=fec1:\:20 local-port=500 local-id=venus.strongswan.org remote-host=fec1:\:1 remote-port=500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*rw.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[fec1:\:20/128] remote-ts=\[fec2:\:10/124]::YES +alice::ping6 -c 1 -W 4 -p deadbeef fec2:\:25::From fec0:\:2 icmp_seq=1 Destination unreachable: Address unreachable::YES +moon::ping6 -c 1 -W 4 -p deadbeef fec2:\:22::From fec2:\:10 icmp_seq=1 Destination unreachable: Address unreachable::YES +# test other types of ICMPs with venus +venus::ping6 -c 1 fec2:\:10::64 bytes from fec2:\:10: icmp_.eq=1::YES +venus::ping6 -t 2 -c 1 fec2:\:10::From fec0:\:2.*Time exceeded: Hop limit::YES +venus::ping6 -M do -s 1320 -c 1 fec2:\:10::From fec0:\:2.*Packet too big: mtu=1280::YES +sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::2 +sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::2 +sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-alice.strongswan.org: ICMP6, destination unreachable, unreachable address fec2:\:25::NO +sun::tcpdump::IP6 ip6-bob.strongswan.org > ip6-moon1.strongswan.org: ICMP6, destination unreachable, unreachable address fec2:\:22::NO +venus::tcpdump::IP6 ip6-venus.strongswan.org > ip6-moon1.strongswan.org: ESP::3 +venus::tcpdump::IP6 ip6-moon1.strongswan.org > ip6-venus.strongswan.org: ESP::3 diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/ip6tables.rules new file mode 100644 index 000000000..6c8af3d42 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/ip6tables.rules @@ -0,0 +1,55 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow last UDP fragment +-A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# allow crl and certificate fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s fec0::15 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d fec0::15 -j ACCEPT + +# allow decrypted ICMPv6s from any source IP +-A INPUT -p icmpv6 --icmpv6-type destination-unreachable -m policy --dir in -j ACCEPT +-A FORWARD -p icmpv6 --icmpv6-type destination-unreachable -m policy --dir in -j ACCEPT + +# allow venus to connect and fetch crls +-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT +-A INPUT -i eth1 -p 50 -j ACCEPT +-A OUTPUT -o eth1 -p 50 -j ACCEPT +-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s fec0::15 -j ACCEPT +-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d fec0::15 -j ACCEPT + +# forward specific errors to venus +-A FORWARD -d fec1::20/128 -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT +-A FORWARD -d fec1::20/128 -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/strongswan.conf b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..192930500 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/strongswan.conf @@ -0,0 +1,10 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 pubkey openssl random +} + +charon-systemd { + load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown + fragment_size = 1400 +} diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/swanctl/swanctl.conf new file mode 100644 index 000000000..a60e81aaa --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/moon/etc/swanctl/swanctl.conf @@ -0,0 +1,55 @@ +connections { + + net-net { + local_addrs = fec0::1 + remote_addrs = fec0::2 + + local { + auth = pubkey + certs = moonCert.pem + id = moon.strongswan.org + } + remote { + auth = pubkey + id = sun.strongswan.org + } + children { + net-net { + local_ts = fec1::0/16 + remote_ts = fec2::0/16 + icmp = yes + + updown = /usr/local/libexec/ipsec/_updown iptables + hostaccess = yes + esp_proposals = aes128-sha256-x25519 + } + } + version = 2 + mobike = no + proposals = aes128-sha256-x25519 + } + + venus : connections.net-net { + local_addrs = fec1::1 + remote_addrs = fec1::20 + + remote { + id = venus.strongswan.org + } + children { + net-net { + # exclude sun but include bob + local_ts = fec2::10/124 + remote_ts = dynamic + hostaccess = no + } + } + } +} + +authorities { + strongswan { + cacert = strongswanCert.pem + crl_uris = http://ip6-winnetou.strongswan.org/strongswan.crl + } +} diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/ip6tables.rules b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/ip6tables.rules new file mode 100644 index 000000000..722f4c86f --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/ip6tables.rules @@ -0,0 +1,49 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow esp +-A INPUT -i eth0 -p 50 -j ACCEPT +-A OUTPUT -o eth0 -p 50 -j ACCEPT + +# allow IKE +-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + +# allow MobIKE +-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT +-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT + +# allow last UDP fragment +-A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT + +# allow ICMPv6 neighbor-solicitations +-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT + +# allow ICMPv6 neighbor-advertisements +-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + +# allow crl and certificate fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s fec0::15 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d fec0::15 -j ACCEPT + +# explicitly allow ICMPv6 responses we don't actually want to see as they should get encrypted +-A OUTPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT +-A FORWARD -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT + +# allow only specific ICMPs from/to venus for this scenario +-A FORWARD -s fec1::20/128 -p icmpv6 --icmpv6-type echo-request -j ACCEPT +-A FORWARD -d fec1::20/128 -p icmpv6 --icmpv6-type echo-reply -j ACCEPT +-A OUTPUT -d fec1::20/128 -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT +-A OUTPUT -d fec1::20/128 -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT + +# log dropped packets +-A INPUT -j LOG --log-prefix " IN: " +-A OUTPUT -j LOG --log-prefix " OUT: " + +COMMIT diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/strongswan.conf b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/strongswan.conf new file mode 100644 index 000000000..192930500 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/strongswan.conf @@ -0,0 +1,10 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 pubkey openssl random +} + +charon-systemd { + load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown + fragment_size = 1400 +} diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/swanctl/swanctl.conf b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/swanctl/swanctl.conf new file mode 100644 index 000000000..ff2a8f145 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/sun/etc/swanctl/swanctl.conf @@ -0,0 +1,38 @@ +connections { + + net-net { + local_addrs = fec0::2 + remote_addrs = fec0::1 + + local { + auth = pubkey + certs = sunCert.pem + id = sun.strongswan.org + } + remote { + auth = pubkey + id = moon.strongswan.org + } + children { + net-net { + # exclude sun's and bob's IPs + local_ts = fec2::20/124 + remote_ts = fec1::0/16 + icmp = yes + + updown = /usr/local/libexec/ipsec/_updown iptables + esp_proposals = aes128-sha256-x25519 + } + } + version = 2 + mobike = no + proposals = aes128-sha256-x25519 + } +} + +authorities { + strongswan { + cacert = strongswanCert.pem + crl_uris = http://ip6-winnetou.strongswan.org/strongswan.crl + } +} diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/venus/etc/strongswan.conf b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/venus/etc/strongswan.conf new file mode 100644 index 000000000..192930500 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/venus/etc/strongswan.conf @@ -0,0 +1,10 @@ +# /etc/strongswan.conf - strongSwan configuration file + +swanctl { + load = pem pkcs1 pubkey openssl random +} + +charon-systemd { + load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown + fragment_size = 1400 +} diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/venus/etc/swanctl/swanctl.conf b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/venus/etc/swanctl/swanctl.conf new file mode 100644 index 000000000..78faa497a --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/hosts/venus/etc/swanctl/swanctl.conf @@ -0,0 +1,37 @@ +connections { + + rw { + local_addrs = fec1::20 + remote_addrs = fec1::1 + + local { + auth = pubkey + certs = venusCert.pem + id = venus.strongswan.org + } + remote { + auth = pubkey + id = moon.strongswan.org + } + children { + rw { + remote_ts = fec2::0/16 + icmp = yes + + updown = /usr/local/libexec/ipsec/_updown iptables + hostaccess = yes + esp_proposals = aes128-sha256-x25519 + } + } + version = 2 + mobike = no + proposals = aes128-sha256-x25519 + } +} + +authorities { + strongswan { + cacert = strongswanCert.pem + crl_uris = http://ip6-winnetou.strongswan.org/strongswan.crl + } +} diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/posttest.dat b/testing/tests/ipv6/net2net-icmp-forward-ikev2/posttest.dat new file mode 100644 index 000000000..e02a9ed89 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/posttest.dat @@ -0,0 +1,18 @@ +venus::systemctl stop strongswan +moon::systemctl stop strongswan +sun::systemctl stop strongswan +alice::"ip route del fec2:\:/16 via fec1:\:1" +venus::"ip route del fec2:\:/16 via fec1:\:1" +moon::"ip route del fec2:\:/16 via fec0:\:2" +sun::"ip route del fec1:\:/16 via fec0:\:1" +bob::"ip route del fec1:\:/16 via fec2:\:1" +sun::"ip route del fec2:\:20/126 via fec2:\:10" +sun::"ip route del fec2:\:10/128 dev eth1" +venus::"ip route del fec0:\:/16 via fec1:\:1" +winnetou::"ip route del fec1:\:/16 via fec0:\:1" +venus::iptables-restore < /etc/iptables.flush +moon::iptables-restore < /etc/iptables.flush +sun::iptables-restore < /etc/iptables.flush +venus::ip6tables-restore < /etc/ip6tables.flush +moon::ip6tables-restore < /etc/ip6tables.flush +sun::ip6tables-restore < /etc/ip6tables.flush diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/pretest.dat b/testing/tests/ipv6/net2net-icmp-forward-ikev2/pretest.dat new file mode 100644 index 000000000..c53d60068 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/pretest.dat @@ -0,0 +1,27 @@ +venus::iptables-restore < /etc/iptables.drop +moon::iptables-restore < /etc/iptables.drop +sun::iptables-restore < /etc/iptables.drop +venus::ip6tables-restore < /etc/ip6tables.rules +moon::ip6tables-restore < /etc/ip6tables.rules +sun::ip6tables-restore < /etc/ip6tables.rules +venus::systemctl start --no-block strongswan +moon::systemctl start --no-block strongswan +sun::systemctl start --no-block strongswan +alice::"ip route add fec2:\:/16 via fec1:\:1" +venus::"ip route add fec2:\:/16 via fec1:\:1" +moon::"ip route add fec2:\:/16 via fec0:\:2" +sun::"ip route add fec1:\:/16 via fec0:\:1" +bob::"ip route add fec1:\:/16 via fec2:\:1" +venus::"ip route add fec0:\:/16 via fec1:\:1" +winnetou::"ip route add fec1:\:/16 via fec0:\:1" +# add a route for part of the private subnet via bob +sun::"ip route add fec2:\:20/126 via fec2:\:10" +# force a lower MTU for traffic to bob +sun::"ip route add fec2:\:10/128 dev eth1 src fec2:\:1 mtu 1280" +# allow decrypted ICMPv6s from any source IP (rules for sun and moon are in ip6tables.rules) +venus::ip6tables -A INPUT -p icmpv6 -m policy --dir in -j ACCEPT +venus::expect-connection rw +moon::expect-connection net-net +sun::expect-connection net-net +moon::swanctl --initiate --child net-net +venus::swanctl --initiate --child rw diff --git a/testing/tests/ipv6/net2net-icmp-forward-ikev2/test.conf b/testing/tests/ipv6/net2net-icmp-forward-ikev2/test.conf new file mode 100644 index 000000000..c527f7a77 --- /dev/null +++ b/testing/tests/ipv6/net2net-icmp-forward-ikev2/test.conf @@ -0,0 +1,29 @@ +#!/bin/bash +# +# This configuration file provides information on the +# guest instances used for this test + +# All guest instances that are required for this test +# +VIRTHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b-ip6.png" + +# Guest instances on which tcpdump is to be started +# +TCPDUMPHOSTS="venus sun" + +# Guest instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="venus moon sun" + +# IP protocol used by IPsec is IPv6 +# +IPV6=1 + +# charon controlled by swanctl +# +SWANCTL=1