denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Updated updown scripts in libipsec scenarios to latest version

Browse Source
This commit is contained in:
Tobias Brunner
2016-03-23 14:13:07 +01:00
parent 958c0e8e5c
commit a9f9598ed0
11 changed files with 341 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/libipsec/host2host-cert/hosts/moon/etc/updown
+31
View File
@@ -441,6 +441,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -465,6 +473,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -504,6 +519,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -547,6 +571,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/host2host-cert/hosts/sun/etc/updown
+31
View File
@@ -441,6 +441,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -465,6 +473,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -504,6 +519,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -547,6 +571,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/net2net-3des/hosts/moon/etc/updown
+31
View File
@@ -441,6 +441,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -465,6 +473,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -504,6 +519,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -547,6 +571,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/net2net-3des/hosts/sun/etc/updown
+31
View File
@@ -441,6 +441,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -465,6 +473,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -504,6 +519,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -547,6 +571,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/net2net-cert/hosts/moon/etc/updown
+31
View File
@@ -441,6 +441,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -465,6 +473,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -504,6 +519,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -547,6 +571,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/net2net-cert/hosts/sun/etc/updown
+31
View File
@@ -441,6 +441,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -465,6 +473,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -504,6 +519,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -547,6 +571,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/net2net-null/hosts/moon/etc/updown
+31
View File
@@ -441,6 +441,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -465,6 +473,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -504,6 +519,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -547,6 +571,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/net2net-null/hosts/sun/etc/updown
+31
View File
@@ -441,6 +441,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -465,6 +473,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -504,6 +519,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -547,6 +571,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/rw-suite-b/hosts/carol/etc/updown
+31
View File
@@ -482,6 +482,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -506,6 +514,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -545,6 +560,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -588,6 +612,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/rw-suite-b/hosts/dave/etc/updown
+31
View File
@@ -482,6 +482,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -506,6 +514,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -545,6 +560,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -588,6 +612,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then
testing/tests/libipsec/rw-suite-b/hosts/moon/etc/updown
+31
View File
@@ -482,6 +482,14 @@ up-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed)
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection setup
if [ $VPN_LOGGING ]
then
@@ -506,6 +514,13 @@ down-host-v6:iptables)
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec host connection teardown
if [ $VPN_LOGGING ]
then
@@ -545,6 +560,15 @@ up-client-v6:iptables)
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
#
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
# IPComp is used (for small inbound packets that are not compressed).
# INPUT is correct here even for forwarded traffic.
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection setup
if [ $VPN_LOGGING ]
then
@@ -588,6 +612,13 @@ down-client-v6:iptables)
$IPSEC_POLICY_OUT -j ACCEPT
fi
#
# IP6IP6 exception teardown
if [ -n "$PLUTO_IPCOMP" ]
then
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
# log IPsec client connection teardown
if [ $VPN_LOGGING ]
then