testing: Add ikev2/per-cpu-sas-encap-transport scenario

Tests transport mode and UDP encapsulation with random source ports. Interestingly, the responder always uses the same SA to respond (maybe due to the cache on the policy).
2025-05-28 16:35:27 +02:00
parent 3b2f8cf282
commit b7d3349000
9 changed files with 229 additions and 0 deletions
@@ -0,0 +1,15 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici
+
+  syslog {
+    daemon {
+      knl = 2
+    }
+  }
+}
@@ -0,0 +1,32 @@
+connections {
+
+   gw-gw {
+      local_addrs  = 192.168.0.1
+      remote_addrs = 192.168.0.2
+
+      local {
+         auth = pubkey
+         certs = moonCert.pem
+         id = moon.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = sun.strongswan.org
+      }
+      children {
+         net-net {
+            mode = transport
+            per_cpu_sas = encap
+
+            start_action = trap
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            hostaccess = yes
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      mobike = no
+      encap = yes
+      proposals = aes128-sha256-x25519
+   }
+}
@@ -0,0 +1,15 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici
+
+  syslog {
+    daemon {
+      knl = 2
+    }
+  }
+}
@@ -0,0 +1,32 @@
+connections {
+
+   gw-gw {
+      local_addrs  = 192.168.0.2
+      remote_addrs = 192.168.0.1
+
+      local {
+         auth = pubkey
+         certs = sunCert.pem
+         id = sun.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = moon.strongswan.org
+      }
+      children {
+         net-net {
+            mode = transport
+            per_cpu_sas = encap
+
+            start_action = trap
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            hostaccess = yes
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      mobike = no
+      encap = yes
+      proposals = aes128-sha256-x25519
+   }
+}