denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added swanctl/rw-cert scenario

Browse Source
This commit is contained in:
Andreas Steffen
2014-06-10 16:48:15 +02:00
parent 8fc0eae37b
commit c621847395
11 changed files with 216 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/swanctl/rw-cert/description.txt
Executable
+6
View File
@@ -0,0 +1,6 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
the client <b>alice</b> behind the gateway <b>moon</b>.
testing/tests/swanctl/rw-cert/evaltest.dat
Executable
+34
View File
@@ -0,0 +1,34 @@
carol::swanctl --list-sas 2> /dev/null::home: #1, ESTABLISHED, IKEv2::YES
dave:: swanctl --list-sas 2> /dev/null::home: #1, ESTABLISHED, IKEv2::YES
moon:: swanctl --list-sas --ike-id 1 2> /dev/null::rw: #1, ESTABLISHED, IKEv2::YES
moon:: swanctl --list-sas --ike-id 2 2> /dev/null::rw: #2, ESTABLISHED, IKEv2::YES
carol::swanctl --list-sas 2> /dev/null::local.*[email protected].*192.168.0.100::YES
carol::swanctl --list-sas 2> /dev/null::remote.*moon.strongswan.org.*192.168.0.1::YES
dave:: swanctl --list-sas 2> /dev/null::local.*[email protected].*192.168.0.200::YES
dave:: swanctl --list-sas 2> /dev/null::remote.*moon.strongswan.org.*192.168.0.1::YES
moon:: swanctl --list-sas --ike-id 1 2> /dev/null::local.*moon.strongswan.org.*192.168.0.1::YES
moon:: swanctl --list-sas --ike-id 1 2> /dev/null::remote.*[email protected].*192.168.0.100::YES
moon:: swanctl --list-sas --ike-id 2 2> /dev/null::local.*moon.strongswan.org.*192.168.0.1::YES
moon:: swanctl --list-sas --ike-id 2 2> /dev/null::remote.*[email protected].*192.168.0.200::YES
carol::swanctl --list-sas 2> /dev/null::AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
dave:: swanctl --list-sas 2> /dev/null::AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
moon:: swanctl --list-sas --ike-id 1 2> /dev/null::AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
moon:: swanctl --list-sas --ike-id 2 2> /dev/null::AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
carol::swanctl --list-sas 2> /dev/null::home: #1, INSTALLED, TUNNEL, ESP:AES_GCM_16-128::YES
dave:: swanctl --list-sas 2> /dev/null::home: #1, INSTALLED, TUNNEL, ESP:AES_GCM_16-128::YES
moon:: swanctl --list-sas --ike-id 1 2> /dev/null::net: #1, INSTALLED, TUNNEL, ESP:AES_GCM_16-128::YES
moon:: swanctl --list-sas --ike-id 2 2> /dev/null::net: #2, INSTALLED, TUNNEL, ESP:AES_GCM_16-128::YES
carol::swanctl --list-sas 2> /dev/null::local.*192.168.0.100/32::YES
carol::swanctl --list-sas 2> /dev/null::remote 10.1.0.0/16::YES
dave:: swanctl --list-sas 2> /dev/null::local.*192.168.0.200/32::YES
dave:: swanctl --list-sas 2> /dev/null::remote 10.1.0.0/16::YES
moon:: swanctl --list-sas --ike-id 1 2> /dev/null::local.*10.1.0.0/16::YES
moon:: swanctl --list-sas --ike-id 1 2> /dev/null::remote 192.168.0.100/32::YES
moon:: swanctl --list-sas --ike-id 2 2> /dev/null::local.*10.1.0.0/16::YES
moon:: swanctl --list-sas --ike-id 2 2> /dev/null::remote 192.168.0.200/32::YES
alice::ping -c 1 192.168.0.100::64 bytes from 192.168.0.100: icmp_req=1::YES
alice::ping -c 1 192.168.0.200::64 bytes from 192.168.0.200: icmp_req=1::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/swanctl/rw-cert/hosts/carol/etc/strongswan.conf
Executable
+13
View File
@@ -0,0 +1,13 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon {
load = sha1 sha2 md5 aes des hmac pem pkcs1 x509 revocation constraints pubkey gmp random nonce curl kernel-netlink socket-default updown vici
}
libstrongswan {
dh_exponent_ansi_x9_42 = no
}
testing/tests/swanctl/rw-cert/hosts/carol/etc/swanctl/swanctl.conf
Executable
+32
View File
@@ -0,0 +1,32 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
start_action = none
updown = /usr/local/libexec/ipsec/_updown iptables
rekey_time = 10m
esp_proposals = aes128gcm128-modp2048
}
}
version = 2
reauth_time = 60m
rekey_time = 20m
proposals = aes128-sha256-modp2048
}
}
testing/tests/swanctl/rw-cert/hosts/dave/etc/strongswan.conf
Executable
+13
View File
@@ -0,0 +1,13 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon {
load = sha1 sha2 md5 aes des hmac pem pkcs1 x509 revocation constraints pubkey gmp random nonce curl kernel-netlink socket-default updown vici
}
libstrongswan {
dh_exponent_ansi_x9_42 = no
}
testing/tests/swanctl/rw-cert/hosts/dave/etc/swanctl/swanctl.conf
Executable
+32
View File
@@ -0,0 +1,32 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
start_action = none
updown = /usr/local/libexec/ipsec/_updown iptables
rekey_time = 10m
esp_proposals = aes128gcm128-modp2048
}
}
version = 2
reauth_time = 60m
rekey_time = 20m
proposals = aes128-sha256-modp2048
}
}
testing/tests/swanctl/rw-cert/hosts/moon/etc/strongswan.conf
Executable
+13
View File
@@ -0,0 +1,13 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon {
load = sha1 sha2 md5 aes des hmac pem pkcs1 x509 revocation constraints pubkey gmp random nonce curl kernel-netlink socket-default updown vici
}
libstrongswan {
dh_exponent_ansi_x9_42 = no
}
testing/tests/swanctl/rw-cert/hosts/moon/etc/swanctl/swanctl.conf
Executable
+30
View File
@@ -0,0 +1,30 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
start_action = none
updown = /usr/local/libexec/ipsec/_updown iptables
rekey_time = 10m
esp_proposals = aes128gcm128-modp2048
}
}
version = 2
reauth_time = 60m
rekey_time = 20m
proposals = aes128-sha256-modp2048
}
}
testing/tests/swanctl/rw-cert/posttest.dat
Executable
+8
View File
@@ -0,0 +1,8 @@
carol::swanctl --terminate --ike home
dave::swanctl --terminate --ike home
carol::service charon stop 2> /dev/null
dave::service charon stop 2> /dev/null
moon::service charon stop 2> /dev/null
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
testing/tests/swanctl/rw-cert/pretest.dat
Executable
+14
View File
@@ -0,0 +1,14 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
moon::service charon start 2> /dev/null
carol::service charon start 2> /dev/null
dave::service charon start 2> /dev/null
moon::swanctl --load-conns 2> /dev/null
carol::swanctl --load-conns 2> /dev/null
dave::swanctl --load-conns 2> /dev/null
moon::swanctl --load-creds 2> /dev/null
carol::swanctl --load-creds 2> /dev/null
dave::swanctl --load-creds 2> /dev/null
carol::swanctl --initiate --child home 2> /dev/null
dave::swanctl --initiate --child home 2> /dev/null
testing/tests/swanctl/rw-cert/test.conf
Executable
+21
View File
@@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"