testing: Migrate ikev2-stroke-bye scenarios to vici
This commit is contained in:
Andreas Steffen
@@ -0,0 +1,8 @@
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to
|
||||
gateway <b>moon</b> and request a <b>virtual IP</b>. <b>moon</b> negotiates
|
||||
broadcast and multicast traffic selectors with the clients, and uses
|
||||
<i>%unique</i> marks to avoid any policy conflicts. The enabled <i>forecast</i>
|
||||
plugin on <b>moon</b> installs the required Netfilter rules to make use of these
|
||||
policies, and additionally starts forwarding broadcast and multicast packets
|
||||
between the clients.<br/>
|
||||
To test forwarding, the hosts send multicast and broadcast ping messages.
|
||||
@@ -0,0 +1,16 @@
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=PH_IP_CAROL local-port=4500 [email protected] remote-host=PH_IP_MOON remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.129/32 10.1.255.255/32 224.0.0.0/4] remote-ts=\[10.1.0.0/16 224.0.0.0/4]::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=PH_IP_DAVE local-port=4500 [email protected] remote-host=PH_IP_MOON remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.130/32 10.1.255.255/32 224.0.0.0/4] remote-ts=\[10.1.0.0/16 224.0.0.0/4]::YES
|
||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=PH_IP_MOON local-port=4500 local-id=moon.strongswan.org remote-host=PH_IP_CAROL remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*rw.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16 224.0.0.0/4] remote-ts=\[10.1.0.129/32 10.1.255.255/32 224.0.0.0/4]::YES
|
||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=PH_IP_MOON local-port=4500 local-id=moon.strongswan.org remote-host=PH_IP_DAVE remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*rw.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16 224.0.0.0/4] remote-ts=\[10.1.0.130/32 10.1.255.255/32 224.0.0.0/4]::YES
|
||||
alice::ping -W 1 -c 1 239.0.0.1 2>&1> /dev/null
|
||||
carol::ping -W 1 -c 1 239.0.0.2 2>&1> /dev/null
|
||||
dave::ping -W 1 -c 1 239.0.0.3 2>&1> /dev/null
|
||||
carol::ping -W 1 -c 1 -b 10.1.255.255 2>&1> /dev/null
|
||||
dave::ping -W 1 -c 1 -b 10.1.255.255 2>&1> /dev/null
|
||||
moon::iptables -t mangle -L -n -v
|
||||
carol::tcpdump::IP alice.strongswan.org > 239.0.0.1: ICMP echo request::YES
|
||||
dave::tcpdump::IP alice.strongswan.org > 239.0.0.1: ICMP echo request::YES
|
||||
carol::tcpdump::IP 10.1.0.130 > 239.0.0.3: ICMP echo request::YES
|
||||
dave::tcpdump::IP 10.1.0.129 > 239.0.0.2: ICMP echo request::YES
|
||||
carol::tcpdump::IP 10.1.0.130 > 10.1.255.255: ICMP echo request::YES
|
||||
dave::tcpdump::IP 10.1.0.129 > 10.1.255.255: ICMP echo request::YES
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown resolve
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = PH_IP_CAROL
|
||||
remote_addrs = PH_IP_MOON
|
||||
|
||||
vips = 0.0.0.0
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
local_ts = 0.0.0.0/0
|
||||
remote_ts = 0.0.0.0/0
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown resolve
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = PH_IP_DAVE
|
||||
remote_addrs = PH_IP_MOON
|
||||
|
||||
vips = 0.0.0.0
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = daveCert.pem
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
local_ts = 0.0.0.0/0
|
||||
remote_ts = 0.0.0.0/0
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown attr forecast
|
||||
|
||||
syslog {
|
||||
daemon {
|
||||
net = 2
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
forecast {
|
||||
interface = eth1
|
||||
reinject = rw
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = PH_IP_MOON
|
||||
|
||||
pools = rw
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = *@strongswan.org
|
||||
}
|
||||
children {
|
||||
rw {
|
||||
local_ts = 10.1.0.0/16,224.0.0.0/4
|
||||
remote_ts = dynamic,224.0.0.0/4,10.1.255.255
|
||||
|
||||
mark_in = %unique
|
||||
mark_out = %unique
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
|
||||
pools {
|
||||
rw {
|
||||
addrs = 10.1.0.128/26
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
moon::systemctl stop strongswan
|
||||
carol::systemctl stop strongswan
|
||||
dave::systemctl stop strongswan
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
@@ -0,0 +1,8 @@
|
||||
moon::systemctl start strongswan
|
||||
carol::systemctl start strongswan
|
||||
dave::systemctl start strongswan
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home
|
||||
dave::expect-connection home
|
||||
dave::swanctl --initiate --child home
|
||||
@@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou dave"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w-d.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon carol dave"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol dave"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
Reference in New Issue
Block a user