denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Migrate ikev2-stroke-bye scenarios to vici

Browse Source
This commit is contained in:
Andreas Steffen
2021-06-22 10:23:06 +02:00
parent 706c58b291
commit eba2622587
931 changed files with 5934 additions and 5925 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/net2net-psk-dscp/description.txt
+13
View File
@@ -0,0 +1,13 @@
In order to support <b>Differentiated Services</b> (DiffServ), two parallel IPsec
connections between the subnets behind the gateways <b>moon</b> and <b>sun</b> are
set up. Using <b>XFRM marks</b> one IPsec SA is designated for <b>Best Effort</b> (BE)
traffic and the second SA for <b>Expedited Forwarding</b> (EF) traffic.
<p/>
The authentication is based on a <b>pre-shared key</b> (PSK). In order to guarantee that
the CHILD_SA with the correct mark is selected on the responder side, each CHILD_SA is
bound to an IKE_SA of its own with a distinct IKEv2 ID but sharing the same PSK.
<p/>
Upon the successful establishment of the IPsec tunnel, the updown script automatically
inserts iptables-based firewall rules that let pass the tunneled traffic
In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b>
pings client <b>bob</b> located behind gateway <b>sun</b>.
testing/tests/ikev2/net2net-psk-dscp/evaltest.dat
+8
View File
@@ -0,0 +1,8 @@
moon::swanctl --list-sas --raw 2> /dev/null::dscp-be.*version=2 state=ESTABLISHED local-host=PH_IP_MOON local-port=500 local-id=moon-be remote-host=PH_IP_SUN remote-port=500 remote-id=sun-be initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*mark-in=0000000a mark-out=0000000a encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
moon::swanctl --list-sas --raw 2> /dev/null::dscp-ef.*version=2 state=ESTABLISHED local-host=PH_IP_MOON local-port=500 local-id=moon-ef remote-host=PH_IP_SUN remote-port=500 remote-id=sun-ef initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*mark-in=00000014 mark-out=00000014 encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::dscp-be.*version=2 state=ESTABLISHED local-host=PH_IP_SUN local-port=500 local-id=sun-be remote-host=PH_IP_MOON remote-port=500 remote-id=moon-be.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*mark-in=0000000a mark-out=0000000a encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::dscp-ef.*version=2 state=ESTABLISHED local-host=PH_IP_SUN local-port=500 local-id=sun-ef remote-host=PH_IP_MOON remote-port=500 remote-id=moon-ef.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*mark-in=00000014 mark-out=00000014 encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
testing/tests/ikev2/net2net-psk-dscp/hosts/moon/etc/strongswan.conf
+10
View File
@@ -0,0 +1,10 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 curve25519 hmac curl vici kernel-netlink socket-default updown
syslog {
daemon {
knl = 2
}
}
}
testing/tests/ikev2/net2net-psk-dscp/hosts/moon/etc/swanctl/swanctl.conf
Executable
+54
View File
@@ -0,0 +1,54 @@
connections {
dscp-be {
local_addrs = PH_IP_MOON
remote_addrs = PH_IP_SUN
local {
auth = psk
id = moon-be
}
remote {
auth = psk
id = sun-be
}
children {
net-net {
local_ts = 10.1.0.0/16
remote_ts = 10.2.0.0/16
mark_in = 10
mark_out = 10
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
mobike = no
proposals = aes128-sha256-x25519
}
dscp-ef : connections.dscp-be {
local {
id = moon-ef
}
remote {
id = sun-ef
}
children {
net-net {
mark_in = 20
mark_out = 20
}
}
}
}
secrets {
ike {
id-be = sun-be
id-ef = sun-ef
secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
}
}
testing/tests/ikev2/net2net-psk-dscp/hosts/sun/etc/strongswan.conf
+11
View File
@@ -0,0 +1,11 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 curve25519 hmac curl vici kernel-netlink socket-default updown
multiple_authentication = no
syslog {
daemon {
knl = 2
}
}
}
testing/tests/ikev2/net2net-psk-dscp/hosts/sun/etc/swanctl/swanctl.conf
Executable
+64
View File
@@ -0,0 +1,64 @@
dscp-base {
local_addrs = PH_IP_SUN
remote_addrs = PH_IP_MOON
local {
auth = psk
}
remote {
auth = psk
}
children {
net-net {
local_ts = 10.2.0.0/16
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
mobike = no
proposals = aes128-sha256-x25519
}
connections {
dscp-be : dscp-base {
local {
id = sun-be
}
remote {
id = moon-be
}
children {
net-net {
mark_in = 10
mark_out = 10
}
}
}
dscp-ef : dscp-base {
local {
id = sun-ef
}
remote {
id = moon-ef
}
children {
net-net {
mark_in = 20
mark_out = 20
}
}
}
}
secrets {
ike {
id-be = moon-be
id-ef = moon-ef
secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
}
}
testing/tests/ikev2/net2net-psk-dscp/posttest.dat
+8
View File
@@ -0,0 +1,8 @@
moon::systemctl stop strongswan
sun::systemctl stop strongswan
moon::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
alice::iptables -t mangle -F OUTPUT
venus::iptables -t mangle -F OUTPUT
bob::iptables -t mangle -F OUTPUT
testing/tests/ikev2/net2net-psk-dscp/pretest.dat
+19
View File
@@ -0,0 +1,19 @@
moon::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
moon::cd /etc/swanctl; rm rsa/* x509/* x509ca/*
sun::cd /etc/swanctl; rm rsa/* x509/* x509ca/*
alice::iptables -t mangle -A OUTPUT -p icmp -j DSCP --set-dscp-class BE
venus::iptables -t mangle -A OUTPUT -p icmp -j DSCP --set-dscp-class EF
moon::iptables -t mangle -A PREROUTING -m dscp --dscp-class BE -j MARK --set-mark 10
moon::iptables -t mangle -A PREROUTING -m dscp --dscp-class EF -j MARK --set-mark 20
bob::iptables -t mangle -A OUTPUT -d PH_IP_ALICE -p icmp -j DSCP --set-dscp-class BE
bob::iptables -t mangle -A OUTPUT -d PH_IP_VENUS -p icmp -j DSCP --set-dscp-class EF
sun::iptables -t mangle -A PREROUTING -m dscp --dscp-class BE -j MARK --set-mark 10
sun::iptables -t mangle -A PREROUTING -m dscp --dscp-class EF -j MARK --set-mark 20
sun::systemctl start strongswan
moon::systemctl start strongswan
sun::expect-connection dscp-ef
moon::expect-connection dscp-be
moon::swanctl --initiate --ike dscp-be --child net-net
moon::expect-connection dscp-ef
moon::swanctl --initiate --ike dscp-ef --child net-net
testing/tests/ikev2/net2net-psk-dscp/test.conf
+25
View File
@@ -0,0 +1,25 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
# charon controlled by swanctl
#
SWANCTL=1