testing: Migrate ikev2-stroke-bye scenarios to vici

2021-06-22 10:23:06 +02:00
parent 706c58b291
commit eba2622587
931 changed files with 5934 additions and 5925 deletions
@@ -0,0 +1,8 @@
+The hosts <b>moon</b>, <b>sun</b> and <b>dave</b> install <b>transport-mode</b> trap
+policies with <b>remote_addrs=%any</b>.  The remote host is dynamically determined
+based on the acquires received from the kernel.  Host <b>dave</b> additionally limits
+the remote hosts to <b>moon</b> and <b>sun</b> with <b>remote_ts</b>.  This is tested by
+pinging <b>sun</b> and <b>carol</b> from <b>moon</b>, <b>carol</b> from <b>sun</b>, and
+<b>sun</b> and <b>moon</b> from <b>dave</b>. The latter also pings <b>carol</b>, which
+is not going to be encrypted as <b>carol</b> is not part of the configured
+<b>remote_ts</b>.
@@ -0,0 +1,29 @@
+moon::ping -c 2 -W 1 -i 0.4 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=2::YES
+moon::ping -c 2 -W 1 -i 0.4 PH_IP_CAROL::64 bytes from PH_IP_CAROL: icmp_.eq=2::YES
+sun::ping -c 2 -W 1 -i 0.4 PH_IP_CAROL::64 bytes from PH_IP_CAROL: icmp_.eq=2::YES
+dave::ping -c 2 -W 1 -i 0.4 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_.eq=2::YES
+dave::ping -c 2 -W 1 -i 0.4 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=2::YES
+dave::ping -c 1 PH_IP_CAROL::64 bytes from PH_IP_CAROL: icmp_.eq=1::YES
+moon::swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_MOON.*remote-host=PH_IP_SUN.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_MOON/32] remote-ts=\[PH_IP_SUN/32]::YES
+moon::swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_MOON.*remote-host=PH_IP_CAROL.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_MOON/32] remote-ts=\[PH_IP_CAROL/32]::YES
+moon::swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_MOON.*remote-host=PH_IP_DAVE.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_MOON/32] remote-ts=\[PH_IP_DAVE/32]::YES
+sun:: swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_SUN.*remote-host=PH_IP_MOON.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_SUN/32] remote-ts=\[PH_IP_MOON/32]::YES
+sun:: swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_SUN.*remote-host=PH_IP_DAVE.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_SUN/32] remote-ts=\[PH_IP_DAVE/32]::YES
+sun:: swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_SUN.*remote-host=PH_IP_CAROL.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_SUN/32] remote-ts=\[PH_IP_CAROL/32]::YES
+dave::swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_DAVE.*remote-host=PH_IP_MOON.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_DAVE/32] remote-ts=\[PH_IP_MOON/32]::YES
+dave::swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_DAVE.*remote-host=PH_IP_SUN.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_DAVE/32] remote-ts=\[PH_IP_SUN/32]::YES
+carol::swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_CAROL.*remote-host=PH_IP_MOON.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_CAROL/32] remote-ts=\[PH_IP_MOON/32]::YES
+carol::swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_CAROL.*remote-host=PH_IP_SUN.*child-sas.*trap-any.*state=INSTALLED mode=TRANSPORT.*local-ts=\[PH_IP_CAROL/32] remote-ts=\[PH_IP_SUN/32]::YES
+carol::swanctl --list-sas --raw 2> /dev/null::trap-any.*state=ESTABLISHED local-host=PH_IP_CAROL.*remote-host=PH_IP_DAVE::NO
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
+sun::tcpdump::IP carol.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > carol.strongswan.org: ESP::YES
+sun::tcpdump::IP dave.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > dave.strongswan.org: ESP::YES
+carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+carol::tcpdump::IP sun.strongswan.org > carol.strongswan.org: ESP::YES
+carol::tcpdump::IP carol.strongswan.org > sun.strongswan.org: ESP::YES
+carol::tcpdump::IP dave.strongswan.org > carol.strongswan.org: ICMP echo request::YES
+carol::tcpdump::IP carol.strongswan.org > dave.strongswan.org: ICMP echo reply::YES
@@ -0,0 +1,14 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
+  syslog {
+    daemon {
+      knl = 2
+    }
+  }
+}
@@ -0,0 +1,24 @@
+connections {
+
+   trap-any {
+      remote_addrs = %any
+
+      local {
+         auth = psk
+      }
+      remote {
+         auth = psk
+      }
+      children {
+         trap-any {
+            mode = transport
+         }
+      }
+   }
+}
+
+secrets {
+   ike {
+      secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
+   }
+}
@@ -0,0 +1,14 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
+  syslog {
+    daemon {
+      knl = 2
+    }
+  }
+}
@@ -0,0 +1,26 @@
+connections {
+
+   trap-any {
+      remote_addrs = %any
+
+      local {
+         auth = psk
+      }
+      remote {
+         auth = psk
+      }
+      children {
+         trap-any {
+            remote_ts = 192.168.0.0/30
+            mode = transport
+            start_action = trap
+         }
+      }
+   }
+}
+
+secrets {
+   ike {
+      secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
+   }
+}
@@ -0,0 +1,14 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
+  syslog {
+    daemon {
+      knl = 2
+    }
+  }
+}
@@ -0,0 +1,39 @@
+connections {
+
+   trap-any {
+      remote_addrs = %any
+
+      local {
+         auth = psk
+      }
+      remote {
+         auth = psk
+      }
+      children {
+         trap-any {
+            mode = transport
+            start_action = trap
+         }
+      }
+   }
+
+   # to access the host via SSH in the test environment
+   pass {
+      remote_addrs = 127.0.0.1
+
+      children {
+         pass-ssh {
+            local_ts = 0.0.0.0/0[tcp/22]
+            remote_ts = 0.0.0.0/0[tcp]
+            mode = pass
+            start_action = trap
+         }
+      }
+   }
+}
+
+secrets {
+   ike {
+      secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
+   }
+}
@@ -0,0 +1,14 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
+  syslog {
+    daemon {
+      knl = 2
+    }
+  }
+}
@@ -0,0 +1,39 @@
+connections {
+
+   trap-any {
+      remote_addrs = %any
+
+      local {
+         auth = psk
+      }
+      remote {
+         auth = psk
+      }
+      children {
+         trap-any {
+            mode = transport
+            start_action = trap
+         }
+      }
+   }
+
+   # to access the host via SSH in the test environment
+   pass {
+      remote_addrs = 127.0.0.1
+
+      children {
+         pass-ssh {
+            local_ts = 0.0.0.0/0[tcp/22]
+            remote_ts = 0.0.0.0/0[tcp]
+            mode = pass
+            start_action = trap
+         }
+      }
+   }
+}
+
+secrets {
+   ike {
+      secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
+   }
+}
@@ -0,0 +1,4 @@
+moon::systemctl stop strongswan
+sun::systemctl stop strongswan
+carol::systemctl stop strongswan
+dave::systemctl stop strongswan
@@ -0,0 +1,5 @@
+moon::systemctl start strongswan
+sun::systemctl start strongswan
+carol::systemctl start strongswan
+dave::systemctl start strongswan
+moon::sleep 1
@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="moon winnetou sun carol dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d-s.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun carol"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun carol dave"
+
+# charon controlled by swanctl
+#
+SWANCTL=1