testing: Removed openssl suite B scenarios
This commit is contained in:
Andreas Steffen
@@ -1,12 +0,0 @@
|
|||||||
The roadwarrior <b>dave</b> tries to set up a connection to roadwarrior <b>carol</b>
|
|
||||||
but because <b>carol</b> has set the strongswan.conf option <b>initiator_only = yes</b>
|
|
||||||
she ignores the repeated IKE requests sent by <b>dave</b>.
|
|
||||||
<p/>
|
|
||||||
After the failed connection attempt by <b>dave</b>, roadwarrior <b>carol</b> sets up a
|
|
||||||
connection to gateway <b>moon</b>. The authentication is based on Suite B with <b>128 bit</b>
|
|
||||||
security based on <b>X.509 ECDSA</b> certificates, <b>ECP Diffie-Hellman</b> groups and <b>AES-GCM</b>
|
|
||||||
authenticated encryption.
|
|
||||||
<p/>
|
|
||||||
Upon the successful establishment of the IPsec tunnel, the static IPsec policy rules of
|
|
||||||
an iptables-based firewall let pass the tunneled traffic. In order to test both tunnel and firewall,
|
|
||||||
<b>carol</b> pings the client <b>alice</b> behind the gateway <b>moon</b>.
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
dave:: cat /var/log/daemon.log::establishing IKE_SA failed, peer not responding::YES
|
|
||||||
carol::cat /var/log/daemon.log::openssl FIPS mode(2) - enabled::YES
|
|
||||||
moon:: cat /var/log/daemon.log::openssl FIPS mode(2) - enabled::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of.*[email protected].*with ECDSA_WITH_SHA256_DER successful::YES
|
|
||||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
|
||||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
|
||||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
|
||||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
|
|
||||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
|
||||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
|
||||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
config setup
|
|
||||||
|
|
||||||
conn %default
|
|
||||||
ikelifetime=60m
|
|
||||||
keylife=20m
|
|
||||||
rekeymargin=3m
|
|
||||||
keyingtries=1
|
|
||||||
keyexchange=ikev2
|
|
||||||
ike=aes128gcm128-prfsha256-ecp256!
|
|
||||||
esp=aes128gcm128-ecp256!
|
|
||||||
|
|
||||||
conn home
|
|
||||||
left=PH_IP_CAROL
|
|
||||||
leftcert=carolCert.pem
|
|
||||||
[email protected]
|
|
||||||
leftfirewall=yes
|
|
||||||
right=PH_IP_MOON
|
|
||||||
[email protected]
|
|
||||||
rightsubnet=10.1.0.0/16
|
|
||||||
auto=add
|
|
||||||
-15
@@ -1,15 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAbKgAwIBAgIJAPaidX4i76aJMAoGCCqGSM49BAMEMEgxCzAJBgNVBAYT
|
|
||||||
AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMR4wHAYDVQQDExVzdHJvbmdT
|
|
||||||
d2FuIEVDIFJvb3QgQ0EwHhcNMTMwNjEzMDAwMDAwWhcNMjMwNjEzMDAwMDAwWjBI
|
|
||||||
MQswCQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UE
|
|
||||||
AxMVc3Ryb25nU3dhbiBFQyBSb290IENBMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
|
|
||||||
AAQBFMdTb4zSs2wx2kTzLKiH/+km1KcwWu/Df1iMheq2I/HuTHAKn0381HxSWWKE
|
|
||||||
J/5mz91X4zsUbjA465X73YDMcJMBQ4oFkHx4NwiW0u3kI4ztTK8cSCVLX0k5xdvb
|
|
||||||
TIeiGDHcWmSpaAhgjq6ZhghncQ9vysKF9UgNwZZ42jbe5Ek6J5KjQjBAMA8GA1Ud
|
|
||||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS6XflxthO1atHd
|
|
||||||
uja3qtLB7o/Y0jAKBggqhkjOPQQDBAOBjAAwgYgCQgGC5TVO0Yy05OIO9GwQ1X7E
|
|
||||||
J08tyxmzQnCPfXKEEUOD+DDnSCcK0aCrGAIZCTmLR7euOCZ8gkPurJbML5RAjJjd
|
|
||||||
YQJCAL9qmPe6hWCEEOiOgCsy50nr5Qwo+FfS05ZItrUGVUQZES9BtmpkhjZlAOrA
|
|
||||||
ihgk0RArH39otlUFPSbSE9bicCDy
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
-18
@@ -1,18 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIC8TCCAlKgAwIBAgIBEDAKBggqhkjOPQQDAjBIMQswCQYDVQQGEwJDSDEZMBcG
|
|
||||||
A1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25nU3dhbiBFQyBS
|
|
||||||
b290IENBMB4XDTE4MDYxMzEyMTEyMVoXDTIzMDYxMTEyMTEyMVowXzELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xFjAUBgNVBAsTDUVDRFNB
|
|
||||||
IDI1NiBiaXQxHTAbBgNVBAMMFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMFkwEwYHKoZI
|
|
||||||
zj0CAQYIKoZIzj0DAQcDQgAE3WHJOZfpI6KZX6zlKRtCvY0VwHW/K8SWjDCuoq+C
|
|
||||||
Vb7NnQ0Lpfb22Cihwjf0/ne78AcYGapZdt8/tdxlpQm+9qOCARQwggEQMAkGA1Ud
|
|
||||||
EwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBSpGHTyNt5Tfshldm2Oz0MlnHZ+
|
|
||||||
aTB4BgNVHSMEcTBvgBS6XflxthO1atHduja3qtLB7o/Y0qFMpEowSDELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHjAcBgNVBAMTFXN0cm9u
|
|
||||||
Z1N3YW4gRUMgUm9vdCBDQYIJAPaidX4i76aJMB8GA1UdEQQYMBaBFGNhcm9sQHN0
|
|
||||||
cm9uZ3N3YW4ub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuc3Ryb25n
|
|
||||||
c3dhbi5vcmcvc3Ryb25nc3dhbl9lYy5jcmwwCgYIKoZIzj0EAwIDgYwAMIGIAkIA
|
|
||||||
7r9urYVPXwOUBU120HDb/0Z+ezMm8vFtGsrJPME9JdW7bdkb1IpWpSobn3Ua94Gm
|
|
||||||
q7PtKPYbOoF6m4aAIhouWkwCQgChGMvdnRhLQiItMGybWY5mLOYemM9U3CjNLRSE
|
|
||||||
gDIPWr67i05MwdofcT2hYPSFHAyeI7OfJikHrAfDcTok6kPA3A==
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
-7
@@ -1,7 +0,0 @@
|
|||||||
-----BEGIN ENCRYPTED PRIVATE KEY-----
|
|
||||||
MIHeMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAgyh91hjqzCuAICCAAw
|
|
||||||
HQYJYIZIAWUDBAECBBBZwepsRENncvW5UJ/blAqmBIGQZdbHnD3PWEbUXZJPkbIK
|
|
||||||
VvJZkd2+k12IxdShMWwCeW93R+3nj+7T0NPAQqMbuqz51zgO+SuXDupUIKdLHKMy
|
|
||||||
vdasLrbA3fe7YFVlxQjB6fB69V059ifi61OCIO/KfC7Je4ff3TZVwJcUYpduPIkQ
|
|
||||||
BZAw46T0JtrXltFgxxGYnnTlzuYW6EDB3l6Fwb2zCyZm
|
|
||||||
-----END ENCRYPTED PRIVATE KEY-----
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
|
||||||
|
|
||||||
: ECDSA carolKey.pem "nH5ZQEWtku0RJEZ6"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
-P INPUT ACCEPT
|
|
||||||
-P OUTPUT ACCEPT
|
|
||||||
-P FORWARD ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*nat
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*mangle
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
# default policy is DROP
|
|
||||||
-P INPUT DROP
|
|
||||||
-P OUTPUT DROP
|
|
||||||
-P FORWARD DROP
|
|
||||||
|
|
||||||
# allow esp
|
|
||||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
||||||
|
|
||||||
# allow IKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow MobIKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow ssh
|
|
||||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
||||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
||||||
|
|
||||||
# allow crl fetch from winnetou
|
|
||||||
-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
|
|
||||||
|
|
||||||
# allow traffic tunnelled via IPsec
|
|
||||||
-A INPUT -i eth0 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon {
|
|
||||||
load = test-vectors pem pkcs1 pkcs8 random nonce x509 revocation openssl soup stroke kernel-netlink socket-default
|
|
||||||
|
|
||||||
initiator_only = yes
|
|
||||||
integrity_test = yes
|
|
||||||
|
|
||||||
crypto_test {
|
|
||||||
required = yes
|
|
||||||
on_add = yes
|
|
||||||
}
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
openssl {
|
|
||||||
fips_mode = 2
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
config setup
|
|
||||||
|
|
||||||
conn %default
|
|
||||||
ikelifetime=60m
|
|
||||||
keylife=20m
|
|
||||||
rekeymargin=3m
|
|
||||||
keyingtries=1
|
|
||||||
keyexchange=ikev2
|
|
||||||
ike=aes128gcm128-prfsha256-ecp256!
|
|
||||||
esp=aes128gcm128-ecp256!
|
|
||||||
|
|
||||||
conn peer
|
|
||||||
left=PH_IP_DAVE
|
|
||||||
leftcert=daveCert.pem
|
|
||||||
[email protected]
|
|
||||||
leftfirewall=yes
|
|
||||||
right=PH_IP_CAROL
|
|
||||||
[email protected]
|
|
||||||
auto=add
|
|
||||||
-15
@@ -1,15 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAbKgAwIBAgIJAPaidX4i76aJMAoGCCqGSM49BAMEMEgxCzAJBgNVBAYT
|
|
||||||
AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMR4wHAYDVQQDExVzdHJvbmdT
|
|
||||||
d2FuIEVDIFJvb3QgQ0EwHhcNMTMwNjEzMDAwMDAwWhcNMjMwNjEzMDAwMDAwWjBI
|
|
||||||
MQswCQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UE
|
|
||||||
AxMVc3Ryb25nU3dhbiBFQyBSb290IENBMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
|
|
||||||
AAQBFMdTb4zSs2wx2kTzLKiH/+km1KcwWu/Df1iMheq2I/HuTHAKn0381HxSWWKE
|
|
||||||
J/5mz91X4zsUbjA465X73YDMcJMBQ4oFkHx4NwiW0u3kI4ztTK8cSCVLX0k5xdvb
|
|
||||||
TIeiGDHcWmSpaAhgjq6ZhghncQ9vysKF9UgNwZZ42jbe5Ek6J5KjQjBAMA8GA1Ud
|
|
||||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS6XflxthO1atHd
|
|
||||||
uja3qtLB7o/Y0jAKBggqhkjOPQQDBAOBjAAwgYgCQgGC5TVO0Yy05OIO9GwQ1X7E
|
|
||||||
J08tyxmzQnCPfXKEEUOD+DDnSCcK0aCrGAIZCTmLR7euOCZ8gkPurJbML5RAjJjd
|
|
||||||
YQJCAL9qmPe6hWCEEOiOgCsy50nr5Qwo+FfS05ZItrUGVUQZES9BtmpkhjZlAOrA
|
|
||||||
ihgk0RArH39otlUFPSbSE9bicCDy
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIC7TCCAlCgAwIBAgIBEjAKBggqhkjOPQQDAjBIMQswCQYDVQQGEwJDSDEZMBcG
|
|
||||||
A1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25nU3dhbiBFQyBS
|
|
||||||
b290IENBMB4XDTE4MDYxMzEyMzUyNFoXDTIzMDYxMTEyMzUyNFowXjELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xFjAUBgNVBAsTDUVDRFNB
|
|
||||||
IDI1NiBiaXQxHDAaBgNVBAMME2RhdmVAc3Ryb25nc3dhbi5vcmcwWTATBgcqhkjO
|
|
||||||
PQIBBggqhkjOPQMBBwNCAATRc+i666sxHVohZ/4ld8ffz2xoa+x9+7TzM689nczQ
|
|
||||||
oZMs3+AJIjjNzdjvEe6kPHW73p51IdtlVF97Ib62hgQuo4IBEzCCAQ8wCQYDVR0T
|
|
||||||
BAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDA3QkktCD5ZvWeiepNeQPWpcKP8
|
|
||||||
MHgGA1UdIwRxMG+AFLpd+XG2E7Vq0d26Nreq0sHuj9jSoUykSjBIMQswCQYDVQQG
|
|
||||||
EwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25n
|
|
||||||
U3dhbiBFQyBSb290IENBggkA9qJ1fiLvpokwHgYDVR0RBBcwFYETZGF2ZUBzdHJv
|
|
||||||
bmdzd2FuLm9yZzA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLnN0cm9uZ3N3
|
|
||||||
YW4ub3JnL3N0cm9uZ3N3YW5fZWMuY3JsMAoGCCqGSM49BAMCA4GKADCBhgJBOrfM
|
|
||||||
xT0Cn1uXVvuS977ANQZwzAX4O9y5POFXBkDKLFPL9hgWg7jxhREkDRcvViovMmiM
|
|
||||||
EAjoEZLD8SysfYrRZxcCQXtgWTfS2GAIDSQS1of1so/8Z/xZdfoIWxRoZ/xmH7jY
|
|
||||||
Yt3wK6yGjziEbX9LGN4MkOwkJKjEkTwbTygv7Wt3arz/
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
-----BEGIN EC PRIVATE KEY-----
|
|
||||||
MHcCAQEEICEAikut4YuFnv6vLE/7Lk+LmQ+ic35apftbhu2+TICQoAoGCCqGSM49
|
|
||||||
AwEHoUQDQgAE0XPouuurMR1aIWf+JXfH389saGvsffu08zOvPZ3M0KGTLN/gCSI4
|
|
||||||
zc3Y7xHupDx1u96edSHbZVRfeyG+toYELg==
|
|
||||||
-----END EC PRIVATE KEY-----
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
|
||||||
|
|
||||||
: ECDSA daveKey.pem
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
-P INPUT ACCEPT
|
|
||||||
-P OUTPUT ACCEPT
|
|
||||||
-P FORWARD ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*nat
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*mangle
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
# default policy is DROP
|
|
||||||
-P INPUT DROP
|
|
||||||
-P OUTPUT DROP
|
|
||||||
-P FORWARD DROP
|
|
||||||
|
|
||||||
# allow esp
|
|
||||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
||||||
|
|
||||||
# allow IKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow MobIKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow ssh
|
|
||||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
||||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
||||||
|
|
||||||
# allow crl fetch from winnetou
|
|
||||||
-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
|
|
||||||
|
|
||||||
# allow traffic tunnelled via IPsec
|
|
||||||
-A INPUT -i eth0 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon {
|
|
||||||
load = test-vectors pem pkcs1 pkcs8 random nonce x509 revocation openssl soup stroke kernel-netlink socket-default
|
|
||||||
|
|
||||||
initiator_only = yes
|
|
||||||
integrity_test = yes
|
|
||||||
|
|
||||||
crypto_test {
|
|
||||||
required = yes
|
|
||||||
on_add = yes
|
|
||||||
}
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
openssl {
|
|
||||||
fips_mode = 2
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
config setup
|
|
||||||
|
|
||||||
conn %default
|
|
||||||
ikelifetime=60m
|
|
||||||
keylife=20m
|
|
||||||
rekey=no
|
|
||||||
reauth=no
|
|
||||||
keyexchange=ikev2
|
|
||||||
ike=aes128gcm128-prfsha256-ecp256!
|
|
||||||
esp=aes128gcm128-ecp256!
|
|
||||||
|
|
||||||
conn rw
|
|
||||||
left=PH_IP_MOON
|
|
||||||
leftcert=moonCert.pem
|
|
||||||
[email protected]
|
|
||||||
leftsubnet=10.1.0.0/16
|
|
||||||
leftfirewall=yes
|
|
||||||
right=%any
|
|
||||||
auto=add
|
|
||||||
-15
@@ -1,15 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAbKgAwIBAgIJAPaidX4i76aJMAoGCCqGSM49BAMEMEgxCzAJBgNVBAYT
|
|
||||||
AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMR4wHAYDVQQDExVzdHJvbmdT
|
|
||||||
d2FuIEVDIFJvb3QgQ0EwHhcNMTMwNjEzMDAwMDAwWhcNMjMwNjEzMDAwMDAwWjBI
|
|
||||||
MQswCQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UE
|
|
||||||
AxMVc3Ryb25nU3dhbiBFQyBSb290IENBMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
|
|
||||||
AAQBFMdTb4zSs2wx2kTzLKiH/+km1KcwWu/Df1iMheq2I/HuTHAKn0381HxSWWKE
|
|
||||||
J/5mz91X4zsUbjA465X73YDMcJMBQ4oFkHx4NwiW0u3kI4ztTK8cSCVLX0k5xdvb
|
|
||||||
TIeiGDHcWmSpaAhgjq6ZhghncQ9vysKF9UgNwZZ42jbe5Ek6J5KjQjBAMA8GA1Ud
|
|
||||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS6XflxthO1atHd
|
|
||||||
uja3qtLB7o/Y0jAKBggqhkjOPQQDBAOBjAAwgYgCQgGC5TVO0Yy05OIO9GwQ1X7E
|
|
||||||
J08tyxmzQnCPfXKEEUOD+DDnSCcK0aCrGAIZCTmLR7euOCZ8gkPurJbML5RAjJjd
|
|
||||||
YQJCAL9qmPe6hWCEEOiOgCsy50nr5Qwo+FfS05ZItrUGVUQZES9BtmpkhjZlAOrA
|
|
||||||
ihgk0RArH39otlUFPSbSE9bicCDy
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIC7jCCAlCgAwIBAgIBEzAKBggqhkjOPQQDAjBIMQswCQYDVQQGEwJDSDEZMBcG
|
|
||||||
A1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25nU3dhbiBFQyBS
|
|
||||||
b290IENBMB4XDTE4MDYxMzE0MzEzMVoXDTIzMDYxMTE0MzEzMVowXjELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xFjAUBgNVBAsTDUVDRFNB
|
|
||||||
IDI1NiBiaXQxHDAaBgNVBAMTE21vb24uc3Ryb25nc3dhbi5vcmcwWTATBgcqhkjO
|
|
||||||
PQIBBggqhkjOPQMBBwNCAATCqc/Wov++N8wvG3IhsEAxa38bxoIBPQZeOqMyi/lV
|
|
||||||
breEsOSJD/POV3gkt1lKOaQ502XdJcjdAvCqjtbpzCMWo4IBEzCCAQ8wCQYDVR0T
|
|
||||||
BAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFAtkayAwMYDQqnlKDRvm7HNCIxY8
|
|
||||||
MHgGA1UdIwRxMG+AFLpd+XG2E7Vq0d26Nreq0sHuj9jSoUykSjBIMQswCQYDVQQG
|
|
||||||
EwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25n
|
|
||||||
U3dhbiBFQyBSb290IENBggkA9qJ1fiLvpokwHgYDVR0RBBcwFYITbW9vbi5zdHJv
|
|
||||||
bmdzd2FuLm9yZzA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLnN0cm9uZ3N3
|
|
||||||
YW4ub3JnL3N0cm9uZ3N3YW5fZWMuY3JsMAoGCCqGSM49BAMCA4GLADCBhwJBVnfl
|
|
||||||
l9eV6R+jNdUCuz+yDdM7c1UpQ+Qy7rtXq50KZY7d1xJsTk152LxXIkO8EJnHmO4l
|
|
||||||
s39RHlGXItWcYGffXIICQgCLB+R8QFnMcKlgpjrxsuO/Ljg1RcMav3y3zaHJJJLT
|
|
||||||
eJBEL7RhDaPGcJ/hKU4TPwvSEIkswQaDnN+oAZiz/gFDUw==
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
-----BEGIN EC PRIVATE KEY-----
|
|
||||||
MHcCAQEEIG7fewqQ4RTIWsck4m9ftByXOl4X0va0RtYqdbiF9CAHoAoGCCqGSM49
|
|
||||||
AwEHoUQDQgAEwqnP1qL/vjfMLxtyIbBAMWt/G8aCAT0GXjqjMov5VW63hLDkiQ/z
|
|
||||||
zld4JLdZSjmkOdNl3SXI3QLwqo7W6cwjFg==
|
|
||||||
-----END EC PRIVATE KEY-----
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
|
||||||
|
|
||||||
: ECDSA moonKey.pem
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
-P INPUT ACCEPT
|
|
||||||
-P OUTPUT ACCEPT
|
|
||||||
-P FORWARD ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*nat
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*mangle
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
# default policy is DROP
|
|
||||||
-P INPUT DROP
|
|
||||||
-P OUTPUT DROP
|
|
||||||
-P FORWARD DROP
|
|
||||||
|
|
||||||
# allow esp
|
|
||||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
||||||
|
|
||||||
# allow IKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow MobIKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow ssh
|
|
||||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
||||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
||||||
|
|
||||||
# allow crl fetch from winnetou
|
|
||||||
-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
|
|
||||||
|
|
||||||
# allow traffic tunnelled via IPsec
|
|
||||||
-A FORWARD -i eth0 -o eth1 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
|
||||||
-A FORWARD -o eth0 -i eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon {
|
|
||||||
load = test-vectors pem pkcs1 pkcs8 random nonce x509 revocation openssl soup stroke kernel-netlink socket-default
|
|
||||||
|
|
||||||
integrity_test = yes
|
|
||||||
|
|
||||||
crypto_test {
|
|
||||||
required = yes
|
|
||||||
on_add = yes
|
|
||||||
}
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
openssl {
|
|
||||||
fips_mode = 2
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
moon::ipsec stop
|
|
||||||
carol::ipsec stop
|
|
||||||
dave::ipsec stop
|
|
||||||
moon::iptables-restore < /etc/iptables.flush
|
|
||||||
carol::iptables-restore < /etc/iptables.flush
|
|
||||||
dave::iptables-restore < /etc/iptables.flush
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
moon::iptables-restore < /etc/iptables.rules
|
|
||||||
carol::iptables-restore < /etc/iptables.rules
|
|
||||||
dave::iptables-restore < /etc/iptables.rules
|
|
||||||
moon::ipsec start
|
|
||||||
carol::ipsec start
|
|
||||||
dave::ipsec start
|
|
||||||
moon::expect-connection rw
|
|
||||||
dave::expect-connection peer
|
|
||||||
dave::ipsec up peer
|
|
||||||
carol::expect-connection home
|
|
||||||
carol::ipsec up home
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# This configuration file provides information on the
|
|
||||||
# guest instances used for this test
|
|
||||||
|
|
||||||
# All guest instances that are required for this test
|
|
||||||
#
|
|
||||||
VIRTHOSTS="alice moon carol winnetou dave"
|
|
||||||
|
|
||||||
# Corresponding block diagram
|
|
||||||
#
|
|
||||||
DIAGRAM="a-m-c-w-d.png"
|
|
||||||
|
|
||||||
# Guest instances on which tcpdump is to be started
|
|
||||||
#
|
|
||||||
TCPDUMPHOSTS="moon"
|
|
||||||
|
|
||||||
# Guest instances on which IPsec is started
|
|
||||||
# Used for IPsec logging purposes
|
|
||||||
#
|
|
||||||
IPSECHOSTS="moon carol dave"
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
The roadwarrior <b>dave</b> tries to set up a connection to roadwarrior <b>carol</b>
|
|
||||||
but because <b>carol</b> has set the strongswan.conf option <b>initiator_only = yes</b>
|
|
||||||
she ignores the repeated IKE requests sent by <b>dave</b>.
|
|
||||||
<p/>
|
|
||||||
After the failed connection attempt by <b>dave</b>, roadwarrior <b>carol</b> sets up a
|
|
||||||
connection to gateway <b>moon</b>. The authentication is based on Suite B with <b>192 bit</b>
|
|
||||||
security based on <b>X.509 ECDSA</b> certificates, <b>ECP Diffie-Hellman</b> groups and <b>AES-GCM</b>
|
|
||||||
authenticated encryption.
|
|
||||||
<p/>
|
|
||||||
Upon the successful establishment of the IPsec tunnel, the static IPsec policy rules of
|
|
||||||
an iptables-based firewall let pass the tunneled traffic. In order to test both tunnel and firewall,
|
|
||||||
<b>carol</b> pings the client <b>alice</b> behind the gateway <b>moon</b>.
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
dave:: cat /var/log/daemon.log::establishing IKE_SA failed, peer not responding::YES
|
|
||||||
carol::cat /var/log/daemon.log::openssl FIPS mode(2) - enabled::YES
|
|
||||||
moon:: cat /var/log/daemon.log::openssl FIPS mode(2) - enabled::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of.*[email protected].*with ECDSA_WITH_SHA384_DER successful::YES
|
|
||||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
|
||||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
|
||||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
|
||||||
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
|
|
||||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
|
||||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
|
||||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
config setup
|
|
||||||
|
|
||||||
conn %default
|
|
||||||
ikelifetime=60m
|
|
||||||
keylife=20m
|
|
||||||
rekeymargin=3m
|
|
||||||
keyingtries=1
|
|
||||||
keyexchange=ikev2
|
|
||||||
ike=aes256gcm128-prfsha384-ecp384!
|
|
||||||
esp=aes256gcm128-ecp384!
|
|
||||||
|
|
||||||
conn home
|
|
||||||
left=PH_IP_CAROL
|
|
||||||
leftcert=carolCert.pem
|
|
||||||
[email protected]
|
|
||||||
leftfirewall=yes
|
|
||||||
right=PH_IP_MOON
|
|
||||||
[email protected]
|
|
||||||
rightsubnet=10.1.0.0/16
|
|
||||||
auto=add
|
|
||||||
-15
@@ -1,15 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAbKgAwIBAgIJAPaidX4i76aJMAoGCCqGSM49BAMEMEgxCzAJBgNVBAYT
|
|
||||||
AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMR4wHAYDVQQDExVzdHJvbmdT
|
|
||||||
d2FuIEVDIFJvb3QgQ0EwHhcNMTMwNjEzMDAwMDAwWhcNMjMwNjEzMDAwMDAwWjBI
|
|
||||||
MQswCQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UE
|
|
||||||
AxMVc3Ryb25nU3dhbiBFQyBSb290IENBMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
|
|
||||||
AAQBFMdTb4zSs2wx2kTzLKiH/+km1KcwWu/Df1iMheq2I/HuTHAKn0381HxSWWKE
|
|
||||||
J/5mz91X4zsUbjA465X73YDMcJMBQ4oFkHx4NwiW0u3kI4ztTK8cSCVLX0k5xdvb
|
|
||||||
TIeiGDHcWmSpaAhgjq6ZhghncQ9vysKF9UgNwZZ42jbe5Ek6J5KjQjBAMA8GA1Ud
|
|
||||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS6XflxthO1atHd
|
|
||||||
uja3qtLB7o/Y0jAKBggqhkjOPQQDBAOBjAAwgYgCQgGC5TVO0Yy05OIO9GwQ1X7E
|
|
||||||
J08tyxmzQnCPfXKEEUOD+DDnSCcK0aCrGAIZCTmLR7euOCZ8gkPurJbML5RAjJjd
|
|
||||||
YQJCAL9qmPe6hWCEEOiOgCsy50nr5Qwo+FfS05ZItrUGVUQZES9BtmpkhjZlAOrA
|
|
||||||
ihgk0RArH39otlUFPSbSE9bicCDy
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
-19
@@ -1,19 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIDDjCCAm+gAwIBAgIBETAKBggqhkjOPQQDAjBIMQswCQYDVQQGEwJDSDEZMBcG
|
|
||||||
A1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25nU3dhbiBFQyBS
|
|
||||||
b290IENBMB4XDTE4MDYxMzEyMzQzMloXDTIzMDYxMTEyMzQzMlowXzELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xFjAUBgNVBAsTDUVDRFNB
|
|
||||||
IDM4NCBiaXQxHTAbBgNVBAMMFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMHYwEAYHKoZI
|
|
||||||
zj0CAQYFK4EEACIDYgAExm8lmoXGUfLL8xzhhQFmadz7SjPdubASbH9m+t7h30OV
|
|
||||||
yo+NPmtve7uqrWzttyWfqR7tFSOLtP5joj8U9E580ilT/2MsjVQJpKOFpYaggPUK
|
|
||||||
f+fhRwfQMUunyyAoIRSbo4IBFDCCARAwCQYDVR0TBAIwADALBgNVHQ8EBAMCA6gw
|
|
||||||
HQYDVR0OBBYEFCQeIdu6skXTNWUg5w1Eb9HR1dU2MHgGA1UdIwRxMG+AFLpd+XG2
|
|
||||||
E7Vq0d26Nreq0sHuj9jSoUykSjBIMQswCQYDVQQGEwJDSDEZMBcGA1UEChMQTGlu
|
|
||||||
dXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25nU3dhbiBFQyBSb290IENBggkA
|
|
||||||
9qJ1fiLvpokwHwYDVR0RBBgwFoEUY2Fyb2xAc3Ryb25nc3dhbi5vcmcwPAYDVR0f
|
|
||||||
BDUwMzAxoC+gLYYraHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2Fu
|
|
||||||
X2VjLmNybDAKBggqhkjOPQQDAgOBjAAwgYgCQgGptTrYfjcWM+P66K5W+sq1d4X6
|
|
||||||
E0+I2lXRKRiku2vPjpTQZJim4k4pAJNC19R2CCJMBgqab1ROUUsHMMHBNcyR/gJC
|
|
||||||
AN6S1J68o3UTQwAyN/zXW4ur8cxsPKV9uZYoz7O6Snz+eTliz/g8NPtfLYUseCii
|
|
||||||
VoXhdWwKkiRd8Cjck+RJHVWh
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
-8
@@ -1,8 +0,0 @@
|
|||||||
-----BEGIN ENCRYPTED PRIVATE KEY-----
|
|
||||||
MIIBDjBJBgkqhkiG9w0BBQ0wPDAbBgkqhkiG9w0BBQwwDgQI1OV1cAp5SZcCAggA
|
|
||||||
MB0GCWCGSAFlAwQBFgQQ1SGtVnno2vKhkF+iPT6vygSBwFZQrciZs2FN8cDI0x9c
|
|
||||||
3OFxbaRawXnagMlpYq/To268rDFtcKGBN7JxwBaFGJw4NFrU/sOu2NkhLuA/Jbaz
|
|
||||||
w75aQ/MjTeOtwy2PS62J/+T1zqCdfpfCJYeYCc2CPd3E21FbsW0Mmfw1b8vZ2YeS
|
|
||||||
lsd9jvY/bob4tH68J1ZqErOLaCU0EXPgqlZiLhcDIwfZJDqrZ5xFHk3mcjB6Pc4O
|
|
||||||
TWwJN+elQoxd29HSASw9plO2p1DRDpSZPTU67UDXDOWfJA==
|
|
||||||
-----END ENCRYPTED PRIVATE KEY-----
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
|
||||||
|
|
||||||
: ECDSA carolKey.pem "nH5ZQEWtku0RJEZ6"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
-P INPUT ACCEPT
|
|
||||||
-P OUTPUT ACCEPT
|
|
||||||
-P FORWARD ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*nat
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*mangle
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
# default policy is DROP
|
|
||||||
-P INPUT DROP
|
|
||||||
-P OUTPUT DROP
|
|
||||||
-P FORWARD DROP
|
|
||||||
|
|
||||||
# allow esp
|
|
||||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
||||||
|
|
||||||
# allow IKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow MobIKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow ssh
|
|
||||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
||||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
||||||
|
|
||||||
# allow crl fetch from winnetou
|
|
||||||
-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
|
|
||||||
|
|
||||||
# allow traffic tunnelled via IPsec
|
|
||||||
-A INPUT -i eth0 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon {
|
|
||||||
load = test-vectors pem pkcs1 pkcs8 random nonce x509 revocation openssl soup stroke kernel-netlink socket-default
|
|
||||||
|
|
||||||
initiator_only = yes
|
|
||||||
integrity_test = yes
|
|
||||||
|
|
||||||
crypto_test {
|
|
||||||
required = yes
|
|
||||||
on_add = yes
|
|
||||||
}
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
openssl {
|
|
||||||
fips_mode = 2
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
config setup
|
|
||||||
|
|
||||||
conn %default
|
|
||||||
ikelifetime=60m
|
|
||||||
keylife=20m
|
|
||||||
rekeymargin=3m
|
|
||||||
keyingtries=1
|
|
||||||
keyexchange=ikev2
|
|
||||||
ike=aes256gcm128-prfsha384-ecp384!
|
|
||||||
esp=aes256gcm128-ecp384!
|
|
||||||
|
|
||||||
conn peer
|
|
||||||
left=PH_IP_DAVE
|
|
||||||
leftcert=daveCert.pem
|
|
||||||
[email protected]
|
|
||||||
leftfirewall=yes
|
|
||||||
right=PH_IP_CAROL
|
|
||||||
[email protected]
|
|
||||||
auto=add
|
|
||||||
-15
@@ -1,15 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAbKgAwIBAgIJAPaidX4i76aJMAoGCCqGSM49BAMEMEgxCzAJBgNVBAYT
|
|
||||||
AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMR4wHAYDVQQDExVzdHJvbmdT
|
|
||||||
d2FuIEVDIFJvb3QgQ0EwHhcNMTMwNjEzMDAwMDAwWhcNMjMwNjEzMDAwMDAwWjBI
|
|
||||||
MQswCQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UE
|
|
||||||
AxMVc3Ryb25nU3dhbiBFQyBSb290IENBMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
|
|
||||||
AAQBFMdTb4zSs2wx2kTzLKiH/+km1KcwWu/Df1iMheq2I/HuTHAKn0381HxSWWKE
|
|
||||||
J/5mz91X4zsUbjA465X73YDMcJMBQ4oFkHx4NwiW0u3kI4ztTK8cSCVLX0k5xdvb
|
|
||||||
TIeiGDHcWmSpaAhgjq6ZhghncQ9vysKF9UgNwZZ42jbe5Ek6J5KjQjBAMA8GA1Ud
|
|
||||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS6XflxthO1atHd
|
|
||||||
uja3qtLB7o/Y0jAKBggqhkjOPQQDBAOBjAAwgYgCQgGC5TVO0Yy05OIO9GwQ1X7E
|
|
||||||
J08tyxmzQnCPfXKEEUOD+DDnSCcK0aCrGAIZCTmLR7euOCZ8gkPurJbML5RAjJjd
|
|
||||||
YQJCAL9qmPe6hWCEEOiOgCsy50nr5Qwo+FfS05ZItrUGVUQZES9BtmpkhjZlAOrA
|
|
||||||
ihgk0RArH39otlUFPSbSE9bicCDy
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIDDDCCAm2gAwIBAgIBDzAKBggqhkjOPQQDAjBIMQswCQYDVQQGEwJDSDEZMBcG
|
|
||||||
A1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25nU3dhbiBFQyBS
|
|
||||||
b290IENBMB4XDTE4MDYxMzEyMTAzMVoXDTIzMDYxMTEyMTAzMVowXjELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xFjAUBgNVBAsTDUVDRFNB
|
|
||||||
IDM4NCBiaXQxHDAaBgNVBAMME2RhdmVAc3Ryb25nc3dhbi5vcmcwdjAQBgcqhkjO
|
|
||||||
PQIBBgUrgQQAIgNiAAQiPVu1BMrRbeXe2c7zSzBl1UeJfNeM0ocoAfYUe/8KzxU5
|
|
||||||
7Gapbm2Gztkm/2V4Zb7PvK3LOKIrUnxNdE0nVvsdIZKSi/BZEm3BQu8lofvwQQxQ
|
|
||||||
rWnu3qzwqEfwb0iB2WyjggETMIIBDzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAd
|
|
||||||
BgNVHQ4EFgQUDCdvv80iOq2pGsjrnNiQFP2RjnsweAYDVR0jBHEwb4AUul35cbYT
|
|
||||||
tWrR3bo2t6rSwe6P2NKhTKRKMEgxCzAJBgNVBAYTAkNIMRkwFwYDVQQKExBMaW51
|
|
||||||
eCBzdHJvbmdTd2FuMR4wHAYDVQQDExVzdHJvbmdTd2FuIEVDIFJvb3QgQ0GCCQD2
|
|
||||||
onV+Iu+miTAeBgNVHREEFzAVgRNkYXZlQHN0cm9uZ3N3YW4ub3JnMDwGA1UdHwQ1
|
|
||||||
MDMwMaAvoC2GK2h0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dhbl9l
|
|
||||||
Yy5jcmwwCgYIKoZIzj0EAwIDgYwAMIGIAkIBMxGGwujqlwf+JFNXW/sbxZmynwzq
|
|
||||||
duPikzCw0wIq+YhFYJVi2YWDz0Ikfn4WUvoiUIC/uSBAJAw/3E3SHO5I4Y8CQgF2
|
|
||||||
d6Ct2ocQwMcz5O00i3BsuOjiHvL3VB3GGG8rfIXAqwUAy4jXQo0bMh2yD+5WwKmP
|
|
||||||
GnRyvRuhwRkbBIGt6l1mbA==
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
-----BEGIN EC PRIVATE KEY-----
|
|
||||||
MIGkAgEBBDBz89+bQmsMHvfaCsI0N1bInZ+oxA9JZHZrAAkHGHaWFUQZFXBMB88n
|
|
||||||
2+6S2JvUbcygBwYFK4EEACKhZANiAAQiPVu1BMrRbeXe2c7zSzBl1UeJfNeM0oco
|
|
||||||
AfYUe/8KzxU57Gapbm2Gztkm/2V4Zb7PvK3LOKIrUnxNdE0nVvsdIZKSi/BZEm3B
|
|
||||||
Qu8lofvwQQxQrWnu3qzwqEfwb0iB2Ww=
|
|
||||||
-----END EC PRIVATE KEY-----
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
|
||||||
|
|
||||||
: ECDSA daveKey.pem
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
-P INPUT ACCEPT
|
|
||||||
-P OUTPUT ACCEPT
|
|
||||||
-P FORWARD ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*nat
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*mangle
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
# default policy is DROP
|
|
||||||
-P INPUT DROP
|
|
||||||
-P OUTPUT DROP
|
|
||||||
-P FORWARD DROP
|
|
||||||
|
|
||||||
# allow esp
|
|
||||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
||||||
|
|
||||||
# allow IKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow MobIKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow ssh
|
|
||||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
||||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
||||||
|
|
||||||
# allow crl fetch from winnetou
|
|
||||||
-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
|
|
||||||
|
|
||||||
# allow traffic tunnelled via IPsec
|
|
||||||
-A INPUT -i eth0 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon {
|
|
||||||
load = test-vectors pem pkcs1 pkcs8 random nonce x509 revocation openssl soup stroke kernel-netlink socket-default
|
|
||||||
|
|
||||||
initiator_only = yes
|
|
||||||
integrity_test = yes
|
|
||||||
|
|
||||||
crypto_test {
|
|
||||||
required = yes
|
|
||||||
on_add = yes
|
|
||||||
}
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
openssl {
|
|
||||||
fips_mode = 2
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
|
||||||
|
|
||||||
config setup
|
|
||||||
|
|
||||||
conn %default
|
|
||||||
ikelifetime=60m
|
|
||||||
keylife=20m
|
|
||||||
rekey=no
|
|
||||||
reauth=no
|
|
||||||
keyexchange=ikev2
|
|
||||||
ike=aes256gcm128-prfsha384-ecp384!
|
|
||||||
esp=aes256gcm128-ecp384!
|
|
||||||
|
|
||||||
conn rw
|
|
||||||
left=PH_IP_MOON
|
|
||||||
leftcert=moonCert.pem
|
|
||||||
[email protected]
|
|
||||||
leftsubnet=10.1.0.0/16
|
|
||||||
leftfirewall=yes
|
|
||||||
right=%any
|
|
||||||
auto=add
|
|
||||||
-15
@@ -1,15 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIICUTCCAbKgAwIBAgIJAPaidX4i76aJMAoGCCqGSM49BAMEMEgxCzAJBgNVBAYT
|
|
||||||
AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMR4wHAYDVQQDExVzdHJvbmdT
|
|
||||||
d2FuIEVDIFJvb3QgQ0EwHhcNMTMwNjEzMDAwMDAwWhcNMjMwNjEzMDAwMDAwWjBI
|
|
||||||
MQswCQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UE
|
|
||||||
AxMVc3Ryb25nU3dhbiBFQyBSb290IENBMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
|
|
||||||
AAQBFMdTb4zSs2wx2kTzLKiH/+km1KcwWu/Df1iMheq2I/HuTHAKn0381HxSWWKE
|
|
||||||
J/5mz91X4zsUbjA465X73YDMcJMBQ4oFkHx4NwiW0u3kI4ztTK8cSCVLX0k5xdvb
|
|
||||||
TIeiGDHcWmSpaAhgjq6ZhghncQ9vysKF9UgNwZZ42jbe5Ek6J5KjQjBAMA8GA1Ud
|
|
||||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS6XflxthO1atHd
|
|
||||||
uja3qtLB7o/Y0jAKBggqhkjOPQQDBAOBjAAwgYgCQgGC5TVO0Yy05OIO9GwQ1X7E
|
|
||||||
J08tyxmzQnCPfXKEEUOD+DDnSCcK0aCrGAIZCTmLR7euOCZ8gkPurJbML5RAjJjd
|
|
||||||
YQJCAL9qmPe6hWCEEOiOgCsy50nr5Qwo+FfS05ZItrUGVUQZES9BtmpkhjZlAOrA
|
|
||||||
ihgk0RArH39otlUFPSbSE9bicCDy
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIDCzCCAm2gAwIBAgIBFDAKBggqhkjOPQQDAjBIMQswCQYDVQQGEwJDSDEZMBcG
|
|
||||||
A1UEChMQTGludXggc3Ryb25nU3dhbjEeMBwGA1UEAxMVc3Ryb25nU3dhbiBFQyBS
|
|
||||||
b290IENBMB4XDTE4MDYxMzE0MzE1MVoXDTIzMDYxMTE0MzE1MVowXjELMAkGA1UE
|
|
||||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xFjAUBgNVBAsTDUVDRFNB
|
|
||||||
IDM4NCBiaXQxHDAaBgNVBAMTE21vb24uc3Ryb25nc3dhbi5vcmcwdjAQBgcqhkjO
|
|
||||||
PQIBBgUrgQQAIgNiAAQBXgnLJrtT2zS6BEj4WBRskabmIw8TVo3Q4+MyOBab2jzM
|
|
||||||
AVE44VFjo/ihd1YCeTs8KyZY+w8XPnCqm+z+Z9NeU2tN5wLlVYSBwyYzL9+Nhnam
|
|
||||||
F6qMSaPBnIE2CK2hgqGjggETMIIBDzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAd
|
|
||||||
BgNVHQ4EFgQUT4FEmRbCvjxKsXqruiQgzC50pj0weAYDVR0jBHEwb4AUul35cbYT
|
|
||||||
tWrR3bo2t6rSwe6P2NKhTKRKMEgxCzAJBgNVBAYTAkNIMRkwFwYDVQQKExBMaW51
|
|
||||||
eCBzdHJvbmdTd2FuMR4wHAYDVQQDExVzdHJvbmdTd2FuIEVDIFJvb3QgQ0GCCQD2
|
|
||||||
onV+Iu+miTAeBgNVHREEFzAVghNtb29uLnN0cm9uZ3N3YW4ub3JnMDwGA1UdHwQ1
|
|
||||||
MDMwMaAvoC2GK2h0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dhbl9l
|
|
||||||
Yy5jcmwwCgYIKoZIzj0EAwIDgYsAMIGHAkIAhHCvrcHfCJbPcNDdyT4x3F3V2wq7
|
|
||||||
96TzcVzlLJ+zSxr3Xo3eqOZaxAlnnoI4aQIukZ0RXzSCebDrOL9+k+5uRakCQU9k
|
|
||||||
W5MphqYKOys+lQmpKBEnzZlM1QvFfUUiXwoxN8Ilc9c0nSVXKl9m/uPgP7GZjvaE
|
|
||||||
J4juvRKmi2nMoxWIJtMt
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
-----BEGIN EC PRIVATE KEY-----
|
|
||||||
MIGkAgEBBDDuG7KDU5nek/TFvZQIxg89wevYYa1/EDyQHLFanmbK1DTx07Wv9D/b
|
|
||||||
BL5sHWEPNMGgBwYFK4EEACKhZANiAAQBXgnLJrtT2zS6BEj4WBRskabmIw8TVo3Q
|
|
||||||
4+MyOBab2jzMAVE44VFjo/ihd1YCeTs8KyZY+w8XPnCqm+z+Z9NeU2tN5wLlVYSB
|
|
||||||
wyYzL9+NhnamF6qMSaPBnIE2CK2hgqE=
|
|
||||||
-----END EC PRIVATE KEY-----
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
|
||||||
|
|
||||||
: ECDSA moonKey.pem
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
-P INPUT ACCEPT
|
|
||||||
-P OUTPUT ACCEPT
|
|
||||||
-P FORWARD ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*nat
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
|
|
||||||
*mangle
|
|
||||||
|
|
||||||
-F
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
# default policy is DROP
|
|
||||||
-P INPUT DROP
|
|
||||||
-P OUTPUT DROP
|
|
||||||
-P FORWARD DROP
|
|
||||||
|
|
||||||
# allow esp
|
|
||||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
||||||
|
|
||||||
# allow IKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow MobIKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow ssh
|
|
||||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
||||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
||||||
|
|
||||||
# allow crl fetch from winnetou
|
|
||||||
-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
|
|
||||||
|
|
||||||
# allow traffic tunnelled via IPsec
|
|
||||||
-A FORWARD -i eth0 -o eth1 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
|
||||||
-A FORWARD -o eth0 -i eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon {
|
|
||||||
load = test-vectors pem pkcs1 pkcs8 random nonce x509 revocation openssl soup stroke kernel-netlink socket-default
|
|
||||||
|
|
||||||
integrity_test = yes
|
|
||||||
|
|
||||||
crypto_test {
|
|
||||||
required = yes
|
|
||||||
on_add = yes
|
|
||||||
}
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
openssl {
|
|
||||||
fips_mode = 2
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
moon::ipsec stop
|
|
||||||
carol::ipsec stop
|
|
||||||
dave::ipsec stop
|
|
||||||
moon::iptables-restore < /etc/iptables.flush
|
|
||||||
carol::iptables-restore < /etc/iptables.flush
|
|
||||||
dave::iptables-restore < /etc/iptables.flush
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
moon::iptables-restore < /etc/iptables.rules
|
|
||||||
carol::iptables-restore < /etc/iptables.rules
|
|
||||||
dave::iptables-restore < /etc/iptables.rules
|
|
||||||
moon::ipsec start
|
|
||||||
carol::ipsec start
|
|
||||||
dave::ipsec start
|
|
||||||
moon::expect-connection rw
|
|
||||||
dave::expect-connection peer
|
|
||||||
dave::ipsec up peer
|
|
||||||
carol::expect-connection home
|
|
||||||
carol::ipsec up home
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# This configuration file provides information on the
|
|
||||||
# guest instances used for this test
|
|
||||||
|
|
||||||
# All guest instances that are required for this test
|
|
||||||
#
|
|
||||||
VIRTHOSTS="alice moon carol winnetou dave"
|
|
||||||
|
|
||||||
# Corresponding block diagram
|
|
||||||
#
|
|
||||||
DIAGRAM="a-m-c-w-d.png"
|
|
||||||
|
|
||||||
# Guest instances on which tcpdump is to be started
|
|
||||||
#
|
|
||||||
TCPDUMPHOSTS="moon"
|
|
||||||
|
|
||||||
# Guest instances on which IPsec is started
|
|
||||||
# Used for IPsec logging purposes
|
|
||||||
#
|
|
||||||
IPSECHOSTS="moon carol dave"
|
|
||||||
Reference in New Issue
Block a user