ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity

testing: Converted ipv6/host2host-ikev1 to swanctl

This commit is contained in:
Andreas Steffen 2017-10-17 11:44:17 +02:00
parent 0a6f8644ef
commit 087b027f88
11 changed files with 113 additions and 88 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
testing/tests/ipv6/host2host-ikev1/description.txt
View File

@ -1,5 +1,6 @@
An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up.
The authentication is based on X.509 certificates. Upon the successful establishment of
the IPsec tunnel, <b>leftfirewall=yes</b> automatically inserts ip6tables-based firewall
rules that let pass the tunneled traffic. In order to test both the host-to-host tunnel
and the firewall rules, <b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command.
An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully
set up. The authentication is based on X.509 certificates. Upon the successful
establishment of the IPsec tunnel, automatically inserted ip6tables-based firewall
rules that pass the tunneled traffic. In order to test both the host-to-host tunnel
and the firewall rules, <b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using
the ping6 command.

6
testing/tests/ipv6/host2host-ikev1/evaltest.dat
View File

@ -1,7 +1,5 @@
moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES
moon::swanctl --list-sas --raw 2> /dev/null::host-host.*version=1 state=ESTABLISHED local-host=fec0:\:1 local-port=500 local-id=moon.strongswan.org remote-host=fec0:\:2 remote-port=500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*host-host.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 dh-group=CURVE_25519.*local-ts=\[fec0:\:1/128] remote-ts=\[fec0:\:2/128]::YES
sun ::swanctl --list-sas --raw 2> /dev/null::host-host.*version=1 state=ESTABLISHED local-host=fec0:\:2 local-port=500 local-id=sun.strongswan.org remote-host=fec0:\:1 remote-port=500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*host-host.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 dh-group=CURVE_25519.*local-ts=\[fec0:\:2/128] remote-ts=\[fec0:\:1/128]::YES
sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES

32
testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf
View File

@ -1,32 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
ca strongswan
cacert=strongswanCert.pem
certuribase=http://ip6-winnetou.strongswan.org/certs/
crluri=http://ip6-winnetou.strongswan.org/strongswan.crl
auto=add
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
fragmentation=yes
conn net-net
also=host-host
leftsubnet=fec1::0/16
rightsubnet=fec2::0/16
conn host-host
left=PH_IP6_MOON
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftfirewall=yes
right=PH_IP6_SUN
rightid=@sun.strongswan.org
auto=add

20
testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/strongswan.conf
View File

@ -1,8 +1,18 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
hash_and_url = yes
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
fragment_size = 1024
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
syslog {
daemon {
default = 1
}
auth {
default = 0
}
}
}

32
testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,32 @@
connections {
host-host {
local_addrs = fec0::1
remote_addrs = fec0::2
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
host-host {
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128-sha256-x25519
}
}
version = 1
proposals = aes128-sha256-x25519
}
}
authorities {
strongswan {
cacert = strongswanCert.pem
crl_uris = http://ip6-winnetou.strongswan.org/strongswan.crl
}
}

31
testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/ipsec.conf
View File

@ -1,31 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
ca strongswan
cacert=strongswanCert.pem
certuribase=http://ip6-winnetou.strongswan.org/certs/
crluri=http://ip6-winnetou.strongswan.org/strongswan.crl
auto=add
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
fragmentation=yes
conn net-net
also=host-host
leftsubnet=fec2::0/16
rightsubnet=fec1::0/16
conn host-host
left=PH_IP6_SUN
leftcert=sunCert.pem
leftid=@sun.strongswan.org
leftfirewall=yes
right=PH_IP6_MOON
rightid=@moon.strongswan.org
auto=add

20
testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/strongswan.conf
View File

@ -1,8 +1,18 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
hash_and_url = yes
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
fragment_size = 1024
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
syslog {
daemon {
default = 1
}
auth {
default = 0
}
}
}

32
testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,32 @@
connections {
host-host {
local_addrs = fec0::2
remote_addrs = fec0::1
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
host-host {
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128-sha256-x25519
}
}
version = 1
proposals = aes128-sha256-x25519
}
}
authorities {
strongswan {
cacert = strongswanCert.pem
crl_uris = http://ip6-winnetou.strongswan.org/strongswan.crl
}
}

4
testing/tests/ipv6/host2host-ikev1/posttest.dat
View File

@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
moon::systemctl stop strongswan-swanctl
sun::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
moon::ip6tables-restore < /etc/ip6tables.flush

9
testing/tests/ipv6/host2host-ikev1/pretest.dat
View File

@ -2,8 +2,9 @@ moon::iptables-restore < /etc/iptables.drop
sun::iptables-restore < /etc/iptables.drop
moon::ip6tables-restore < /etc/ip6tables.rules
sun::ip6tables-restore < /etc/ip6tables.rules
moon::ipsec start
sun::ipsec start
moon::expect-connection host-host
moon::systemctl start strongswan-swanctl
sun::systemctl start strongswan-swanctl
sun::expect-connection host-host
moon::ipsec up host-host
moon::expect-connection host-host
moon::swanctl --initiate --child host-host 2> /dev/null
moon::sleep 1

4
testing/tests/ipv6/host2host-ikev1/test.conf
View File

@ -23,3 +23,7 @@ IPSECHOSTS="moon sun"
# IP protocol used by IPsec is IPv6
#
IPV6=1
# charon controlled by swanctl
#
SWANCTL=1