ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity

testing: Migrate MOBIKE tests to vici 

Note that the mobike-nat test has been removed as it basically did the same
as the mobike-virtual-ip-nat test.  Instead, the mobike-nat-mapping scenario
is added, which simulates a NAT router restart.
This commit is contained in:
Tobias Brunner 2021-06-10 16:41:01 +02:00 committed by Andreas Steffen
parent abe51389c5
commit 2b5c743952
65 changed files with 404 additions and 332 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
testing/tests/ikev2-stroke-bye/mobike-nat/description.txt
View File

@ -1,7 +0,0 @@
The roadwarrior <b>alice</b> is sitting behind the NAT router <b>moon</b> but
at the outset of the scenario is also directly connected to the 192.168.0.0/24 network
via an additional <b>eth1</b> interface. <b>alice</b> builds up a tunnel to gateway <b>sun</b>
in order to reach <b>bob</b> in the subnet behind. When the <b>eth1</b> interface
goes away, <b>alice</b> switches to <b>eth0</b> and signals the IP address change
via a MOBIKE ADDRESS_UPDATE notification to peer <b>sun</b>. <b>alice</b> sets
a virtual IP of 10.3.0.3, so that the IPsec policies don't have to be changed.

18
testing/tests/ikev2-stroke-bye/mobike-nat/evaltest.dat
View File

@ -1,18 +0,0 @@
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_MOON::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::moon.strongswan.org.*sun.strongswan.org.*: UDP-encap: ESP.*seq=0x2::YES
moon::tcpdump::sun.strongswan.org.*moon.strongswan.org.*: UDP-encap: ESP.*seq=0x2::YES
bob::tcpdump::10.3.0.3.*bob.strongswan.org.*ICMP echo request::YES
bob::tcpdump::bob.strongswan.org.*10.3.0.3.*ICMP echo reply::YES

20
testing/tests/ikev2-stroke-bye/mobike-nat/hosts/alice/etc/ipsec.conf
View File

@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn mobike
left=192.168.0.50
leftsourceip=%config
leftcert=aliceCert.pem
leftid=alice@strongswan.org
right=PH_IP_SUN
rightid=@sun.strongswan.org
rightsubnet=10.2.0.0/16
auto=add

5
testing/tests/ikev2-stroke-bye/mobike-nat/hosts/alice/etc/strongswan.conf
View File

@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
}

20
testing/tests/ikev2-stroke-bye/mobike-nat/hosts/sun/etc/ipsec.conf
View File

@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn mobike
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=@sun.strongswan.org
leftsubnet=10.2.0.0/16
right=%any
rightsourceip=10.3.0.3
rightid=alice@strongswan.org
auto=add

5
testing/tests/ikev2-stroke-bye/mobike-nat/hosts/sun/etc/strongswan.conf
View File

@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
}

31
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/evaltest.dat
View File

@ -1,31 +0,0 @@
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES
alice::ipsec status 2> /dev/null::mobike.*INSTALLED.*ESP SPIs::YES
sun:: ipsec status 2> /dev/null::mobike.*INSTALLED.*ESP SPIs::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_MOON::YES
alice::ipsec status 2> /dev/null::mobike.*INSTALLED.*ESP in UDP SPIs::YES
sun:: ipsec status 2> /dev/null::mobike.*INSTALLED.*ESP in UDP SPIs::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifup eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES
alice::ipsec status 2> /dev/null::mobike.*INSTALLED.*ESP SPIs::YES
sun:: ipsec status 2> /dev/null::mobike.*INSTALLED.*ESP SPIs::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::moon.strongswan.org.*sun.strongswan.org.*: ESP.*seq=0x2::YES
moon::tcpdump::sun.strongswan.org.*moon.strongswan.org.*: ESP.*seq=0x2::YES
bob::tcpdump::10.3.0.3.*bob.strongswan.org.*ICMP echo request::3
bob::tcpdump::bob.strongswan.org.*10.3.0.3.*ICMP echo reply::3

19
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/hosts/alice/etc/ipsec.conf
View File

@ -1,19 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn mobike
leftsourceip=%config
leftcert=aliceCert.pem
leftid=alice@strongswan.org
right=PH_IP_SUN
rightid=@sun.strongswan.org
rightsubnet=10.2.0.0/16
auto=add

12
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/hosts/alice/etc/strongswan.conf
View File

@ -1,12 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
prefer_best_path = yes
syslog {
daemon {
knl = 2
}
}
}

20
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/hosts/sun/etc/ipsec.conf
View File

@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn mobike
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=@sun.strongswan.org
leftsubnet=10.2.0.0/16
right=%any
rightsourceip=10.3.0.3
rightid=alice@strongswan.org
auto=add

11
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/hosts/sun/etc/strongswan.conf
View File

@ -1,11 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
syslog {
daemon {
knl = 2
}
}
}

18
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/evaltest.dat
View File

@ -1,18 +0,0 @@
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::alice.strongswan.org.*sun.strongswan.org.*: ESP.*seq=0x2::YES
moon::tcpdump::sun.strongswan.org.*alice.strongswan.org.*: ESP.*seq=0x2::YES
bob::tcpdump::10.3.0.3.*bob.strongswan.org.*ICMP echo request::YES
bob::tcpdump::bob.strongswan.org.*10.3.0.3.*ICMP echo reply::YES

20
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/hosts/alice/etc/ipsec.conf
View File

@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn mobike
left=192.168.0.50
leftsourceip=%config
leftcert=aliceCert.pem
leftid=alice@strongswan.org
right=PH_IP_SUN
rightid=@sun.strongswan.org
rightsubnet=10.2.0.0/16
auto=add

5
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/hosts/alice/etc/strongswan.conf
View File

@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
}

20
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/hosts/sun/etc/ipsec.conf
View File

@ -1,20 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn mobike
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=@sun.strongswan.org
leftsubnet=10.2.0.0/16
right=192.168.0.50
rightsourceip=10.3.0.3
rightid=alice@strongswan.org
auto=add

5
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/hosts/sun/etc/strongswan.conf
View File

@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
}

20
testing/tests/ikev2-stroke-bye/mobike/evaltest.dat
View File

@ -1,20 +0,0 @@
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES
alice::ipsec statusall 2> /dev/null::192.168.0.50/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 192.168.0.50/32::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE::YES
alice::ipsec statusall 2> /dev/null::PH_IP_ALICE/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === PH_IP_ALICE/32::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::alice.strongswan.org.*sun.strongswan.org: ESP.*seq=0x2::YES
moon::tcpdump::sun.strongswan.org.*alice.strongswan.org: ESP.*seq=0x2::YES
bob::tcpdump::alice1.strongswan.org.*bob.strongswan.org.*ICMP echo request::YES
bob::tcpdump::bob.strongswan.org.*alice1.strongswan.org.*ICMP echo reply::YES
bob::tcpdump::alice.strongswan.org.*bob.strongswan.org.*ICMP echo request::YES
bob::tcpdump::bob.strongswan.org.*alice.strongswan.org.*ICMP echo reply::YES

19
testing/tests/ikev2-stroke-bye/mobike/hosts/alice/etc/ipsec.conf
View File

@ -1,19 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn mobike
left=192.168.0.50
leftcert=aliceCert.pem
leftid=alice@strongswan.org
right=PH_IP_SUN
rightid=@sun.strongswan.org
rightsubnet=10.2.0.0/16
auto=add

5
testing/tests/ikev2-stroke-bye/mobike/hosts/alice/etc/strongswan.conf
View File

@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
}

19
testing/tests/ikev2-stroke-bye/mobike/hosts/sun/etc/ipsec.conf
View File

@ -1,19 +0,0 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn mobike
left=PH_IP_SUN
leftcert=sunCert.pem
leftid=@sun.strongswan.org
leftsubnet=10.2.0.0/16
right=192.168.0.50
rightid=alice@strongswan.org
auto=add

5
testing/tests/ikev2-stroke-bye/mobike/hosts/sun/etc/strongswan.conf
View File

@ -1,5 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default
}

6
testing/tests/ikev2/mobike-nat-mappings/description.txt Normal file
View File

@ -0,0 +1,6 @@
The roadwarrior <b>alice</b> is sitting behind the NAT router <b>moon</b>.
<b>alice</b> builds up a tunnel to gateway <b>sun</b> in order to reach <b>bob</b>
in the subnet behind. When the NAT router <b>moon</b> is restarted, the NAT
mappings change. <b>alice</b> notices this when sending a DPD and signals the
change via a MOBIKE ADDRESS_UPDATE notification to peer <b>sun</b>. <b>alice</b> sets
a virtual IP of 10.3.0.3, so that the IPsec policies don't have to be changed.

27
testing/tests/ikev2/mobike-nat-mappings/evaltest.dat Normal file
View File

@ -0,0 +1,27 @@
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_ALICE local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*protocol=ESP encap=yes spi-in.*local-ts=\[10.3.0.3/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=PH_IP_MOON remote-port=1... remote-id=alice@strongswan.org.*protocol=ESP encap=yes spi-in.*local-ts=\[10.2.0.0/16] remote-ts=\[10.3.0.3/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
bob:: ping -c 1 10.3.0.3::64 bytes from 10.3.0.3: icmp_.eq=1::YES
# wait until one DPD has been exchanged, as we can't detect changed NAT mappings
# with the NAT-D payloads from IKE_SA_INIT as we changed the ports with IKE_AUTH
alice::sleep 6::No output expected::NO
# simulate a restart of the NAT router, bob won't be able to ping
moon::iptables -t nat -F
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:5000-5100
moon::conntrack -F
bob::ping -c 1 -W 1 10.3.0.3::64 bytes from 10.3.0.3: icmp_.eq=1::NO
# wait until the next DPD detects the changed NAT mapping and updates the endpoints
alice::sleep 6::No output expected::NO
alice::cat /var/log/daemon.log::sending DPD request::YES
alice::cat /var/log/daemon.log::detected changes in NAT mappings, initiating MOBIKE update::YES
sun:: cat /var/log/daemon.log::remote endpoint changed from PH_IP_MOON\[1...] to PH_IP_MOON\[5...]::YES
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_ALICE local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*protocol=ESP encap=yes spi-in.*local-ts=\[10.3.0.3/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=PH_IP_MOON remote-port=5... remote-id=alice@strongswan.org.*protocol=ESP encap=yes spi-in.*local-ts=\[10.2.0.0/16] remote-ts=\[10.3.0.3/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
bob:: ping -c 1 10.3.0.3::64 bytes from 10.3.0.3: icmp_.eq=1::YES
moon::tcpdump::moon.strongswan.org.*sun.strongswan.org.*: UDP-encap: ESP.*::4
moon::tcpdump::sun.strongswan.org.*moon.strongswan.org.*: UDP-encap: ESP.*::5
bob::tcpdump::10.3.0.3.*bob.strongswan.org.*ICMP echo request::2
bob::tcpdump::bob.strongswan.org.*10.3.0.3.*ICMP echo reply::2
bob::tcpdump::bob.strongswan.org.*10.3.0.3.*ICMP echo request::3
bob::tcpdump::10.3.0.3.*bob.strongswan.org.*ICMP echo reply::2

6
testing/tests/ikev2-stroke-bye/mobike/hosts/alice/etc/iptables.rules → testing/tests/ikev2/mobike-nat-mappings/hosts/alice/etc/iptables.rules
View File

@ -15,21 +15,15 @@
# allow ESP
-A INPUT -i eth0 -p 50 -j ACCEPT
-A INPUT -i eth1 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT
-A OUTPUT -o eth1 -p 50 -j ACCEPT
# allow IKE
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT

9
testing/tests/ikev2/mobike-nat-mappings/hosts/alice/etc/strongswan.conf Normal file
View File

@ -0,0 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey curve25519 gmp curl kernel-netlink socket-default resolve updown vici
}

25
testing/tests/ikev2/mobike-nat-mappings/hosts/alice/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,25 @@
connections {
mobike {
remote_addrs = PH_IP_SUN
vips = 0.0.0.0
dpd_delay = 5
local {
auth = pubkey
certs = aliceCert.pem
id = alice@strongswan.org
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
mobike {
remote_ts = 10.2.0.0/16
}
}
}
}

0
testing/tests/ikev2-stroke-bye/mobike-nat/hosts/sun/etc/iptables.rules → testing/tests/ikev2/mobike-nat-mappings/hosts/sun/etc/iptables.rules
View File

9
testing/tests/ikev2/mobike-nat-mappings/hosts/sun/etc/strongswan.conf Normal file
View File

@ -0,0 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey curve25519 gmp curl kernel-netlink socket-default resolve updown vici
}

29
testing/tests/ikev2/mobike-nat-mappings/hosts/sun/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,29 @@
connections {
mobike {
local_addrs = PH_IP_SUN
pools = mobike
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = alice@strongswan.org
}
children {
mobike {
local_ts = 10.2.0.0/16
}
}
}
}
pools {
mobike {
addrs = 10.3.0.3/32
}
}

4
testing/tests/ikev2-stroke-bye/mobike-nat/posttest.dat → testing/tests/ikev2/mobike-nat-mappings/posttest.dat
View File

@ -1,5 +1,5 @@
alice::ipsec stop
sun::ipsec stop
alice::systemctl stop strongswan
sun::systemctl stop strongswan
alice::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F

7
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/pretest.dat → testing/tests/ikev2/mobike-nat-mappings/pretest.dat
View File

@ -1,10 +1,9 @@
alice::ifup eth1
alice::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
alice::ipsec start
sun::ipsec start
alice::systemctl start strongswan
sun::systemctl start strongswan
alice::expect-connection mobike
sun::expect-connection mobike
alice::ipsec up mobike
alice::swanctl --initiate --child mobike 2> /dev/null

3
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/test.conf → testing/tests/ikev2/mobike-nat-mappings/test.conf
View File

@ -19,3 +19,6 @@ TCPDUMPHOSTS="bob moon sun"
# Used for IPsec logging purposes
#
IPSECHOSTS="alice sun"
# charon controlled by swanctl
SWANCTL=1

2
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/description.txt → testing/tests/ikev2/mobike-virtual-ip-nat/description.txt
View File

@ -4,6 +4,6 @@ via an additional <b>eth1</b> interface. <b>alice</b> builds up a tunnel to gate
in order to reach <b>bob</b> in the subnet behind. When the <b>eth1</b> interface
goes away, <b>alice</b> switches to <b>eth0</b> and signals the IP address change
via a MOBIKE ADDRESS_UPDATE notification to peer <b>sun</b>. Later the interface
comes back up again and because the best path is preferred (charon.prefer_best_path)
comes back up again and because the best path is preferred (charon-systemd.prefer_best_path)
there is another switch to the directly connected path. <b>alice</b> sets
a virtual IP of 10.3.0.3, so that the IPsec policies don't have to be changed.

19
testing/tests/ikev2/mobike-virtual-ip-nat/evaltest.dat Normal file
View File

@ -0,0 +1,19 @@
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=192.168.0.50 local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*protocol=ESP spi-in.*local-ts=\[10.3.0.3/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.50 remote-port=4500 remote-id=alice@strongswan.org.*protocol=ESP spi-in.*local-ts=\[10.2.0.0/16] remote-ts=\[10.3.0.3/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_ALICE local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*protocol=ESP encap=yes spi-in.*local-ts=\[10.3.0.3/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=PH_IP_MOON remote-port=1... remote-id=alice@strongswan.org.*protocol=ESP encap=yes spi-in.*local-ts=\[10.2.0.0/16] remote-ts=\[10.3.0.3/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifup eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=192.168.0.50 local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*protocol=ESP spi-in.*local-ts=\[10.3.0.3/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.50 remote-port=4500 remote-id=alice@strongswan.org.*protocol=ESP spi-in.*local-ts=\[10.2.0.0/16] remote-ts=\[10.3.0.3/32]::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::moon.strongswan.org.*sun.strongswan.org.*: ESP.*seq=0x2::YES
moon::tcpdump::sun.strongswan.org.*moon.strongswan.org.*: ESP.*seq=0x2::YES
bob::tcpdump::10.3.0.3.*bob.strongswan.org.*ICMP echo request::3
bob::tcpdump::bob.strongswan.org.*10.3.0.3.*ICMP echo reply::3

0
testing/tests/ikev2-stroke-bye/mobike-nat/hosts/alice/etc/iptables.rules → testing/tests/ikev2/mobike-virtual-ip-nat/hosts/alice/etc/iptables.rules
View File

16
testing/tests/ikev2/mobike-virtual-ip-nat/hosts/alice/etc/strongswan.conf Normal file
View File

@ -0,0 +1,16 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey curve25519 gmp curl kernel-netlink socket-default resolve updown vici
prefer_best_path = yes
syslog {
daemon {
knl = 2
}
}
}

23
testing/tests/ikev2/mobike-virtual-ip-nat/hosts/alice/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,23 @@
connections {
mobike {
remote_addrs = PH_IP_SUN
vips = 0.0.0.0
local {
auth = pubkey
certs = aliceCert.pem
id = alice@strongswan.org
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
mobike {
remote_ts = 10.2.0.0/16
}
}
}
}

0
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/hosts/sun/etc/iptables.rules → testing/tests/ikev2/mobike-virtual-ip-nat/hosts/sun/etc/iptables.rules
View File

15
testing/tests/ikev2/mobike-virtual-ip-nat/hosts/sun/etc/strongswan.conf Normal file
View File

@ -0,0 +1,15 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey curve25519 gmp curl kernel-netlink socket-default resolve updown vici
syslog {
daemon {
knl = 2
}
}
}

29
testing/tests/ikev2/mobike-virtual-ip-nat/hosts/sun/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,29 @@
connections {
mobike {
local_addrs = PH_IP_SUN
pools = mobike
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = alice@strongswan.org
}
children {
mobike {
local_ts = 10.2.0.0/16
}
}
}
}
pools {
mobike {
addrs = 10.3.0.3/32
}
}

4
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/posttest.dat → testing/tests/ikev2/mobike-virtual-ip-nat/posttest.dat
View File

@ -1,5 +1,5 @@
alice::ipsec stop
sun::ipsec stop
alice::systemctl stop strongswan
sun::systemctl stop strongswan
alice::ifdown eth1
alice::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush

6
testing/tests/ikev2-stroke-bye/mobike-nat/pretest.dat → testing/tests/ikev2/mobike-virtual-ip-nat/pretest.dat
View File

@ -3,8 +3,8 @@ alice::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
alice::ipsec start
sun::ipsec start
alice::systemctl start strongswan
sun::systemctl start strongswan
alice::expect-connection mobike
sun::expect-connection mobike
alice::ipsec up mobike
alice::swanctl --initiate --child mobike 2> /dev/null

3
testing/tests/ikev2-stroke-bye/mobike-nat/test.conf → testing/tests/ikev2/mobike-virtual-ip-nat/test.conf
View File

@ -19,3 +19,6 @@ TCPDUMPHOSTS="bob moon sun"
# Used for IPsec logging purposes
#
IPSECHOSTS="alice sun"
# charon controlled by swanctl
SWANCTL=1

0
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/description.txt → testing/tests/ikev2/mobike-virtual-ip/description.txt
View File

14
testing/tests/ikev2/mobike-virtual-ip/evaltest.dat Normal file
View File

@ -0,0 +1,14 @@
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=192.168.0.50 local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*local-ts=\[10.3.0.3/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.50 remote-port=4500 remote-id=alice@strongswan.org.*local-ts=\[10.2.0.0/16] remote-ts=\[10.3.0.3/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_ALICE local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*local-ts=\[10.3.0.3/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=PH_IP_ALICE remote-port=4500 remote-id=alice@strongswan.org.*local-ts=\[10.2.0.0/16] remote-ts=\[10.3.0.3/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::alice.strongswan.org.*sun.strongswan.org.*: ESP.*seq=0x2::YES
moon::tcpdump::sun.strongswan.org.*alice.strongswan.org.*: ESP.*seq=0x2::YES
bob::tcpdump::10.3.0.3.*bob.strongswan.org.*ICMP echo request::2
bob::tcpdump::bob.strongswan.org.*10.3.0.3.*ICMP echo reply::2

0
testing/tests/ikev2-stroke-bye/mobike-virtual-ip-nat/hosts/alice/etc/iptables.rules → testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules
View File

9
testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/strongswan.conf Normal file
View File

@ -0,0 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey curve25519 gmp curl kernel-netlink socket-default resolve updown vici
}

24
testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,24 @@
connections {
mobike {
local_addrs = 192.168.0.50
remote_addrs = PH_IP_SUN
vips = 0.0.0.0
local {
auth = pubkey
certs = aliceCert.pem
id = alice@strongswan.org
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
mobike {
remote_ts = 10.2.0.0/16
}
}
}
}

0
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/hosts/sun/etc/iptables.rules → testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules
View File

9
testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/strongswan.conf Normal file
View File

@ -0,0 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey curve25519 gmp curl kernel-netlink socket-default resolve updown vici
}

30
testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,30 @@
connections {
mobike {
local_addrs = PH_IP_SUN
remote_addrs = 192.168.0.50
pools = mobike
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = alice@strongswan.org
}
children {
mobike {
local_ts = 10.2.0.0/16
}
}
}
}
pools {
mobike {
addrs = 10.3.0.3/32
}
}

4
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/posttest.dat → testing/tests/ikev2/mobike-virtual-ip/posttest.dat
View File

@ -1,5 +1,5 @@
alice::ipsec stop
sun::ipsec stop
alice::systemctl stop strongswan
sun::systemctl stop strongswan
alice::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
sun::ip route del 10.1.0.0/16 via PH_IP_MOON

6
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/pretest.dat → testing/tests/ikev2/mobike-virtual-ip/pretest.dat
View File

@ -2,8 +2,8 @@ alice::ifup eth1
alice::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
sun::ip route add 10.1.0.0/16 via PH_IP_MOON
alice::ipsec start
sun::ipsec start
alice::systemctl start strongswan
sun::systemctl start strongswan
alice::expect-connection mobike
sun::expect-connection mobike
alice::ipsec up mobike
alice::swanctl --initiate --child mobike 2> /dev/null

3
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/test.conf → testing/tests/ikev2/mobike-virtual-ip/test.conf
View File

@ -19,3 +19,6 @@ TCPDUMPHOSTS="bob moon sun"
# Used for IPsec logging purposes
#
IPSECHOSTS="alice sun"
# charon controlled by swanctl
SWANCTL=1

0
testing/tests/ikev2-stroke-bye/mobike/description.txt → testing/tests/ikev2/mobike/description.txt
View File

16
testing/tests/ikev2/mobike/evaltest.dat Normal file
View File

@ -0,0 +1,16 @@
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=192.168.0.50 local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*local-ts=\[192.168.0.50/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.50 remote-port=4500 remote-id=alice@strongswan.org.*local-ts=\[10.2.0.0/16] remote-ts=\[192.168.0.50/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_ALICE local-port=4500 local-id=alice@strongswan.org remote-host=PH_IP_SUN remote-port=4500 remote-id=sun.strongswan.org.*local-ts=\[PH_IP_ALICE/32] remote-ts=\[10.2.0.0/16]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::mobike.*state=ESTABLISHED local-host=PH_IP_SUN local-port=4500 local-id=sun.strongswan.org remote-host=PH_IP_ALICE remote-port=4500 remote-id=alice@strongswan.org.*local-ts=\[10.2.0.0/16] remote-ts=\[PH_IP_ALICE/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::alice.strongswan.org.*sun.strongswan.org: ESP.*seq=0x2::YES
moon::tcpdump::sun.strongswan.org.*alice.strongswan.org: ESP.*seq=0x2::YES
bob::tcpdump::alice1.strongswan.org.*bob.strongswan.org.*ICMP echo request::YES
bob::tcpdump::bob.strongswan.org.*alice1.strongswan.org.*ICMP echo reply::YES
bob::tcpdump::alice.strongswan.org.*bob.strongswan.org.*ICMP echo request::YES
bob::tcpdump::bob.strongswan.org.*alice.strongswan.org.*ICMP echo reply::YES

0
testing/tests/ikev2-stroke-bye/mobike-virtual-ip/hosts/alice/etc/iptables.rules → testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules
View File

9
testing/tests/ikev2/mobike/hosts/alice/etc/strongswan.conf Normal file
View File

@ -0,0 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey curve25519 gmp curl kernel-netlink socket-default resolve updown vici
}

22
testing/tests/ikev2/mobike/hosts/alice/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,22 @@
connections {
mobike {
local_addrs = 192.168.0.50
remote_addrs = PH_IP_SUN
local {
auth = pubkey
certs = aliceCert.pem
id = alice@strongswan.org
}
remote {
auth = pubkey
id = sun.strongswan.org
}
children {
mobike {
remote_ts = 10.2.0.0/16
}
}
}
}

0
testing/tests/ikev2-stroke-bye/mobike/hosts/sun/etc/iptables.rules → testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules
View File

9
testing/tests/ikev2/mobike/hosts/sun/etc/strongswan.conf Normal file
View File

@ -0,0 +1,9 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon-systemd {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey curve25519 gmp curl kernel-netlink socket-default resolve updown vici
}

22
testing/tests/ikev2/mobike/hosts/sun/etc/swanctl/swanctl.conf Normal file
View File

@ -0,0 +1,22 @@
connections {
mobike {
local_addrs = PH_IP_SUN
remote_addrs = 192.168.0.50
local {
auth = pubkey
certs = sunCert.pem
id = sun.strongswan.org
}
remote {
auth = pubkey
id = alice@strongswan.org
}
children {
mobike {
local_ts = 10.2.0.0/16
}
}
}
}

4
testing/tests/ikev2-stroke-bye/mobike/posttest.dat → testing/tests/ikev2/mobike/posttest.dat
View File

@ -1,5 +1,5 @@
alice::ipsec stop
sun::ipsec stop
alice::systemctl stop strongswan
sun::systemctl stop strongswan
alice::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
sun::ip route del 10.1.0.0/16 via PH_IP_MOON

6
testing/tests/ikev2-stroke-bye/mobike/pretest.dat → testing/tests/ikev2/mobike/pretest.dat
View File

@ -2,8 +2,8 @@ alice::ifup eth1
alice::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
sun::ip route add 10.1.0.0/16 via PH_IP_MOON
alice::ipsec start
sun::ipsec start
alice::systemctl start strongswan
sun::systemctl start strongswan
alice::expect-connection mobike
sun::expect-connection mobike
alice::ipsec up mobike
alice::swanctl --initiate --child mobike 2> /dev/null

3
testing/tests/ikev2-stroke-bye/mobike/test.conf → testing/tests/ikev2/mobike/test.conf
View File

@ -19,3 +19,6 @@ TCPDUMPHOSTS="bob moon sun"
# Used for IPsec logging purposes
#
IPSECHOSTS="alice sun"
# charon controlled by swanctl
SWANCTL=1