testing: Add ipv6/rw-compress-ikev2 scenario
This commit is contained in:
parent
6055e347f8
commit
62e050e0ef
|
@ -0,0 +1,10 @@
|
||||||
|
This scenario enables IPComp compression between roadwarrior <b>carol</b> and
|
||||||
|
gateway <b>moon</b>. Two IPv6 ICMP requests from <b>carol</b> to <b>alice</b>
|
||||||
|
check the established tunnel with compression. The packet sizes are different
|
||||||
|
because the kernel does not compress small packets.<br/>
|
||||||
|
<b>Note:</b> The kernel applies IPComp after fragmenting the original packet
|
||||||
|
according to the MTU. Also, because <b>alice</b> does not know about the IPsec
|
||||||
|
tunnel between <b>moon</b> and <b>carol</b> the response to the first ICMP
|
||||||
|
request is fragmented in too large fragments and <b>moon</b> sends back ICMPs
|
||||||
|
with type 2 to notify <b>alice</b> about this (Path MTU Discovery).
|
||||||
|
The second ping is then answered successfully.
|
|
@ -0,0 +1,13 @@
|
||||||
|
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||||
|
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||||
|
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||||
|
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||||
|
moon:: cat /var/log/daemon.log::IKE_AUTH request.*N(IPCOMP_SUP)::YES
|
||||||
|
moon:: cat /var/log/daemon.log::IKE_AUTH response.*N(IPCOMP_SUP)::YES
|
||||||
|
moon:: ip xfrm state::proto comp spi::YES
|
||||||
|
carol::ip xfrm state::proto comp spi::YES
|
||||||
|
# send two pings because the first is lost due to Path MTU Discovery between alice and moon
|
||||||
|
carol::ping6 -c 2 -W 1 -s 8184 -p deadbeef ip6-alice.strongswan.org::8192 bytes from ip6-alice.strongswan.org::YES
|
||||||
|
carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org::YES
|
||||||
|
moon::tcpdump::IP6 ip6-carol.strongswan.org > ip6-moon.strongswan.org: ESP::YES
|
||||||
|
moon::tcpdump::IP6 ip6-moon.strongswan.org > ip6-carol.strongswan.org: ESP::YES
|
|
@ -0,0 +1,25 @@
|
||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
|
||||||
|
ca strongswan
|
||||||
|
cacert=strongswanCert.pem
|
||||||
|
crluri=http://ip6-winnetou.strongswan.org/strongswan.crl
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
keyexchange=ikev2
|
||||||
|
compress=yes
|
||||||
|
leftfirewall=yes
|
||||||
|
|
||||||
|
conn home
|
||||||
|
leftcert=carolCert.pem
|
||||||
|
leftid=carol@strongswan.org
|
||||||
|
right=PH_IP6_MOON
|
||||||
|
rightsubnet=fec1::/16
|
||||||
|
rightid=@moon.strongswan.org
|
||||||
|
auto=add
|
|
@ -0,0 +1,5 @@
|
||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon {
|
||||||
|
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||||
|
}
|
|
@ -0,0 +1,24 @@
|
||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
|
||||||
|
ca strongswan
|
||||||
|
cacert=strongswanCert.pem
|
||||||
|
crluri=http://ip6-winnetou.strongswan.org/strongswan.crl
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
keyexchange=ikev2
|
||||||
|
compress=yes
|
||||||
|
leftfirewall=yes
|
||||||
|
|
||||||
|
conn rw
|
||||||
|
leftcert=moonCert.pem
|
||||||
|
leftid=@moon.strongswan.org
|
||||||
|
leftsubnet=fec1::/16
|
||||||
|
right=%any
|
||||||
|
auto=add
|
|
@ -0,0 +1,5 @@
|
||||||
|
# /etc/strongswan.conf - strongSwan configuration file
|
||||||
|
|
||||||
|
charon {
|
||||||
|
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||||
|
}
|
|
@ -0,0 +1,8 @@
|
||||||
|
moon::ipsec stop
|
||||||
|
carol::ipsec stop
|
||||||
|
moon::iptables-restore < /etc/iptables.flush
|
||||||
|
carol::iptables-restore < /etc/iptables.flush
|
||||||
|
moon::ip6tables-restore < /etc/ip6tables.flush
|
||||||
|
carol::ip6tables-restore < /etc/ip6tables.flush
|
||||||
|
alice::"ip route del fec0:\:/16 via fec1:\:1"
|
||||||
|
carol::"ip route del fec1:\:/16 via fec0:\:1"
|
|
@ -0,0 +1,13 @@
|
||||||
|
moon::iptables-restore < /etc/iptables.drop
|
||||||
|
carol::iptables-restore < /etc/iptables.drop
|
||||||
|
moon::ip6tables-restore < /etc/ip6tables.rules
|
||||||
|
carol::ip6tables-restore < /etc/ip6tables.rules
|
||||||
|
# enable Path MTU Discovery
|
||||||
|
moon::ip6tables -I OUTPUT 1 -o eth1 -p icmpv6 --icmpv6-type 2 -j ACCEPT
|
||||||
|
alice::"ip route add fec0:\:/16 via fec1:\:1"
|
||||||
|
carol::"ip route add fec1:\:/16 via fec0:\:1"
|
||||||
|
moon::ipsec start
|
||||||
|
carol::ipsec start
|
||||||
|
moon::expect-connection rw
|
||||||
|
carol::expect-connection home
|
||||||
|
carol::ipsec up home
|
|
@ -0,0 +1,22 @@
|
||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# This configuration file provides information on the
|
||||||
|
# guest instances used for this test
|
||||||
|
|
||||||
|
# All guest instances that are required for this test
|
||||||
|
#
|
||||||
|
VIRTHOSTS="alice moon carol winnetou"
|
||||||
|
|
||||||
|
# Corresponding block diagram
|
||||||
|
#
|
||||||
|
DIAGRAM="a-m-c-w-ip6.png"
|
||||||
|
|
||||||
|
# Guest instances on which tcpdump is to be started
|
||||||
|
#
|
||||||
|
TCPDUMPHOSTS="moon"
|
||||||
|
|
||||||
|
# Guest instances on which IPsec is started
|
||||||
|
# Used for IPsec logging purposes
|
||||||
|
#
|
||||||
|
IPSECHOSTS="moon carol"
|
||||||
|
|
Loading…
Reference in New Issue