Merge branch 'ipcomp'
Fixes compatibility issues between firewall rules (leftfirewall=yes) and IPComp (compress=yes), plus issues with IPComp when used with multiple subnets in left|rightsubnet. Fixes #436.
This commit is contained in:
commit
6b95565767
|
@ -50,6 +50,9 @@
|
|||
# PLUTO_PROTO
|
||||
# is the negotiated IPsec protocol, ah|esp
|
||||
#
|
||||
# PLUTO_IPCOMP
|
||||
# is not empty if IPComp was negotiated
|
||||
#
|
||||
# PLUTO_UNIQUEID
|
||||
# is the unique identifier of the associated IKE_SA
|
||||
#
|
||||
|
@ -411,6 +414,14 @@ up-host:iptables)
|
|||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# allow IPIP traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed)
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
|
@ -435,6 +446,13 @@ down-host:iptables)
|
|||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# IPIP exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
|
@ -474,6 +492,15 @@ up-client:iptables)
|
|||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# allow IPIP traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed).
|
||||
# INPUT is correct here even for forwarded traffic.
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
|
@ -517,6 +544,13 @@ down-client:iptables)
|
|||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# IPIP exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
|
|
|
@ -1,4 +1,5 @@
|
|||
/*
|
||||
* Copyright (C) 2013 Tobias Brunner
|
||||
* Copyright (C) 2008 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
|
@ -218,12 +219,12 @@ METHOD(listener_t, child_updown, bool,
|
|||
enumerator = child_sa->create_policy_enumerator(child_sa);
|
||||
while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
|
||||
{
|
||||
char command[1024];
|
||||
char command[2048];
|
||||
host_t *my_client, *other_client;
|
||||
u_int8_t my_client_mask, other_client_mask;
|
||||
char *virtual_ip, *iface, *mark_in, *mark_out, *udp_enc, *dns, *xauth;
|
||||
mark_t mark;
|
||||
bool is_host, is_ipv6;
|
||||
bool is_host, is_ipv6, use_ipcomp;
|
||||
FILE *shell;
|
||||
|
||||
my_ts->to_subnet(my_ts, &my_client, &my_client_mask);
|
||||
|
@ -322,6 +323,9 @@ METHOD(listener_t, child_updown, bool,
|
|||
|
||||
dns = make_dns_vars(this, ike_sa);
|
||||
|
||||
/* check for IPComp */
|
||||
use_ipcomp = child_sa->get_ipcomp(child_sa) != IPCOMP_NONE;
|
||||
|
||||
/* determine IPv4/IPv6 and client/host situation */
|
||||
is_host = my_ts->is_host(my_ts, me);
|
||||
is_ipv6 = is_host ? (me->get_family(me) == AF_INET6) :
|
||||
|
@ -355,6 +359,7 @@ METHOD(listener_t, child_updown, bool,
|
|||
"%s"
|
||||
"%s"
|
||||
"%s"
|
||||
"%s"
|
||||
"%s",
|
||||
up ? "up" : "down",
|
||||
is_host ? "-host" : "-client",
|
||||
|
@ -377,6 +382,7 @@ METHOD(listener_t, child_updown, bool,
|
|||
mark_in,
|
||||
mark_out,
|
||||
udp_enc,
|
||||
use_ipcomp ? "PLUTO_IPCOMP='1' " : "",
|
||||
config->get_hostaccess(config) ? "PLUTO_HOST_ACCESS='1' " : "",
|
||||
dns,
|
||||
script);
|
||||
|
|
|
@ -1203,6 +1203,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
|||
struct nlmsghdr *hdr;
|
||||
struct xfrm_usersa_info *sa;
|
||||
u_int16_t icv_size = 64;
|
||||
ipsec_mode_t original_mode = mode;
|
||||
status_t status = FAILED;
|
||||
|
||||
/* if IPComp is used, we install an additional IPComp SA. if the cpi is 0
|
||||
|
@ -1213,7 +1214,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
|||
add_sa(this, src, dst, htonl(ntohs(cpi)), IPPROTO_COMP, reqid, mark,
|
||||
tfc, &lft, ENCR_UNDEFINED, chunk_empty, AUTH_UNDEFINED,
|
||||
chunk_empty, mode, ipcomp, 0, initiator, FALSE, FALSE, inbound,
|
||||
NULL, NULL);
|
||||
src_ts, dst_ts);
|
||||
ipcomp = IPCOMP_NONE;
|
||||
/* use transport mode ESP SA, IPComp uses tunnel mode */
|
||||
mode = MODE_TRANSPORT;
|
||||
|
@ -1243,7 +1244,12 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
|||
break;
|
||||
case MODE_BEET:
|
||||
case MODE_TRANSPORT:
|
||||
if(src_ts && dst_ts)
|
||||
if (original_mode == MODE_TUNNEL)
|
||||
{ /* don't install selectors for switched SAs. because only one
|
||||
* selector can be installed other traffic would get dropped */
|
||||
break;
|
||||
}
|
||||
if (src_ts && dst_ts)
|
||||
{
|
||||
sa->sel = ts2selector(src_ts, dst_ts);
|
||||
/* don't install proto/port on SA. This would break
|
||||
|
|
|
@ -0,0 +1,3 @@
|
|||
The peers <b>alice</b> and <b>bob</b> are located behind the NAT routers <b>moon</b> and <b>sun</b>,
|
||||
respectively. They both connect to a central gateway <b>carol</b> using IPComp.
|
||||
In order to test the IPsec tunnel both peers ping each other and gateway <b>carol</b>.
|
|
@ -0,0 +1,22 @@
|
|||
alice::ipsec status 2> /dev/null::hub.*ESTABLISHED.*alice@strongswan.org.*carol@strongswan.org::YES
|
||||
bob:: ipsec status 2> /dev/null::hub.*ESTABLISHED.*bob@strongswan.org.*carol@strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::hub.*ESTABLISHED.*PH_IP_MOON.*alice@strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::hub.*ESTABLISHED.*PH_IP_SUN.*bob@strongswan.org::YES
|
||||
alice::ipsec status 2> /dev/null::hub.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||
bob:: ipsec status 2> /dev/null::hub.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||
carol::ipsec status 2> /dev/null::hub.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||
carol::cat /var/log/daemon.log::IKE_AUTH request.*N(IPCOMP_SUP)::YES
|
||||
carol::cat /var/log/daemon.log::IKE_AUTH response.*N(IPCOMP_SUP)::YES
|
||||
alice::ip xfrm state::proto comp spi::YES
|
||||
bob:: ip xfrm state::proto comp spi::YES
|
||||
carol::ip xfrm state::proto comp spi::YES
|
||||
alice::ping -c 1 -s 8184 -p deadbeef PH_IP_CAROL::8192 bytes from PH_IP_CAROL: icmp_req=1::YES
|
||||
alice::ping -c 1 PH_IP_CAROL::64 bytes from PH_IP_CAROL: icmp_req=1::YES
|
||||
alice::ping -c 1 -s 8184 -p deadbeef PH_IP_BOB::8192 bytes from PH_IP_BOB: icmp_req=1::YES
|
||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
|
||||
bob:: ping -c 1 -s 8184 -p deadbeef PH_IP_ALICE::8192 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
|
||||
moon::tcpdump::IP moon.strongswan.org.* > carol.strongswan.org.*: UDP::YES
|
||||
moon::tcpdump::IP carol.strongswan.org.* > moon.strongswan.org.*: UDP::YES
|
||||
sun::tcpdump::IP sun.strongswan.org.* > carol.strongswan.org.*: UDP::YES
|
||||
sun::tcpdump::IP carol.strongswan.org.* > sun.strongswan.org.*: UDP::YES
|
|
@ -0,0 +1,24 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
dpdaction=restart
|
||||
dpddelay=60s
|
||||
leftfirewall=yes
|
||||
lefthostaccess=yes
|
||||
|
||||
conn hub
|
||||
leftcert=aliceCert.pem
|
||||
leftid=alice@strongswan.org
|
||||
leftsubnet=10.1.0.0/16
|
||||
right=PH_IP_CAROL
|
||||
rightid=carol@strongswan.org
|
||||
rightsubnet=PH_IP_CAROL/32,10.2.0.0/16
|
||||
compress=yes
|
||||
auto=add
|
|
@ -0,0 +1,5 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||
}
|
|
@ -0,0 +1,24 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
dpdaction=restart
|
||||
dpddelay=60s
|
||||
leftfirewall=yes
|
||||
lefthostaccess=yes
|
||||
|
||||
conn hub
|
||||
leftcert=bobCert.pem
|
||||
leftid=bob@strongswan.org
|
||||
leftsubnet=10.2.0.0/16
|
||||
right=PH_IP_CAROL
|
||||
rightid=carol@strongswan.org
|
||||
rightsubnet=PH_IP_CAROL/32,10.1.0.0/16
|
||||
compress=yes
|
||||
auto=add
|
|
@ -0,0 +1,5 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||
}
|
|
@ -0,0 +1,23 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
dpdaction=clear
|
||||
dpddelay=60s
|
||||
|
||||
conn hub
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
leftfirewall=yes
|
||||
lefthostaccess=yes
|
||||
right=%any
|
||||
leftsubnet=0.0.0.0/0
|
||||
rightsubnet=0.0.0.0/0
|
||||
compress=yes
|
||||
auto=add
|
|
@ -0,0 +1,24 @@
|
|||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
COMMIT
|
|
@ -0,0 +1,5 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||
}
|
|
@ -0,0 +1,10 @@
|
|||
bob::ipsec stop
|
||||
alice::ipsec stop
|
||||
carol::ipsec stop
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
bob::iptables-restore < /etc/iptables.flush
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
moon::conntrack -F
|
||||
sun::conntrack -F
|
|
@ -0,0 +1,21 @@
|
|||
alice::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
bob::iptables-restore < /etc/iptables.rules
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
|
||||
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
|
||||
moon::iptables -A FORWARD -i eth0 -o eth1 -d 10.1.0.0/16 -j ACCEPT
|
||||
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p udp -j SNAT --to-source PH_IP_SUN:1200-1300
|
||||
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
|
||||
sun::iptables -A FORWARD -i eth1 -o eth0 -s 10.2.0.0/16 -j ACCEPT
|
||||
sun::iptables -A FORWARD -i eth0 -o eth1 -d 10.2.0.0/16 -j ACCEPT
|
||||
carol::ipsec start
|
||||
alice::ipsec start
|
||||
bob::ipsec start
|
||||
carol::expect-connection hub
|
||||
alice::expect-connection hub
|
||||
bob::expect-connection hub
|
||||
alice::ipsec up hub
|
||||
bob::ipsec up hub
|
|
@ -0,0 +1,21 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou sun bob"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w-s-b-med.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon sun"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="alice carol bob"
|
|
@ -1,3 +1,4 @@
|
|||
This scenario enables IPCOMP compression between roadwarrior <b>carol</b> and
|
||||
gateway <b>moon</b>. Two pings from <b>carol</b> to <b>alice</b> checks
|
||||
the established tunnel with compression.
|
||||
This scenario enables IPComp compression between roadwarrior <b>carol</b> and
|
||||
gateway <b>moon</b>. Two pings from <b>carol</b> to <b>alice</b> check
|
||||
the established tunnel with compression. The packet sizes of the two pings
|
||||
are different because the kernel does not compress small packets.
|
||||
|
|
|
@ -6,7 +6,7 @@ moon:: cat /var/log/daemon.log::IKE_AUTH request.*N(IPCOMP_SUP)::YES
|
|||
moon:: cat /var/log/daemon.log::IKE_AUTH response.*N(IPCOMP_SUP)::YES
|
||||
moon:: ip xfrm state::proto comp spi::YES
|
||||
carol::ip xfrm state::proto comp spi::YES
|
||||
carol::ping -n -c 2 -s 8184 -p deadbeef PH_IP_ALICE::8192 bytes from PH_IP_ALICE::YES
|
||||
carol::ping -n -c 1 -s 8184 -p deadbeef PH_IP_ALICE::8192 bytes from PH_IP_ALICE::YES
|
||||
carol::ping -n -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE::YES
|
||||
moon::tcpdump::carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
|
||||
|
|
|
@ -9,6 +9,7 @@ conn %default
|
|||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
compress=yes
|
||||
leftfirewall=yes
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||
}
|
||||
|
|
|
@ -9,6 +9,7 @@ conn %default
|
|||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
compress=yes
|
||||
leftfirewall=yes
|
||||
|
||||
conn rw
|
||||
left=PH_IP_MOON
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||
}
|
||||
|
|
|
@ -1,2 +1,4 @@
|
|||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
|
|
|
@ -1,3 +1,5 @@
|
|||
carol::iptables-restore < /etc/iptables.rules
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::ipsec start
|
||||
moon::ipsec start
|
||||
carol::sleep 2
|
||||
|
|
|
@ -0,0 +1,13 @@
|
|||
An IPsec <b>transport-mode</b> connection between the natted host <b>alice</b> and gateway <b>sun</b>
|
||||
is successfully set up. <b>leftfirewall=yes</b> automatically inserts iptables-based firewall
|
||||
rules that let pass the decrypted IP packets. In order to test the host-to-host connection
|
||||
<b>alice</b> pings <b>sun</b>.<br/>
|
||||
<b>Note:</b> This scenario also demonstrates two problems with transport-mode and NAT traversal:
|
||||
<ol>
|
||||
<li>The client <b>venus</b> behind the same NAT as client <b>alice</b> is not able to ping <b>sun</b>
|
||||
(even with ICMP explicitly allowed there) because the request arrives unencrypted and thus gets
|
||||
dropped when the IPsec policies are consulted (increases the <em>XfrmInTmplMismatch</em> counter
|
||||
in <em>/proc/net/xfrm_stat</em>).</li>
|
||||
<li>A similar issue arises when <b>venus</b> also establishes an IPsec <b>transport-mode</b> connection to
|
||||
<b>sun</b>, due to the conflicting IPsec policies <b>sun</b> declines such a connection.</li>
|
||||
</ol>
|
|
@ -0,0 +1,12 @@
|
|||
alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*sun.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*sun.strongswan.org.*alice@strongswan.org::YES
|
||||
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT::YES
|
||||
sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT::YES
|
||||
alice::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
|
||||
venus::ping -c 1 -W 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::NO
|
||||
venus::ipsec up nat-t::received TS_UNACCEPTABLE notify::YES
|
||||
sun::cat /var/log/daemon.log::unable to install policy::YES
|
||||
sun::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.*: UDP::YES
|
||||
sun::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.*: UDP::YES
|
||||
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ICMP echo request::YES
|
||||
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ICMP echo reply::NO
|
|
@ -0,0 +1,18 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn nat-t
|
||||
leftcert=aliceCert.pem
|
||||
leftid=alice@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=192.168.0.2
|
||||
rightid=@sun.strongswan.org
|
||||
type=transport
|
||||
auto=add
|
|
@ -0,0 +1,18 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
left=192.168.0.2
|
||||
leftcert=sunCert.pem
|
||||
leftid=@sun.strongswan.org
|
||||
leftfirewall=yes
|
||||
|
||||
conn nat-t
|
||||
right=%any
|
||||
type=transport
|
||||
auto=add
|
|
@ -0,0 +1,28 @@
|
|||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ICMP
|
||||
-A INPUT -i eth0 -p icmp -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p icmp -j ACCEPT
|
||||
|
||||
COMMIT
|
|
@ -0,0 +1,18 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn nat-t
|
||||
leftcert=venusCert.pem
|
||||
leftid=venus@strongswan.org
|
||||
leftfirewall=yes
|
||||
right=192.168.0.2
|
||||
rightid=@sun.strongswan.org
|
||||
type=transport
|
||||
auto=add
|
|
@ -0,0 +1,6 @@
|
|||
alice::ipsec stop
|
||||
venus::ipsec stop
|
||||
sun::ipsec stop
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
|
@ -0,0 +1,12 @@
|
|||
alice::iptables-restore < /etc/iptables.rules
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -j MASQUERADE
|
||||
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
|
||||
moon::iptables -A FORWARD -i eth0 -o eth1 -d 10.1.0.0/16 -j ACCEPT
|
||||
alice::ipsec start
|
||||
venus::ipsec start
|
||||
sun::ipsec start
|
||||
alice::expect-connection nat-t
|
||||
venus::expect-connection nat-t
|
||||
alice::ipsec up nat-t
|
|
@ -0,0 +1,21 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon winnetou sun"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-w-s-b.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="sun alice venus moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="alice venus sun"
|
|
@ -0,0 +1,10 @@
|
|||
This scenario enables IPComp compression between roadwarrior <b>carol</b> and
|
||||
gateway <b>moon</b>. Two IPv6 ICMP requests from <b>carol</b> to <b>alice</b>
|
||||
check the established tunnel with compression. The packet sizes are different
|
||||
because the kernel does not compress small packets.<br/>
|
||||
<b>Note:</b> The kernel applies IPComp after fragmenting the original packet
|
||||
according to the MTU. Also, because <b>alice</b> does not know about the IPsec
|
||||
tunnel between <b>moon</b> and <b>carol</b> the response to the first ICMP
|
||||
request is fragmented in too large fragments and <b>moon</b> sends back ICMPs
|
||||
with type 2 to notify <b>alice</b> about this (Path MTU Discovery).
|
||||
The second ping is then answered successfully.
|
|
@ -0,0 +1,13 @@
|
|||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL.*IPCOMP::YES
|
||||
moon:: cat /var/log/daemon.log::IKE_AUTH request.*N(IPCOMP_SUP)::YES
|
||||
moon:: cat /var/log/daemon.log::IKE_AUTH response.*N(IPCOMP_SUP)::YES
|
||||
moon:: ip xfrm state::proto comp spi::YES
|
||||
carol::ip xfrm state::proto comp spi::YES
|
||||
# send two pings because the first is lost due to Path MTU Discovery between alice and moon
|
||||
carol::ping6 -c 2 -W 1 -s 8184 -p deadbeef ip6-alice.strongswan.org::8192 bytes from ip6-alice.strongswan.org::YES
|
||||
carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org::YES
|
||||
moon::tcpdump::IP6 ip6-carol.strongswan.org > ip6-moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP6 ip6-moon.strongswan.org > ip6-carol.strongswan.org: ESP::YES
|
|
@ -0,0 +1,25 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri=http://ip6-winnetou.strongswan.org/strongswan.crl
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
compress=yes
|
||||
leftfirewall=yes
|
||||
|
||||
conn home
|
||||
leftcert=carolCert.pem
|
||||
leftid=carol@strongswan.org
|
||||
right=PH_IP6_MOON
|
||||
rightsubnet=fec1::/16
|
||||
rightid=@moon.strongswan.org
|
||||
auto=add
|
|
@ -0,0 +1,5 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||
}
|
|
@ -0,0 +1,24 @@
|
|||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri=http://ip6-winnetou.strongswan.org/strongswan.crl
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
compress=yes
|
||||
leftfirewall=yes
|
||||
|
||||
conn rw
|
||||
leftcert=moonCert.pem
|
||||
leftid=@moon.strongswan.org
|
||||
leftsubnet=fec1::/16
|
||||
right=%any
|
||||
auto=add
|
|
@ -0,0 +1,5 @@
|
|||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
|
||||
}
|
|
@ -0,0 +1,8 @@
|
|||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
moon::ip6tables-restore < /etc/ip6tables.flush
|
||||
carol::ip6tables-restore < /etc/ip6tables.flush
|
||||
alice::"ip route del fec0:\:/16 via fec1:\:1"
|
||||
carol::"ip route del fec1:\:/16 via fec0:\:1"
|
|
@ -0,0 +1,13 @@
|
|||
moon::iptables-restore < /etc/iptables.drop
|
||||
carol::iptables-restore < /etc/iptables.drop
|
||||
moon::ip6tables-restore < /etc/ip6tables.rules
|
||||
carol::ip6tables-restore < /etc/ip6tables.rules
|
||||
# enable Path MTU Discovery
|
||||
moon::ip6tables -I OUTPUT 1 -o eth1 -p icmpv6 --icmpv6-type 2 -j ACCEPT
|
||||
alice::"ip route add fec0:\:/16 via fec1:\:1"
|
||||
carol::"ip route add fec1:\:/16 via fec0:\:1"
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::ipsec up home
|
|
@ -0,0 +1,22 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w-ip6.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol"
|
||||
|
Loading…
Reference in New Issue