sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-06 00:00:47 -04:00
Code Issues Projects Releases Wiki Activity

added ikev2/dhcp-static-client-id scenario

Browse Source
This commit is contained in:
Andreas Steffen 2010-04-23 12:56:59 +02:00
parent 55fe05d489
commit 2dbff1bf53
16 changed files with 324 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
testing/tests/ikev2/dhcp-static-client-id/description.txt Normal file
View File

@ -0,0 +1,11 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
and request a <b>virtual IP</b> via the IKEv2 configuration payload by using the <b>leftsourceip=%config</b>
parameter. The <b>dhcp</b> plugin on gateway <b>moon</b> then requests an IP address and DNS/WINS server
information from DHCP server <b>venus</b> using the DHCP protocol. The IP addresses are assigned statically
by <b>venus</b> based on the IKEv2 peer identities <b>carol@strongswan.org</b> and <b>dave@strongswan.org</b>,
respectively, included by the dhcp plugin as a <b>dhcp-client-identity</b> option in the DHCP request.
<p/>
With the static assignment of 10.1.0.30 and 10.1.0.40, respectively, <b>carol</b> and <b>dave</b>
become full members of the subnet 10.1.0.0/16 hidden behind gateway <b>moon</b>. And this thanks to
the <b>farp</b> plugin through which <b>moon</b> acts as a proxy for ARP requests e.g. from <b>alice</b>
who wants to ping <b>carol</b> and <b>dave</b>.

22
testing/tests/ikev2/dhcp-static-client-id/evaltest.dat Normal file
View File

@ -0,0 +1,22 @@
carol::ipsec status::home.*INSTALLED::YES
alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
dave::ipsec status::home.*INSTALLED::YES
alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
moon::ipsec status::rw{.*10.1.0.0/16 === 10.1.0.30/32::YES
moon::ipsec status::rw{.*10.1.0.0/16 === 10.1.0.40/32::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES
alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo reply::YES

24
testing/tests/ikev2/dhcp-static-client-id/hosts/carol/etc/ipsec.conf Executable file
View File

@ -0,0 +1,24 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=PH_IP_CAROL
leftsourceip=%config
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add

5
testing/tests/ikev2/dhcp-static-client-id/hosts/carol/etc/strongswan.conf Normal file
View File

@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink socket-default updown resolve
}

24
testing/tests/ikev2/dhcp-static-client-id/hosts/dave/etc/ipsec.conf Executable file
View File

@ -0,0 +1,24 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
conn home
left=PH_IP_DAVE
leftsourceip=%config
leftcert=daveCert.pem
leftid=dave@strongswan.org
leftfirewall=yes
right=PH_IP_MOON
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add

5
testing/tests/ikev2/dhcp-static-client-id/hosts/dave/etc/strongswan.conf Normal file
View File

@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink socket-default updown resolve
}

9
testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/dhcpd.conf Normal file
View File

@ -0,0 +1,9 @@
subnet 10.1.0.0 netmask 255.255.0.0 {
option routers 10.1.0.1;
option broadcast-address 10.1.255.255;
option domain-name servers PH_IP_WINNETOU PH_IP_VENUS
option netbios-name-servers PH_IP_VENUS;
# dynamic address pool for visitors
range 10.1.0.30 10.1.0.50;
}

91
testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables Executable file
View File

@ -0,0 +1,91 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow bootpc and bootps
iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT
# allow broadcasts from eth1
iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
# log dropped packets
iptables -A INPUT -j LOG --log-prefix " IN: "
iptables -A OUTPUT -j LOG --log-prefix " OUT: "
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}

23
testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/ipsec.conf Executable file
View File

@ -0,0 +1,23 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
left=PH_IP_MOON
leftsubnet=10.1.0.0/16
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftfirewall=yes
conn rw
right=%any
rightsourceip=%dhcp
auto=add

10
testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/strongswan.conf Normal file
View File

@ -0,0 +1,10 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink socket-default updown attr farp dhcp
plugins {
dhcp {
server = 10.1.255.255
}
}
}

25
testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcpd.conf Normal file
View File

@ -0,0 +1,25 @@
# dhcpd configuration file
ddns-update-style none;
subnet 10.1.0.0 netmask 255.255.0.0 {
option domain-name "strongswan.org";
option domain-name-servers 10.1.0.20;
option netbios-name-servers 10.1.0.10;
option routers 10.1.0.1;
option broadcast-address 10.1.255.255;
next-server 10.1.0.20;
range 10.1.0.50 10.1.0.60;
}
host carol {
option dhcp-client-identifier "carol@strongswan.org";
fixed-address 10.1.0.30;
}
host dave {
option dhcp-client-identifier "dave@strongswan.org";
fixed-address 10.1.0.40;
}

9
testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf Normal file
View File

@ -0,0 +1,9 @@
interface=eth0
dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255
dhcp-host=id:carol@strongswan.org,10.1.0.30
dhcp-host=id:dave@strongswan.org,10.1.0.40
dhcp-option=option:router,10.1.0.1
dhcp-option=option:dns-server,10.1.0.20
dhcp-option=option:netbios-ns,10.1.0.10
dhcp-option=option:domain-name,strongswan.org
log-dhcp

24
testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd Executable file
View File

@ -0,0 +1,24 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop"
depend() {
need net
need logger
}
start() {
ebegin "Starting DHCP server"
start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd
eend $?
}
stop() {
ebegin "Stopping DHCP server"
start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid
rm -f /var/state/dhcp/dhcpd.leases
touch /var/state/dhcp/dhcpd.leases
eend $?
}

9
testing/tests/ikev2/dhcp-static-client-id/posttest.dat Normal file
View File

@ -0,0 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
venus::/etc/init.d/dhcpd stop 2> /dev/null
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
dave::/etc/init.d/iptables stop 2> /dev/null
alice::arp -d 10.1.0.30
alice::arp -d 10.1.0.40

12
testing/tests/ikev2/dhcp-static-client-id/pretest.dat Normal file
View File

@ -0,0 +1,12 @@
moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
dave::/etc/init.d/iptables start 2> /dev/null
venus::cat /etc/dhcpd.conf
venus::/etc/init.d/dhcpd start 2> /dev/null
carol::ipsec start
dave::ipsec start
moon::ipsec start
carol::sleep 2
carol::ipsec up home
dave::ipsec up home
carol::sleep 1

21
testing/tests/ikev2/dhcp-static-client-id/test.conf Normal file
View File

@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# UML instances used for this test
# All UML instances that are required for this test
#
UMLHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"