sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-11-22 00:01:45 -05:00
Code Issues Projects Releases Wiki Activity

added dynamic DNS scenarios

Browse Source
This commit is contained in:
Andreas Steffen 2007-06-18 17:50:54 +00:00
parent 3b04350ab2
commit 571bca865b
31 changed files with 641 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
testing/tests/ikev1/dynamic-initiator/description.txt Normal file
View File

@ -0,0 +1,12 @@
The peers <b>carol</b> and <b>moon</b> both have dynamic IP addresses, so that the remote end
is defined symbolically by <b>right=&lt;hostname&gt;</b>. The ipsec starter resolves the
fully-qualified hostname into the current IP address via a DNS lookup (simulated by an
/etc/hosts entry). Since the peer IP addresses are expected to change over time, the option
<b>rightallowany=yes</b> will allow an IKE main mode rekeying to arrive from an arbitrary
IP address under the condition that the peer identity remains unchanged. When this happens
the old tunnel is replaced by an IPsec connection to the new origin.
<p>
In this scenario <b>carol</b> first initiates a tunnel to <b>moon</b>. After some time <b>carol</b>
suddenly changes her IP address and restarts the connection to <b>moon</b> without deleting the
old tunnel first (simulated by iptables blocking IKE packets to and from
<b>carol</b> and starting the connection from host <b>dave</b> using <b>carol</b>'s identity).

8
testing/tests/ikev1/dynamic-initiator/evaltest.dat Normal file
View File

@ -0,0 +1,8 @@
carol::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
dave::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
moon::cat /var/log/auth.log::PH_IP_CAROL.*IPsec SA established::YES
moon::cat /var/log/auth.log::PH_IP_DAVE.*deleting connection.*with peer PH_IP_CAROL::YES
moon::cat /var/log/auth.log::PH_IP_DAVE.*IPsec SA established::YES
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES

29
testing/tests/ikev1/dynamic-initiator/hosts/carol/etc/ipsec.conf Executable file
View File

@ -0,0 +1,29 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn moon
left=%defaultroute
leftsourceip=PH_IP_CAROL1
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=moon.strongswan.org
rightallowany=yes
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add

29
testing/tests/ikev1/dynamic-initiator/hosts/dave/etc/ipsec.conf Executable file
View File

@ -0,0 +1,29 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn moon
left=%defaultroute
leftsourceip=PH_IP_CAROL1
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=moon.strongswan.org
rightallowany=yes
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add

25
testing/tests/ikev1/dynamic-initiator/hosts/dave/etc/ipsec.d/certs/carolCert.pem Normal file
View File

@ -0,0 +1,25 @@
-----BEGIN CERTIFICATE-----
MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX
T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl
vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii
S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW
LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM
YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC
MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD
j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI
U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM
2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE
HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd
hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG
C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK
omBYfxqp
-----END CERTIFICATE-----

30
testing/tests/ikev1/dynamic-initiator/hosts/dave/etc/ipsec.d/private/carolKey.pem Normal file
View File

@ -0,0 +1,30 @@
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,1E1991A43D0778B7
MAsd1YBlHz54KjvBvhpwDBewinBkxBo/NmdsMetLIcV8Ag87YcKtTXYju+fbW21y
DI12iPDQeS9tk17tS8qE5ubWmx/8n0fa5VCdLZ06JK6eeASXNoomXZh5rGsd42It
sj0irWAnbIA3nFFWQl+Uz5pGZMse7aDSNyk1zs3xtywFIaditYIBsRhrTVmJ/bCK
waVr++S2pwUHJ/phKoZQ8pwgF5KtYOZxdNtYIzfOZNMoplESR3+WYBYSuW8BKuOc
QAign/BL2JVJLD4OpHQ68D8Su2sbh6ZYA5jslZLDgG9O7eiMbkCE+N8DmKO6wNAr
zB5ILb4u5dIyTqun32tOENEhpZqDdMQtZZ34fRBze4IoMx9LrEOAHdZAQyyERP80
iJCnH8BNf6FerA+XeDs4LVd1yrCklXKFINatqSRP/tNY3kruKw2Q7cAi2AFf+Rv6
1lrvwK4MiLSHFtzcgEJuxm2bxeceIwXLJ2AVlfLBJvK/yJlq0MPedFbl6E6UwKfw
cMLokF3sa1XrfwpJ93enGLqdpJrkR3dTzrsshjIhjQqfc8lqLwRlbMGc9u+V0ZsK
OJ8e26wc/4l5D7CQ1vmgT/R/tuydBtUskgH96anhNJj1M95odkoh4Zicmm5iLgy2
kluVYiEk0Fs7hc5Qtv8ZLN7ZoBRvZfJZWhXHDXmh71g1aoVYacIkFwiTMX4NoDy5
QVq9tFUZ1TW4VrNIzfq++rLoz4XlgVy0Yz8jNWKuB0KRuHPNSsQUY2NHkDX+wOjq
MP1SfNDxqPoqrmCqbgMw/9DmeOj9gyiTyjZhPZTxFOp67FYEYzYtR6bLQKEhdgf6
iOVROZyrFHMZdBiUgV8GECds1th6ZYWmNRGdvxYjSjExIYgkDrcWbowTqD0bFC9b
zClaSqrxR6GHUzbUVOBuCP+RmUx4j6gPvMRLUcIn5RmpbGtPE0ixeB5sFB0IuRRW
6u2YToCiuq3EG1iJRmxjnBa/zj1aBO6OlsE/aPc0Sx+Jhm+MUbDioxUAriX96bJ+
DEB4zgDhC0vIvkkUVAzQMkWPX479nPDmiZLpMqUIfqUh75WDpHbCladyGMgSkEo0
IKq96oAWHJC8WLH0UMxMNuf8Ut+TsSpIO6G0RPl/cx3+hQqSUC5oUB7R3ZAWYx+6
mawjkNJEx72yeJmQtGiZYEfeMt0Svm10PypMXFu0+2JjiS2eRj2K1yqrUnuL6AnY
GYYmTmR74dnVAd35bRYJjY1XHGC9MyqBn4jLqKZm1BKO3sFsctGDy6vybnvAgPD7
LioGQHPiOZmQe9Q5mMLedE9NAUCzlR8BHRbWtlnajQWcC0JcVu/mBQsjOt/KHh/V
CY4aFXE56lRH2OpqZQxFpBFOSFDcuVX+zcEBGmKfk65n2MFL4McAJUhVRZL561Zx
r9BvILv1Ld6/hECbodq0sUqvbDYHzv25zxAVKSIk1xy85mP5aNbk8xuGHmm860wg
YOqdePwBEcDHoio+ov/uFYB7+4gt40vV90EzSiyfdq8x9RFMViJU430IkIBcvByo
tFFcbN8ucBozxtl4AX495GVSRI7V0XXBtEdOIwJIzPBylZOHxCuTnA==
-----END RSA PRIVATE KEY-----

3
testing/tests/ikev1/dynamic-initiator/hosts/dave/etc/ipsec.secrets Normal file
View File

@ -0,0 +1,3 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
: RSA carolKey.pem "nH5ZQEWtku0RJEZ6"

26
testing/tests/ikev1/dynamic-initiator/hosts/moon/etc/ipsec.conf Executable file
View File

@ -0,0 +1,26 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
left=%defaultroute
leftsubnet=10.1.0.0/16
leftsourceip=PH_IP_MOON1
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftfirewall=yes
conn carol
right=carol.strongswan.org
rightallowany=yes
rightid=carol@strongswan.org
rightsubnet=PH_IP_CAROL1/32
auto=add

11
testing/tests/ikev1/dynamic-initiator/posttest.dat Normal file
View File

@ -0,0 +1,11 @@
dave::ipsec stop
carol::ipsec stop
dave::sleep 1
moon::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
dave::/etc/init.d/iptables stop 2> /dev/null
carol::ip addr del PH_IP_CAROL1/32 dev eth0
dave::ip addr del PH_IP_CAROL1/32 dev eth0
dave::rm /etc/ipsec.d/certs/*
dave::rm /etc/ipsec.d/private/*

13
testing/tests/ikev1/dynamic-initiator/pretest.dat Normal file
View File

@ -0,0 +1,13 @@
moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
dave::/etc/init.d/iptables start 2> /dev/null
carol::ipsec start
dave::ipsec start
moon::ipsec start
carol::sleep 2
carol::ipsec up moon
carol::sleep 1
carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT
carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
dave::ipsec up moon
dave::sleep 1

21
testing/tests/ikev1/dynamic-initiator/test.conf Normal file
View File

@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# UML instances used for this test
# All UML instances that are required for this test
#
UMLHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"

13
testing/tests/ikev1/dynamic-responder/description.txt Normal file
View File

@ -0,0 +1,13 @@
The peers <b>carol</b> and <b>moon</b> both have dynamic IP addresses, so that the remote end
is defined symbolically by <b>right=&lt;hostname&gt;</b>. The ipsec starter resolves the
fully-qualified hostname into the current IP address via a DNS lookup (simulated by an
/etc/hosts entry). Since the peer IP addresses are expected to change over time, the option
<b>rightallowany=yes</b> will allow an IKE main mode rekeying to arrive from an arbitrary
IP address under the condition that the peer identity remains unchanged. When this happens
the old tunnel is replaced by an IPsec connection to the new origin.
<p>
In this scenario <b>moon</b> first initiates a tunnel to <b>carol</b>. After some time
the responder <b>carol</b> suddenly changes her IP address and restarts the connection to
<b>moon</b> without deleting the old tunnel first (simulated by iptables blocking IKE packets
to and from <b>carol</b> and starting the connection from host <b>dave</b> using
<b>carol</b>'s identity).

8
testing/tests/ikev1/dynamic-responder/evaltest.dat Normal file
View File

@ -0,0 +1,8 @@
carol::ipsec status::moon.*STATE_QUICK_R2.*IPsec SA established::YES
dave::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
moon::cat /var/log/auth.log::PH_IP_CAROL.*IPsec SA established::YES
moon::cat /var/log/auth.log::PH_IP_DAVE.*deleting connection.*with peer PH_IP_CAROL::YES
moon::cat /var/log/auth.log::PH_IP_DAVE.*IPsec SA established::YES
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES

29
testing/tests/ikev1/dynamic-responder/hosts/carol/etc/ipsec.conf Executable file
View File

@ -0,0 +1,29 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn moon
left=%defaultroute
leftsourceip=PH_IP_CAROL1
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=moon.strongswan.org
rightallowany=yes
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add

29
testing/tests/ikev1/dynamic-responder/hosts/dave/etc/ipsec.conf Executable file
View File

@ -0,0 +1,29 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn moon
left=%defaultroute
leftsourceip=PH_IP_CAROL1
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=moon.strongswan.org
rightallowany=yes
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add

25
testing/tests/ikev1/dynamic-responder/hosts/dave/etc/ipsec.d/certs/carolCert.pem Normal file
View File

@ -0,0 +1,25 @@
-----BEGIN CERTIFICATE-----
MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX
T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl
vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii
S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW
LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM
YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC
MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD
j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI
U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM
2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE
HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd
hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG
C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK
omBYfxqp
-----END CERTIFICATE-----

30
testing/tests/ikev1/dynamic-responder/hosts/dave/etc/ipsec.d/private/carolKey.pem Normal file
View File

@ -0,0 +1,30 @@
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,1E1991A43D0778B7
MAsd1YBlHz54KjvBvhpwDBewinBkxBo/NmdsMetLIcV8Ag87YcKtTXYju+fbW21y
DI12iPDQeS9tk17tS8qE5ubWmx/8n0fa5VCdLZ06JK6eeASXNoomXZh5rGsd42It
sj0irWAnbIA3nFFWQl+Uz5pGZMse7aDSNyk1zs3xtywFIaditYIBsRhrTVmJ/bCK
waVr++S2pwUHJ/phKoZQ8pwgF5KtYOZxdNtYIzfOZNMoplESR3+WYBYSuW8BKuOc
QAign/BL2JVJLD4OpHQ68D8Su2sbh6ZYA5jslZLDgG9O7eiMbkCE+N8DmKO6wNAr
zB5ILb4u5dIyTqun32tOENEhpZqDdMQtZZ34fRBze4IoMx9LrEOAHdZAQyyERP80
iJCnH8BNf6FerA+XeDs4LVd1yrCklXKFINatqSRP/tNY3kruKw2Q7cAi2AFf+Rv6
1lrvwK4MiLSHFtzcgEJuxm2bxeceIwXLJ2AVlfLBJvK/yJlq0MPedFbl6E6UwKfw
cMLokF3sa1XrfwpJ93enGLqdpJrkR3dTzrsshjIhjQqfc8lqLwRlbMGc9u+V0ZsK
OJ8e26wc/4l5D7CQ1vmgT/R/tuydBtUskgH96anhNJj1M95odkoh4Zicmm5iLgy2
kluVYiEk0Fs7hc5Qtv8ZLN7ZoBRvZfJZWhXHDXmh71g1aoVYacIkFwiTMX4NoDy5
QVq9tFUZ1TW4VrNIzfq++rLoz4XlgVy0Yz8jNWKuB0KRuHPNSsQUY2NHkDX+wOjq
MP1SfNDxqPoqrmCqbgMw/9DmeOj9gyiTyjZhPZTxFOp67FYEYzYtR6bLQKEhdgf6
iOVROZyrFHMZdBiUgV8GECds1th6ZYWmNRGdvxYjSjExIYgkDrcWbowTqD0bFC9b
zClaSqrxR6GHUzbUVOBuCP+RmUx4j6gPvMRLUcIn5RmpbGtPE0ixeB5sFB0IuRRW
6u2YToCiuq3EG1iJRmxjnBa/zj1aBO6OlsE/aPc0Sx+Jhm+MUbDioxUAriX96bJ+
DEB4zgDhC0vIvkkUVAzQMkWPX479nPDmiZLpMqUIfqUh75WDpHbCladyGMgSkEo0
IKq96oAWHJC8WLH0UMxMNuf8Ut+TsSpIO6G0RPl/cx3+hQqSUC5oUB7R3ZAWYx+6
mawjkNJEx72yeJmQtGiZYEfeMt0Svm10PypMXFu0+2JjiS2eRj2K1yqrUnuL6AnY
GYYmTmR74dnVAd35bRYJjY1XHGC9MyqBn4jLqKZm1BKO3sFsctGDy6vybnvAgPD7
LioGQHPiOZmQe9Q5mMLedE9NAUCzlR8BHRbWtlnajQWcC0JcVu/mBQsjOt/KHh/V
CY4aFXE56lRH2OpqZQxFpBFOSFDcuVX+zcEBGmKfk65n2MFL4McAJUhVRZL561Zx
r9BvILv1Ld6/hECbodq0sUqvbDYHzv25zxAVKSIk1xy85mP5aNbk8xuGHmm860wg
YOqdePwBEcDHoio+ov/uFYB7+4gt40vV90EzSiyfdq8x9RFMViJU430IkIBcvByo
tFFcbN8ucBozxtl4AX495GVSRI7V0XXBtEdOIwJIzPBylZOHxCuTnA==
-----END RSA PRIVATE KEY-----

3
testing/tests/ikev1/dynamic-responder/hosts/dave/etc/ipsec.secrets Normal file
View File

@ -0,0 +1,3 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
: RSA carolKey.pem "nH5ZQEWtku0RJEZ6"

26
testing/tests/ikev1/dynamic-responder/hosts/moon/etc/ipsec.conf Executable file
View File

@ -0,0 +1,26 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
left=%defaultroute
leftsubnet=10.1.0.0/16
leftsourceip=PH_IP_MOON1
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftfirewall=yes
conn carol
right=carol.strongswan.org
rightallowany=yes
rightid=carol@strongswan.org
rightsubnet=PH_IP_CAROL1/32
auto=add

11
testing/tests/ikev1/dynamic-responder/posttest.dat Normal file
View File

@ -0,0 +1,11 @@
dave::ipsec stop
carol::ipsec stop
dave::sleep 1
moon::ipsec stop
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
dave::/etc/init.d/iptables stop 2> /dev/null
carol::ip addr del PH_IP_CAROL1/32 dev eth0
dave::ip addr del PH_IP_CAROL1/32 dev eth0
dave::rm /etc/ipsec.d/certs/*
dave::rm /etc/ipsec.d/private/*

13
testing/tests/ikev1/dynamic-responder/pretest.dat Normal file
View File

@ -0,0 +1,13 @@
moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
dave::/etc/init.d/iptables start 2> /dev/null
carol::ipsec start
dave::ipsec start
moon::ipsec start
moon::sleep 2
moon::ipsec up carol
moon::sleep 1
carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT
carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
dave::ipsec up moon
dave::sleep 1

21
testing/tests/ikev1/dynamic-responder/test.conf Normal file
View File

@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# UML instances used for this test
# All UML instances that are required for this test
#
UMLHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"

15
testing/tests/ikev1/dynamic-two-peers/description.txt Normal file
View File

@ -0,0 +1,15 @@
The peers <b>carol</b>, <b>dave</b>, and <b>moon</b> all have dynamic IP addresses,
so that the remote end is defined symbolically by <b>right=&lt;hostname&gt;</b>.
The ipsec starter resolves the fully-qualified hostname into the current IP address
via a DNS lookup (simulated by an /etc/hosts entry). Since the peer IP addresses are
expected to change over time, the option <b>rightallowany=yes</b> will allow an IKE
main mode rekeying to arrive from an arbitrary IP address under the condition that
the peer identity remains unchanged. When this happens the old tunnel is replaced
by an IPsec connection to the new origin.
<p>
In this scenario both <b>carol</b> and <b>dave</b> initiate a tunnel to
<b>moon</b> which has a named connection definition for each peer. Although
the IP addresses of both <b>carol</b> and <b>dave</b> are stale, thanks to
the <b>rightallowany=yes</b> flag <b>moon</b> will accept the IKE negotiations
from the actual IP addresses.

10
testing/tests/ikev1/dynamic-two-peers/evaltest.dat Normal file
View File

@ -0,0 +1,10 @@
carol::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
dave::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
moon::ipsec status::carol.*STATE_QUICK_R2.*IPsec SA established::YES
moon::ipsec status::dave.*STATE_QUICK_R2.*IPsec SA established::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES

29
testing/tests/ikev1/dynamic-two-peers/hosts/carol/etc/ipsec.conf Executable file
View File

@ -0,0 +1,29 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn moon
left=%defaultroute
leftsourceip=PH_IP_CAROL1
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=moon.strongswan.org
rightallowany=yes
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add

29
testing/tests/ikev1/dynamic-two-peers/hosts/dave/etc/ipsec.conf Executable file
View File

@ -0,0 +1,29 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
conn moon
left=%defaultroute
leftsourceip=PH_IP_DAVE1
leftcert=daveCert.pem
leftid=dave@strongswan.org
leftfirewall=yes
right=moon.strongswan.org
rightallowany=yes
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add

67
testing/tests/ikev1/dynamic-two-peers/hosts/moon/etc/hosts.stale Normal file
View File

@ -0,0 +1,67 @@
# /etc/hosts: This file describes a number of hostname-to-address
# mappings for the TCP/IP subsystem. It is mostly
# used at boot time, when no name servers are running.
# On small systems, this file can be used instead of a
# "named" name server. Just add the names, addresses
# and any aliases to this file...
#
127.0.0.1 localhost
192.168.0.254 uml0.strongswan.org uml0
10.1.0.254 uml1.strongswan.org uml1
10.2.0.254 uml1.strongswan.org uml2
10.1.0.10 alice.strongswan.org alice
10.1.0.20 venus.strongswan.org venus
10.1.0.1 moon1.strongswan.org moon1
192.168.0.1 moon.strongswan.org moon
192.168.0.110 carol.strongswan.org carol
10.3.0.1 carol1.strongswan.org carol1
192.168.0.150 winnetou.strongswan.org winnetou crl.strongswan.org ocsp.strongswan.org ldap.strongswan.org
192.168.0.220 dave.strongswan.org dave
10.3.0.2 dave1.strongswan.org dave1
192.168.0.2 sun.strongswan.org sun
10.2.0.1 sun1.strongswan.org sun1
10.2.0.10 bob.strongswan.org bob
# IPv6 versions of localhost and co
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
# IPv6 solicited-node multicast addresses
ff02::1:ff00:1 ip6-mcast-1
ff02::1:ff00:2 ip6-mcast-2
ff02::1:ff00:10 ip6-mcast-10
ff02::1:ff00:15 ip6-mcast-15
ff02::1:ff00:20 ip6-mcast-20
# IPv6 site-local addresses
fec1::10 ip6-alice.strongswan.org ip6-alice
fec1::20 ip6-venus.strongswan.org ip6-venus
fec1::1 ip6-moon1.strongswan.org ip6-moon1
fec0::1 ip6-moon.strongswan.org ip6-moon
fec0::10 ip6-carol.strongswan.org ip6-carol
fec3::1 ip6-carol1.strongswan.org ip6-carol1
fec0::15 ip6-winnetou.strongswan.org ip6-winnetou
fec0::20 ip6-dave.strongswan.org ip6-dave
fec3::2 ip6-dave1.strongswan.org ip6-dave1
fec0::2 ip6-sun.strongswan.org ip6-sun
fec2::1 ip6-sun1.strongswan.org ip6-sun1
fec2::10 ip6-bob.strongswan.org ip6-bob
# IPv6 link-local HW derived addresses
fe80::fcfd:0aff:fe01:14 ip6-hw-venus.strongswan.org ip6-hw-venus
fe80::fcfd:0aff:fe01:0a ip6-hw-alice.strongswan.org ip6-hw-alice
fe80::fcfd:0aff:fe01:01 ip6-hw-moon1.strongswan.org ip6-hw-moon1
fe80::fcfd:c0ff:fea8:01 ip6-hw-moon.strongswan.org ip6-hw-moon
fe80::fcfd:c0ff:fea8:64 ip6-hw-carol.strongswan.org ip6-hw-carol
fe80::fcfd:c0ff:fea8:96 ip6-hw-winnetou.strongswan.org ip6-hw-winnetou
fe80::fcfd:c0ff:fea8:c8 ip6-hw-dave.strongswan.org ip6-hw-dave
fe80::fcfd:c0ff:fea8:02 ip6-hw-sun.strongswan.org ip6-hw-sun
fe80::fcfd:0aff:fe02:01 ip6-hw-sun1.strongswan.org ip6-hw-sun1
fe80::fcfd:0aff:fe02:0a ip6-hw-bob.strongswan.org ip6-hw-bob

33
testing/tests/ikev1/dynamic-two-peers/hosts/moon/etc/ipsec.conf Executable file
View File

@ -0,0 +1,33 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
plutodebug=control
crlcheckinterval=180
strictcrlpolicy=no
charonstart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
left=%defaultroute
leftsubnet=10.1.0.0/16
leftsourceip=PH_IP_MOON1
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftfirewall=yes
conn carol
right=carol.strongswan.org
rightallowany=yes
rightid=carol@strongswan.org
rightsubnet=PH_IP_CAROL1/32
auto=add
conn dave
right=dave.strongswan.org
rightallowany=yes
rightid=dave@strongswan.org
rightsubnet=PH_IP_DAVE1/32
auto=add

10
testing/tests/ikev1/dynamic-two-peers/posttest.dat Normal file
View File

@ -0,0 +1,10 @@
carol::ipsec stop
dave::ipsec stop
moon::sleep 1
moon::ipsec stop
moon::mv /etc/hosts.ori /etc/hosts
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
dave::/etc/init.d/iptables stop 2> /dev/null
carol::ip addr del PH_IP_CAROL1/32 dev eth0
dave::ip addr del PH_IP_DAVE1/32 dev eth0

12
testing/tests/ikev1/dynamic-two-peers/pretest.dat Normal file
View File

@ -0,0 +1,12 @@
moon::mv /etc/hosts /etc/hosts.ori
moon::mv /etc/hosts.stale /etc/hosts
moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
dave::/etc/init.d/iptables start 2> /dev/null
carol::ipsec start
dave::ipsec start
moon::ipsec start
carol::sleep 2
carol::ipsec up moon
dave::ipsec up moon
carol::sleep 1

21
testing/tests/ikev1/dynamic-two-peers/test.conf Normal file
View File

@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# UML instances used for this test
# All UML instances that are required for this test
#
UMLHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"