mirror of
https://github.com/strongswan/strongswan.git
synced 2025-11-29 00:00:17 -05:00
added dynamic DNS scenarios
This commit is contained in:
Andreas Steffen
parent
3b04350ab2
commit
571bca865b
12
testing/tests/ikev1/dynamic-initiator/description.txt
Normal file
12
testing/tests/ikev1/dynamic-initiator/description.txt
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
The peers <b>carol</b> and <b>moon</b> both have dynamic IP addresses, so that the remote end
|
||||||
|
is defined symbolically by <b>right=<hostname></b>. The ipsec starter resolves the
|
||||||
|
fully-qualified hostname into the current IP address via a DNS lookup (simulated by an
|
||||||
|
/etc/hosts entry). Since the peer IP addresses are expected to change over time, the option
|
||||||
|
<b>rightallowany=yes</b> will allow an IKE main mode rekeying to arrive from an arbitrary
|
||||||
|
IP address under the condition that the peer identity remains unchanged. When this happens
|
||||||
|
the old tunnel is replaced by an IPsec connection to the new origin.
|
||||||
|
<p>
|
||||||
|
In this scenario <b>carol</b> first initiates a tunnel to <b>moon</b>. After some time <b>carol</b>
|
||||||
|
suddenly changes her IP address and restarts the connection to <b>moon</b> without deleting the
|
||||||
|
old tunnel first (simulated by iptables blocking IKE packets to and from
|
||||||
|
<b>carol</b> and starting the connection from host <b>dave</b> using <b>carol</b>'s identity).
|
||||||
8
testing/tests/ikev1/dynamic-initiator/evaltest.dat
Normal file
8
testing/tests/ikev1/dynamic-initiator/evaltest.dat
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
carol::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
|
||||||
|
dave::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
|
||||||
|
moon::cat /var/log/auth.log::PH_IP_CAROL.*IPsec SA established::YES
|
||||||
|
moon::cat /var/log/auth.log::PH_IP_DAVE.*deleting connection.*with peer PH_IP_CAROL::YES
|
||||||
|
moon::cat /var/log/auth.log::PH_IP_DAVE.*IPsec SA established::YES
|
||||||
|
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
|
||||||
|
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||||
|
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
|
||||||
29
testing/tests/ikev1/dynamic-initiator/hosts/carol/etc/ipsec.conf
Executable file
29
testing/tests/ikev1/dynamic-initiator/hosts/carol/etc/ipsec.conf
Executable file
@ -0,0 +1,29 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn moon
|
||||||
|
left=%defaultroute
|
||||||
|
leftsourceip=PH_IP_CAROL1
|
||||||
|
leftcert=carolCert.pem
|
||||||
|
leftid=carol@strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
right=moon.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
rightid=@moon.strongswan.org
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
29
testing/tests/ikev1/dynamic-initiator/hosts/dave/etc/ipsec.conf
Executable file
29
testing/tests/ikev1/dynamic-initiator/hosts/dave/etc/ipsec.conf
Executable file
@ -0,0 +1,29 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn moon
|
||||||
|
left=%defaultroute
|
||||||
|
leftsourceip=PH_IP_CAROL1
|
||||||
|
leftcert=carolCert.pem
|
||||||
|
leftid=carol@strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
right=moon.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
rightid=@moon.strongswan.org
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -0,0 +1,25 @@
|
|||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||||
|
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||||
|
b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE
|
||||||
|
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
|
||||||
|
cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
|
||||||
|
AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX
|
||||||
|
T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl
|
||||||
|
vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii
|
||||||
|
S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW
|
||||||
|
LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM
|
||||||
|
YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC
|
||||||
|
MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD
|
||||||
|
j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
|
||||||
|
MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
|
||||||
|
EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
|
||||||
|
d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
|
||||||
|
b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI
|
||||||
|
U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM
|
||||||
|
2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE
|
||||||
|
HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd
|
||||||
|
hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG
|
||||||
|
C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK
|
||||||
|
omBYfxqp
|
||||||
|
-----END CERTIFICATE-----
|
||||||
@ -0,0 +1,30 @@
|
|||||||
|
-----BEGIN RSA PRIVATE KEY-----
|
||||||
|
Proc-Type: 4,ENCRYPTED
|
||||||
|
DEK-Info: DES-EDE3-CBC,1E1991A43D0778B7
|
||||||
|
|
||||||
|
MAsd1YBlHz54KjvBvhpwDBewinBkxBo/NmdsMetLIcV8Ag87YcKtTXYju+fbW21y
|
||||||
|
DI12iPDQeS9tk17tS8qE5ubWmx/8n0fa5VCdLZ06JK6eeASXNoomXZh5rGsd42It
|
||||||
|
sj0irWAnbIA3nFFWQl+Uz5pGZMse7aDSNyk1zs3xtywFIaditYIBsRhrTVmJ/bCK
|
||||||
|
waVr++S2pwUHJ/phKoZQ8pwgF5KtYOZxdNtYIzfOZNMoplESR3+WYBYSuW8BKuOc
|
||||||
|
QAign/BL2JVJLD4OpHQ68D8Su2sbh6ZYA5jslZLDgG9O7eiMbkCE+N8DmKO6wNAr
|
||||||
|
zB5ILb4u5dIyTqun32tOENEhpZqDdMQtZZ34fRBze4IoMx9LrEOAHdZAQyyERP80
|
||||||
|
iJCnH8BNf6FerA+XeDs4LVd1yrCklXKFINatqSRP/tNY3kruKw2Q7cAi2AFf+Rv6
|
||||||
|
1lrvwK4MiLSHFtzcgEJuxm2bxeceIwXLJ2AVlfLBJvK/yJlq0MPedFbl6E6UwKfw
|
||||||
|
cMLokF3sa1XrfwpJ93enGLqdpJrkR3dTzrsshjIhjQqfc8lqLwRlbMGc9u+V0ZsK
|
||||||
|
OJ8e26wc/4l5D7CQ1vmgT/R/tuydBtUskgH96anhNJj1M95odkoh4Zicmm5iLgy2
|
||||||
|
kluVYiEk0Fs7hc5Qtv8ZLN7ZoBRvZfJZWhXHDXmh71g1aoVYacIkFwiTMX4NoDy5
|
||||||
|
QVq9tFUZ1TW4VrNIzfq++rLoz4XlgVy0Yz8jNWKuB0KRuHPNSsQUY2NHkDX+wOjq
|
||||||
|
MP1SfNDxqPoqrmCqbgMw/9DmeOj9gyiTyjZhPZTxFOp67FYEYzYtR6bLQKEhdgf6
|
||||||
|
iOVROZyrFHMZdBiUgV8GECds1th6ZYWmNRGdvxYjSjExIYgkDrcWbowTqD0bFC9b
|
||||||
|
zClaSqrxR6GHUzbUVOBuCP+RmUx4j6gPvMRLUcIn5RmpbGtPE0ixeB5sFB0IuRRW
|
||||||
|
6u2YToCiuq3EG1iJRmxjnBa/zj1aBO6OlsE/aPc0Sx+Jhm+MUbDioxUAriX96bJ+
|
||||||
|
DEB4zgDhC0vIvkkUVAzQMkWPX479nPDmiZLpMqUIfqUh75WDpHbCladyGMgSkEo0
|
||||||
|
IKq96oAWHJC8WLH0UMxMNuf8Ut+TsSpIO6G0RPl/cx3+hQqSUC5oUB7R3ZAWYx+6
|
||||||
|
mawjkNJEx72yeJmQtGiZYEfeMt0Svm10PypMXFu0+2JjiS2eRj2K1yqrUnuL6AnY
|
||||||
|
GYYmTmR74dnVAd35bRYJjY1XHGC9MyqBn4jLqKZm1BKO3sFsctGDy6vybnvAgPD7
|
||||||
|
LioGQHPiOZmQe9Q5mMLedE9NAUCzlR8BHRbWtlnajQWcC0JcVu/mBQsjOt/KHh/V
|
||||||
|
CY4aFXE56lRH2OpqZQxFpBFOSFDcuVX+zcEBGmKfk65n2MFL4McAJUhVRZL561Zx
|
||||||
|
r9BvILv1Ld6/hECbodq0sUqvbDYHzv25zxAVKSIk1xy85mP5aNbk8xuGHmm860wg
|
||||||
|
YOqdePwBEcDHoio+ov/uFYB7+4gt40vV90EzSiyfdq8x9RFMViJU430IkIBcvByo
|
||||||
|
tFFcbN8ucBozxtl4AX495GVSRI7V0XXBtEdOIwJIzPBylZOHxCuTnA==
|
||||||
|
-----END RSA PRIVATE KEY-----
|
||||||
@ -0,0 +1,3 @@
|
|||||||
|
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||||
|
|
||||||
|
: RSA carolKey.pem "nH5ZQEWtku0RJEZ6"
|
||||||
26
testing/tests/ikev1/dynamic-initiator/hosts/moon/etc/ipsec.conf
Executable file
26
testing/tests/ikev1/dynamic-initiator/hosts/moon/etc/ipsec.conf
Executable file
@ -0,0 +1,26 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
left=%defaultroute
|
||||||
|
leftsubnet=10.1.0.0/16
|
||||||
|
leftsourceip=PH_IP_MOON1
|
||||||
|
leftcert=moonCert.pem
|
||||||
|
leftid=@moon.strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
|
||||||
|
conn carol
|
||||||
|
right=carol.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightid=carol@strongswan.org
|
||||||
|
rightsubnet=PH_IP_CAROL1/32
|
||||||
|
auto=add
|
||||||
11
testing/tests/ikev1/dynamic-initiator/posttest.dat
Normal file
11
testing/tests/ikev1/dynamic-initiator/posttest.dat
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
dave::ipsec stop
|
||||||
|
carol::ipsec stop
|
||||||
|
dave::sleep 1
|
||||||
|
moon::ipsec stop
|
||||||
|
moon::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
carol::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
dave::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
carol::ip addr del PH_IP_CAROL1/32 dev eth0
|
||||||
|
dave::ip addr del PH_IP_CAROL1/32 dev eth0
|
||||||
|
dave::rm /etc/ipsec.d/certs/*
|
||||||
|
dave::rm /etc/ipsec.d/private/*
|
||||||
13
testing/tests/ikev1/dynamic-initiator/pretest.dat
Normal file
13
testing/tests/ikev1/dynamic-initiator/pretest.dat
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
moon::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
carol::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
dave::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
carol::ipsec start
|
||||||
|
dave::ipsec start
|
||||||
|
moon::ipsec start
|
||||||
|
carol::sleep 2
|
||||||
|
carol::ipsec up moon
|
||||||
|
carol::sleep 1
|
||||||
|
carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||||
|
carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||||
|
dave::ipsec up moon
|
||||||
|
dave::sleep 1
|
||||||
21
testing/tests/ikev1/dynamic-initiator/test.conf
Normal file
21
testing/tests/ikev1/dynamic-initiator/test.conf
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# This configuration file provides information on the
|
||||||
|
# UML instances used for this test
|
||||||
|
|
||||||
|
# All UML instances that are required for this test
|
||||||
|
#
|
||||||
|
UMLHOSTS="alice moon carol winnetou dave"
|
||||||
|
|
||||||
|
# Corresponding block diagram
|
||||||
|
#
|
||||||
|
DIAGRAM="a-m-c-w-d.png"
|
||||||
|
|
||||||
|
# UML instances on which tcpdump is to be started
|
||||||
|
#
|
||||||
|
TCPDUMPHOSTS="moon alice"
|
||||||
|
|
||||||
|
# UML instances on which IPsec is started
|
||||||
|
# Used for IPsec logging purposes
|
||||||
|
#
|
||||||
|
IPSECHOSTS="moon carol dave"
|
||||||
13
testing/tests/ikev1/dynamic-responder/description.txt
Normal file
13
testing/tests/ikev1/dynamic-responder/description.txt
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
The peers <b>carol</b> and <b>moon</b> both have dynamic IP addresses, so that the remote end
|
||||||
|
is defined symbolically by <b>right=<hostname></b>. The ipsec starter resolves the
|
||||||
|
fully-qualified hostname into the current IP address via a DNS lookup (simulated by an
|
||||||
|
/etc/hosts entry). Since the peer IP addresses are expected to change over time, the option
|
||||||
|
<b>rightallowany=yes</b> will allow an IKE main mode rekeying to arrive from an arbitrary
|
||||||
|
IP address under the condition that the peer identity remains unchanged. When this happens
|
||||||
|
the old tunnel is replaced by an IPsec connection to the new origin.
|
||||||
|
<p>
|
||||||
|
In this scenario <b>moon</b> first initiates a tunnel to <b>carol</b>. After some time
|
||||||
|
the responder <b>carol</b> suddenly changes her IP address and restarts the connection to
|
||||||
|
<b>moon</b> without deleting the old tunnel first (simulated by iptables blocking IKE packets
|
||||||
|
to and from <b>carol</b> and starting the connection from host <b>dave</b> using
|
||||||
|
<b>carol</b>'s identity).
|
||||||
8
testing/tests/ikev1/dynamic-responder/evaltest.dat
Normal file
8
testing/tests/ikev1/dynamic-responder/evaltest.dat
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
carol::ipsec status::moon.*STATE_QUICK_R2.*IPsec SA established::YES
|
||||||
|
dave::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
|
||||||
|
moon::cat /var/log/auth.log::PH_IP_CAROL.*IPsec SA established::YES
|
||||||
|
moon::cat /var/log/auth.log::PH_IP_DAVE.*deleting connection.*with peer PH_IP_CAROL::YES
|
||||||
|
moon::cat /var/log/auth.log::PH_IP_DAVE.*IPsec SA established::YES
|
||||||
|
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
|
||||||
|
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||||
|
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
|
||||||
29
testing/tests/ikev1/dynamic-responder/hosts/carol/etc/ipsec.conf
Executable file
29
testing/tests/ikev1/dynamic-responder/hosts/carol/etc/ipsec.conf
Executable file
@ -0,0 +1,29 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn moon
|
||||||
|
left=%defaultroute
|
||||||
|
leftsourceip=PH_IP_CAROL1
|
||||||
|
leftcert=carolCert.pem
|
||||||
|
leftid=carol@strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
right=moon.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
rightid=@moon.strongswan.org
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
29
testing/tests/ikev1/dynamic-responder/hosts/dave/etc/ipsec.conf
Executable file
29
testing/tests/ikev1/dynamic-responder/hosts/dave/etc/ipsec.conf
Executable file
@ -0,0 +1,29 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn moon
|
||||||
|
left=%defaultroute
|
||||||
|
leftsourceip=PH_IP_CAROL1
|
||||||
|
leftcert=carolCert.pem
|
||||||
|
leftid=carol@strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
right=moon.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
rightid=@moon.strongswan.org
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -0,0 +1,25 @@
|
|||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||||
|
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||||
|
b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE
|
||||||
|
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
|
||||||
|
cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
|
||||||
|
AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX
|
||||||
|
T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl
|
||||||
|
vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii
|
||||||
|
S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW
|
||||||
|
LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM
|
||||||
|
YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC
|
||||||
|
MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD
|
||||||
|
j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
|
||||||
|
MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
|
||||||
|
EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
|
||||||
|
d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
|
||||||
|
b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI
|
||||||
|
U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM
|
||||||
|
2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE
|
||||||
|
HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd
|
||||||
|
hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG
|
||||||
|
C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK
|
||||||
|
omBYfxqp
|
||||||
|
-----END CERTIFICATE-----
|
||||||
@ -0,0 +1,30 @@
|
|||||||
|
-----BEGIN RSA PRIVATE KEY-----
|
||||||
|
Proc-Type: 4,ENCRYPTED
|
||||||
|
DEK-Info: DES-EDE3-CBC,1E1991A43D0778B7
|
||||||
|
|
||||||
|
MAsd1YBlHz54KjvBvhpwDBewinBkxBo/NmdsMetLIcV8Ag87YcKtTXYju+fbW21y
|
||||||
|
DI12iPDQeS9tk17tS8qE5ubWmx/8n0fa5VCdLZ06JK6eeASXNoomXZh5rGsd42It
|
||||||
|
sj0irWAnbIA3nFFWQl+Uz5pGZMse7aDSNyk1zs3xtywFIaditYIBsRhrTVmJ/bCK
|
||||||
|
waVr++S2pwUHJ/phKoZQ8pwgF5KtYOZxdNtYIzfOZNMoplESR3+WYBYSuW8BKuOc
|
||||||
|
QAign/BL2JVJLD4OpHQ68D8Su2sbh6ZYA5jslZLDgG9O7eiMbkCE+N8DmKO6wNAr
|
||||||
|
zB5ILb4u5dIyTqun32tOENEhpZqDdMQtZZ34fRBze4IoMx9LrEOAHdZAQyyERP80
|
||||||
|
iJCnH8BNf6FerA+XeDs4LVd1yrCklXKFINatqSRP/tNY3kruKw2Q7cAi2AFf+Rv6
|
||||||
|
1lrvwK4MiLSHFtzcgEJuxm2bxeceIwXLJ2AVlfLBJvK/yJlq0MPedFbl6E6UwKfw
|
||||||
|
cMLokF3sa1XrfwpJ93enGLqdpJrkR3dTzrsshjIhjQqfc8lqLwRlbMGc9u+V0ZsK
|
||||||
|
OJ8e26wc/4l5D7CQ1vmgT/R/tuydBtUskgH96anhNJj1M95odkoh4Zicmm5iLgy2
|
||||||
|
kluVYiEk0Fs7hc5Qtv8ZLN7ZoBRvZfJZWhXHDXmh71g1aoVYacIkFwiTMX4NoDy5
|
||||||
|
QVq9tFUZ1TW4VrNIzfq++rLoz4XlgVy0Yz8jNWKuB0KRuHPNSsQUY2NHkDX+wOjq
|
||||||
|
MP1SfNDxqPoqrmCqbgMw/9DmeOj9gyiTyjZhPZTxFOp67FYEYzYtR6bLQKEhdgf6
|
||||||
|
iOVROZyrFHMZdBiUgV8GECds1th6ZYWmNRGdvxYjSjExIYgkDrcWbowTqD0bFC9b
|
||||||
|
zClaSqrxR6GHUzbUVOBuCP+RmUx4j6gPvMRLUcIn5RmpbGtPE0ixeB5sFB0IuRRW
|
||||||
|
6u2YToCiuq3EG1iJRmxjnBa/zj1aBO6OlsE/aPc0Sx+Jhm+MUbDioxUAriX96bJ+
|
||||||
|
DEB4zgDhC0vIvkkUVAzQMkWPX479nPDmiZLpMqUIfqUh75WDpHbCladyGMgSkEo0
|
||||||
|
IKq96oAWHJC8WLH0UMxMNuf8Ut+TsSpIO6G0RPl/cx3+hQqSUC5oUB7R3ZAWYx+6
|
||||||
|
mawjkNJEx72yeJmQtGiZYEfeMt0Svm10PypMXFu0+2JjiS2eRj2K1yqrUnuL6AnY
|
||||||
|
GYYmTmR74dnVAd35bRYJjY1XHGC9MyqBn4jLqKZm1BKO3sFsctGDy6vybnvAgPD7
|
||||||
|
LioGQHPiOZmQe9Q5mMLedE9NAUCzlR8BHRbWtlnajQWcC0JcVu/mBQsjOt/KHh/V
|
||||||
|
CY4aFXE56lRH2OpqZQxFpBFOSFDcuVX+zcEBGmKfk65n2MFL4McAJUhVRZL561Zx
|
||||||
|
r9BvILv1Ld6/hECbodq0sUqvbDYHzv25zxAVKSIk1xy85mP5aNbk8xuGHmm860wg
|
||||||
|
YOqdePwBEcDHoio+ov/uFYB7+4gt40vV90EzSiyfdq8x9RFMViJU430IkIBcvByo
|
||||||
|
tFFcbN8ucBozxtl4AX495GVSRI7V0XXBtEdOIwJIzPBylZOHxCuTnA==
|
||||||
|
-----END RSA PRIVATE KEY-----
|
||||||
@ -0,0 +1,3 @@
|
|||||||
|
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||||
|
|
||||||
|
: RSA carolKey.pem "nH5ZQEWtku0RJEZ6"
|
||||||
26
testing/tests/ikev1/dynamic-responder/hosts/moon/etc/ipsec.conf
Executable file
26
testing/tests/ikev1/dynamic-responder/hosts/moon/etc/ipsec.conf
Executable file
@ -0,0 +1,26 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
left=%defaultroute
|
||||||
|
leftsubnet=10.1.0.0/16
|
||||||
|
leftsourceip=PH_IP_MOON1
|
||||||
|
leftcert=moonCert.pem
|
||||||
|
leftid=@moon.strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
|
||||||
|
conn carol
|
||||||
|
right=carol.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightid=carol@strongswan.org
|
||||||
|
rightsubnet=PH_IP_CAROL1/32
|
||||||
|
auto=add
|
||||||
11
testing/tests/ikev1/dynamic-responder/posttest.dat
Normal file
11
testing/tests/ikev1/dynamic-responder/posttest.dat
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
dave::ipsec stop
|
||||||
|
carol::ipsec stop
|
||||||
|
dave::sleep 1
|
||||||
|
moon::ipsec stop
|
||||||
|
moon::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
carol::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
dave::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
carol::ip addr del PH_IP_CAROL1/32 dev eth0
|
||||||
|
dave::ip addr del PH_IP_CAROL1/32 dev eth0
|
||||||
|
dave::rm /etc/ipsec.d/certs/*
|
||||||
|
dave::rm /etc/ipsec.d/private/*
|
||||||
13
testing/tests/ikev1/dynamic-responder/pretest.dat
Normal file
13
testing/tests/ikev1/dynamic-responder/pretest.dat
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
moon::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
carol::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
dave::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
carol::ipsec start
|
||||||
|
dave::ipsec start
|
||||||
|
moon::ipsec start
|
||||||
|
moon::sleep 2
|
||||||
|
moon::ipsec up carol
|
||||||
|
moon::sleep 1
|
||||||
|
carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||||
|
carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||||
|
dave::ipsec up moon
|
||||||
|
dave::sleep 1
|
||||||
21
testing/tests/ikev1/dynamic-responder/test.conf
Normal file
21
testing/tests/ikev1/dynamic-responder/test.conf
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# This configuration file provides information on the
|
||||||
|
# UML instances used for this test
|
||||||
|
|
||||||
|
# All UML instances that are required for this test
|
||||||
|
#
|
||||||
|
UMLHOSTS="alice moon carol winnetou dave"
|
||||||
|
|
||||||
|
# Corresponding block diagram
|
||||||
|
#
|
||||||
|
DIAGRAM="a-m-c-w-d.png"
|
||||||
|
|
||||||
|
# UML instances on which tcpdump is to be started
|
||||||
|
#
|
||||||
|
TCPDUMPHOSTS="moon alice"
|
||||||
|
|
||||||
|
# UML instances on which IPsec is started
|
||||||
|
# Used for IPsec logging purposes
|
||||||
|
#
|
||||||
|
IPSECHOSTS="moon carol dave"
|
||||||
15
testing/tests/ikev1/dynamic-two-peers/description.txt
Normal file
15
testing/tests/ikev1/dynamic-two-peers/description.txt
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
The peers <b>carol</b>, <b>dave</b>, and <b>moon</b> all have dynamic IP addresses,
|
||||||
|
so that the remote end is defined symbolically by <b>right=<hostname></b>.
|
||||||
|
The ipsec starter resolves the fully-qualified hostname into the current IP address
|
||||||
|
via a DNS lookup (simulated by an /etc/hosts entry). Since the peer IP addresses are
|
||||||
|
expected to change over time, the option <b>rightallowany=yes</b> will allow an IKE
|
||||||
|
main mode rekeying to arrive from an arbitrary IP address under the condition that
|
||||||
|
the peer identity remains unchanged. When this happens the old tunnel is replaced
|
||||||
|
by an IPsec connection to the new origin.
|
||||||
|
<p>
|
||||||
|
In this scenario both <b>carol</b> and <b>dave</b> initiate a tunnel to
|
||||||
|
<b>moon</b> which has a named connection definition for each peer. Although
|
||||||
|
the IP addresses of both <b>carol</b> and <b>dave</b> are stale, thanks to
|
||||||
|
the <b>rightallowany=yes</b> flag <b>moon</b> will accept the IKE negotiations
|
||||||
|
from the actual IP addresses.
|
||||||
|
|
||||||
10
testing/tests/ikev1/dynamic-two-peers/evaltest.dat
Normal file
10
testing/tests/ikev1/dynamic-two-peers/evaltest.dat
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
carol::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
|
||||||
|
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
|
||||||
|
dave::ipsec status::moon.*STATE_QUICK_I2.*IPsec SA established::YES
|
||||||
|
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
|
||||||
|
moon::ipsec status::carol.*STATE_QUICK_R2.*IPsec SA established::YES
|
||||||
|
moon::ipsec status::dave.*STATE_QUICK_R2.*IPsec SA established::YES
|
||||||
|
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||||
|
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
|
||||||
|
alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
|
||||||
|
alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES
|
||||||
29
testing/tests/ikev1/dynamic-two-peers/hosts/carol/etc/ipsec.conf
Executable file
29
testing/tests/ikev1/dynamic-two-peers/hosts/carol/etc/ipsec.conf
Executable file
@ -0,0 +1,29 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn moon
|
||||||
|
left=%defaultroute
|
||||||
|
leftsourceip=PH_IP_CAROL1
|
||||||
|
leftcert=carolCert.pem
|
||||||
|
leftid=carol@strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
right=moon.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
rightid=@moon.strongswan.org
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
29
testing/tests/ikev1/dynamic-two-peers/hosts/dave/etc/ipsec.conf
Executable file
29
testing/tests/ikev1/dynamic-two-peers/hosts/dave/etc/ipsec.conf
Executable file
@ -0,0 +1,29 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
|
||||||
|
conn moon
|
||||||
|
left=%defaultroute
|
||||||
|
leftsourceip=PH_IP_DAVE1
|
||||||
|
leftcert=daveCert.pem
|
||||||
|
leftid=dave@strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
right=moon.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightsubnet=10.1.0.0/16
|
||||||
|
rightid=@moon.strongswan.org
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -0,0 +1,67 @@
|
|||||||
|
# /etc/hosts: This file describes a number of hostname-to-address
|
||||||
|
# mappings for the TCP/IP subsystem. It is mostly
|
||||||
|
# used at boot time, when no name servers are running.
|
||||||
|
# On small systems, this file can be used instead of a
|
||||||
|
# "named" name server. Just add the names, addresses
|
||||||
|
# and any aliases to this file...
|
||||||
|
#
|
||||||
|
|
||||||
|
127.0.0.1 localhost
|
||||||
|
|
||||||
|
192.168.0.254 uml0.strongswan.org uml0
|
||||||
|
10.1.0.254 uml1.strongswan.org uml1
|
||||||
|
10.2.0.254 uml1.strongswan.org uml2
|
||||||
|
|
||||||
|
10.1.0.10 alice.strongswan.org alice
|
||||||
|
10.1.0.20 venus.strongswan.org venus
|
||||||
|
10.1.0.1 moon1.strongswan.org moon1
|
||||||
|
192.168.0.1 moon.strongswan.org moon
|
||||||
|
192.168.0.110 carol.strongswan.org carol
|
||||||
|
10.3.0.1 carol1.strongswan.org carol1
|
||||||
|
192.168.0.150 winnetou.strongswan.org winnetou crl.strongswan.org ocsp.strongswan.org ldap.strongswan.org
|
||||||
|
192.168.0.220 dave.strongswan.org dave
|
||||||
|
10.3.0.2 dave1.strongswan.org dave1
|
||||||
|
192.168.0.2 sun.strongswan.org sun
|
||||||
|
10.2.0.1 sun1.strongswan.org sun1
|
||||||
|
10.2.0.10 bob.strongswan.org bob
|
||||||
|
|
||||||
|
# IPv6 versions of localhost and co
|
||||||
|
::1 ip6-localhost ip6-loopback
|
||||||
|
fe00::0 ip6-localnet
|
||||||
|
ff00::0 ip6-mcastprefix
|
||||||
|
ff02::1 ip6-allnodes
|
||||||
|
ff02::2 ip6-allrouters
|
||||||
|
ff02::3 ip6-allhosts
|
||||||
|
|
||||||
|
# IPv6 solicited-node multicast addresses
|
||||||
|
ff02::1:ff00:1 ip6-mcast-1
|
||||||
|
ff02::1:ff00:2 ip6-mcast-2
|
||||||
|
ff02::1:ff00:10 ip6-mcast-10
|
||||||
|
ff02::1:ff00:15 ip6-mcast-15
|
||||||
|
ff02::1:ff00:20 ip6-mcast-20
|
||||||
|
|
||||||
|
# IPv6 site-local addresses
|
||||||
|
fec1::10 ip6-alice.strongswan.org ip6-alice
|
||||||
|
fec1::20 ip6-venus.strongswan.org ip6-venus
|
||||||
|
fec1::1 ip6-moon1.strongswan.org ip6-moon1
|
||||||
|
fec0::1 ip6-moon.strongswan.org ip6-moon
|
||||||
|
fec0::10 ip6-carol.strongswan.org ip6-carol
|
||||||
|
fec3::1 ip6-carol1.strongswan.org ip6-carol1
|
||||||
|
fec0::15 ip6-winnetou.strongswan.org ip6-winnetou
|
||||||
|
fec0::20 ip6-dave.strongswan.org ip6-dave
|
||||||
|
fec3::2 ip6-dave1.strongswan.org ip6-dave1
|
||||||
|
fec0::2 ip6-sun.strongswan.org ip6-sun
|
||||||
|
fec2::1 ip6-sun1.strongswan.org ip6-sun1
|
||||||
|
fec2::10 ip6-bob.strongswan.org ip6-bob
|
||||||
|
|
||||||
|
# IPv6 link-local HW derived addresses
|
||||||
|
fe80::fcfd:0aff:fe01:14 ip6-hw-venus.strongswan.org ip6-hw-venus
|
||||||
|
fe80::fcfd:0aff:fe01:0a ip6-hw-alice.strongswan.org ip6-hw-alice
|
||||||
|
fe80::fcfd:0aff:fe01:01 ip6-hw-moon1.strongswan.org ip6-hw-moon1
|
||||||
|
fe80::fcfd:c0ff:fea8:01 ip6-hw-moon.strongswan.org ip6-hw-moon
|
||||||
|
fe80::fcfd:c0ff:fea8:64 ip6-hw-carol.strongswan.org ip6-hw-carol
|
||||||
|
fe80::fcfd:c0ff:fea8:96 ip6-hw-winnetou.strongswan.org ip6-hw-winnetou
|
||||||
|
fe80::fcfd:c0ff:fea8:c8 ip6-hw-dave.strongswan.org ip6-hw-dave
|
||||||
|
fe80::fcfd:c0ff:fea8:02 ip6-hw-sun.strongswan.org ip6-hw-sun
|
||||||
|
fe80::fcfd:0aff:fe02:01 ip6-hw-sun1.strongswan.org ip6-hw-sun1
|
||||||
|
fe80::fcfd:0aff:fe02:0a ip6-hw-bob.strongswan.org ip6-hw-bob
|
||||||
33
testing/tests/ikev1/dynamic-two-peers/hosts/moon/etc/ipsec.conf
Executable file
33
testing/tests/ikev1/dynamic-two-peers/hosts/moon/etc/ipsec.conf
Executable file
@ -0,0 +1,33 @@
|
|||||||
|
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||||
|
|
||||||
|
config setup
|
||||||
|
plutodebug=control
|
||||||
|
crlcheckinterval=180
|
||||||
|
strictcrlpolicy=no
|
||||||
|
charonstart=no
|
||||||
|
|
||||||
|
conn %default
|
||||||
|
ikelifetime=60m
|
||||||
|
keylife=20m
|
||||||
|
rekeymargin=3m
|
||||||
|
keyingtries=1
|
||||||
|
left=%defaultroute
|
||||||
|
leftsubnet=10.1.0.0/16
|
||||||
|
leftsourceip=PH_IP_MOON1
|
||||||
|
leftcert=moonCert.pem
|
||||||
|
leftid=@moon.strongswan.org
|
||||||
|
leftfirewall=yes
|
||||||
|
|
||||||
|
conn carol
|
||||||
|
right=carol.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightid=carol@strongswan.org
|
||||||
|
rightsubnet=PH_IP_CAROL1/32
|
||||||
|
auto=add
|
||||||
|
|
||||||
|
conn dave
|
||||||
|
right=dave.strongswan.org
|
||||||
|
rightallowany=yes
|
||||||
|
rightid=dave@strongswan.org
|
||||||
|
rightsubnet=PH_IP_DAVE1/32
|
||||||
|
auto=add
|
||||||
10
testing/tests/ikev1/dynamic-two-peers/posttest.dat
Normal file
10
testing/tests/ikev1/dynamic-two-peers/posttest.dat
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
carol::ipsec stop
|
||||||
|
dave::ipsec stop
|
||||||
|
moon::sleep 1
|
||||||
|
moon::ipsec stop
|
||||||
|
moon::mv /etc/hosts.ori /etc/hosts
|
||||||
|
moon::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
carol::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
dave::/etc/init.d/iptables stop 2> /dev/null
|
||||||
|
carol::ip addr del PH_IP_CAROL1/32 dev eth0
|
||||||
|
dave::ip addr del PH_IP_DAVE1/32 dev eth0
|
||||||
12
testing/tests/ikev1/dynamic-two-peers/pretest.dat
Normal file
12
testing/tests/ikev1/dynamic-two-peers/pretest.dat
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
moon::mv /etc/hosts /etc/hosts.ori
|
||||||
|
moon::mv /etc/hosts.stale /etc/hosts
|
||||||
|
moon::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
carol::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
dave::/etc/init.d/iptables start 2> /dev/null
|
||||||
|
carol::ipsec start
|
||||||
|
dave::ipsec start
|
||||||
|
moon::ipsec start
|
||||||
|
carol::sleep 2
|
||||||
|
carol::ipsec up moon
|
||||||
|
dave::ipsec up moon
|
||||||
|
carol::sleep 1
|
||||||
21
testing/tests/ikev1/dynamic-two-peers/test.conf
Normal file
21
testing/tests/ikev1/dynamic-two-peers/test.conf
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# This configuration file provides information on the
|
||||||
|
# UML instances used for this test
|
||||||
|
|
||||||
|
# All UML instances that are required for this test
|
||||||
|
#
|
||||||
|
UMLHOSTS="alice moon carol winnetou dave"
|
||||||
|
|
||||||
|
# Corresponding block diagram
|
||||||
|
#
|
||||||
|
DIAGRAM="a-m-c-w-d.png"
|
||||||
|
|
||||||
|
# UML instances on which tcpdump is to be started
|
||||||
|
#
|
||||||
|
TCPDUMPHOSTS="moon alice"
|
||||||
|
|
||||||
|
# UML instances on which IPsec is started
|
||||||
|
# Used for IPsec logging purposes
|
||||||
|
#
|
||||||
|
IPSECHOSTS="moon carol dave"
|
||||||
Loading…
x
Reference in New Issue
Block a user