sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-05 00:00:45 -04:00
Code Issues Projects Releases Wiki Activity

added behind-same-nat p2p scenario

Browse Source
This commit is contained in:
Andreas Steffen 2007-12-19 17:55:08 +00:00
parent aa1a730bfb
commit 8a4e5a957e
14 changed files with 415 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
testing/tests/p2pnat/behind-same-nat/description.txt Normal file
View File

@ -0,0 +1,6 @@
The peers <b>alice</b> and <b>venus</b> are hidden behind the same NAT router <b>moon</b>
but both are not aware of this fact. Thus they try to resolve the apparent double-NAT
situation with the help of the mediation server <b>carol</b> where they register under
the pseudonyms <b>6cu1UTVw@medsrv.org</b> and <b>F1ubAio8@medsrv.org</b>, respectively.
Based on the set of endpoints relayed to them by the mediation server, the peers find out
that they can communicate directly with each other without a NAT router in between.

11
testing/tests/p2pnat/behind-same-nat/evaltest.dat Normal file
View File

@ -0,0 +1,11 @@
alice::ipsec statusall::medsrv.*ESTABLISHED::YES
venus::ipsec statusall::medsrv.*ESTABLISHED::YES
carol::ipsec statusall::medsrv.*ESTABLISHED.*PH_IP_MOON.*6cu1UTVw@medsrv.org::YES
carol::ipsec statusall::medsrv.*ESTABLISHED.*PH_IP_MOON.*F1ubAio8@medsrv.org::YES
alice::cat /var/log/daemon.log::received P2P_CALLBACK::YES
alice::ipsec statusall::p2p.*ESTABLISHED::YES
venus::ipsec statusall::p2p.*ESTABLISHED::YES
alice::ipsec statusall::p2p.*INSTALLED::YES
venus::ipsec statusall::p2p.*INSTALLED::YES
alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
venus::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES

78
testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables Executable file
View File

@ -0,0 +1,78 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow NAT-T including P2P
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}

36
testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/ipsec.conf Executable file
View File

@ -0,0 +1,36 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
dpdaction=restart
dpddelay=60s
left=%defaultroute
leftfirewall=yes
conn medsrv
leftid=6cu1UTVw@medsrv.org
right=PH_IP_CAROL
rightid=carol@strongswan.org
p2p_mediation=yes
authby=psk
auto=add
conn p2p
leftcert=aliceCert.pem
leftid=alice@strongswan.org
right=%any
rightid=@venus.strongswan.org
rightsubnet=PH_IP_VENUS/32
p2p_mediated_by=medsrv
p2p_peerid=F1ubAio8@medsrv.org
auto=start

7
testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/ipsec.secrets Normal file
View File

@ -0,0 +1,7 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
: RSA aliceKey.pem
# secret used for mediation connection
6cu1UTVw@medsrv.org : PSK "BAXz/6cSITttd0CzF9799p859Pi4LPnP"

77
testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables Executable file
View File

@ -0,0 +1,77 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE behind NAT
iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}

25
testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/ipsec.conf Executable file
View File

@ -0,0 +1,25 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
dpdaction=clear
dpddelay=60s
conn medsrv
left=PH_IP_CAROL
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
right=%any
p2p_mediation=yes
auto=add

11
testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/ipsec.secrets Normal file
View File

@ -0,0 +1,11 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
: RSA carolKey.pem "nH5ZQEWtku0RJEZ6"
# Mediation clients with random IDs
6cu1UTVw@medsrv.org : PSK "BAXz/6cSITttd0CzF9799p859Pi4LPnP"
F1ubAio8@medsrv.org : PSK "9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8"
av9oEPMz@medsrv.org : PSK "ZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt"

78
testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables Executable file
View File

@ -0,0 +1,78 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow NAT-T including P2P
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}

36
testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/ipsec.conf Executable file
View File

@ -0,0 +1,36 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
dpdaction=restart
dpddelay=60s
left=%defaultroute
leftfirewall=yes
conn medsrv
leftid=F1ubAio8@medsrv.org
right=PH_IP_CAROL
rightid=carol@strongswan.org
authby=psk
p2p_mediation=yes
auto=start
conn p2p
leftcert=venusCert.pem
leftid=@venus.strongswan.org
right=%any
rightid=alice@strongswan.org
rightsubnet=PH_IP_ALICE/32
p2p_mediated_by=medsrv
p2p_peerid=6cu1UTVw@medsrv.org
auto=add

7
testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/ipsec.secrets Normal file
View File

@ -0,0 +1,7 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
: RSA venusKey.pem
# secret used for mediation connection
F1ubAio8@medsrv.org : PSK "9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8"

8
testing/tests/p2pnat/behind-same-nat/posttest.dat Normal file
View File

@ -0,0 +1,8 @@
venus::ipsec stop
alice::ipsec stop
carol::ipsec stop
alice::/etc/init.d/iptables stop 2> /dev/null
moon::/etc/init.d/iptables stop 2> /dev/null
carol::/etc/init.d/iptables stop 2> /dev/null
venus::/etc/init.d/iptables stop 2> /dev/null
moon::conntrack -F

14
testing/tests/p2pnat/behind-same-nat/pretest.dat Normal file
View File

@ -0,0 +1,14 @@
alice::/etc/init.d/iptables start 2> /dev/null
venus::/etc/init.d/iptables start 2> /dev/null
moon::/etc/init.d/iptables start 2> /dev/null
carol::/etc/init.d/iptables start 2> /dev/null
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
moon::iptables -A FORWARD -i eth0 -o eth1 -d 10.1.0.0/16 -j ACCEPT
carol::ipsec start
carol::sleep 1
alice::ipsec start
alice::sleep 1
venus::ipsec start
venus::sleep 2

21
testing/tests/p2pnat/behind-same-nat/test.conf Normal file
View File

@ -0,0 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
# UML instances used for this test
# All UML instances that are required for this test
#
UMLHOSTS="alice venus moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-med.png"
# UML instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# UML instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus carol"