sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-06 00:00:47 -04:00
Code Issues Projects Releases Wiki Activity

testing: Added swanctl/dhcp-dynamic scenario

Browse Source
This commit is contained in:
Andreas Steffen 2016-02-03 12:10:59 +01:00
parent 3d15269af9
commit ac134b470a
15 changed files with 279 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
testing/tests/swanctl/dhcp-dynamic/description.txt Normal file
View File

@ -0,0 +1,8 @@
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
and request a <b>virtual IP</b> via the IKEv2 configuration payload by using the <b>leftsourceip=%config</b>
parameter. The <b>dhcp</b> plugin on gateway <b>moon</b> then requests an IP address and DNS server
information from DHCP server <b>venus</b> using the DHCP protocol. The IP addresses are assigned dynamically
by <b>venus</b> from the pool 10.1.0.50..10.1.0.60 so that <b>carol</b> and <b>dave</b> become full members
of the subnet 10.1.0.0/16 hidden behind gateway <b>moon</b>. And this thanks to the <b>farp</b> plugin
through which <b>moon</b> acts as a proxy for ARP requests e.g. from <b>alice</b> who wants to ping
<b>carol</b> and <b>dave</b>.

22
testing/tests/swanctl/dhcp-dynamic/evaltest.dat Normal file
View File

@ -0,0 +1,22 @@
alice::ping -c 1 10.1.0.50::64 bytes from 10.1.0.50: icmp_req=1::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
alice::ping -c 1 10.1.0.51::64 bytes from 10.1.0.51: icmp_req=1::YES
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.1.0.50] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.50/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-id=dave@strongswan.org remote-host=192.168.0.1 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*local-vips=\[10.1.0.51] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.51/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.1.0.50] child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.1.0.50/32]
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*remote-vips=\[10.1.0.51] child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.1.0.51/32]
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
alice::tcpdump::ARP, Reply carol3.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo reply::YES
alice::tcpdump::ARP, Reply dave3.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > dave3.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > dave3.strongswan.org: ICMP echo reply::YES

14
testing/tests/swanctl/dhcp-dynamic/hosts/carol/etc/strongswan.conf Executable file
View File

@ -0,0 +1,14 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey gmp curl kernel-netlink socket-default resolve updown vici
start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
}

28
testing/tests/swanctl/dhcp-dynamic/hosts/carol/etc/swanctl/swanctl.conf Executable file
View File

@ -0,0 +1,28 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
vips = 0.0.0.0
local {
auth = pubkey
certs = carolCert.pem
id = carol@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}

14
testing/tests/swanctl/dhcp-dynamic/hosts/dave/etc/strongswan.conf Executable file
View File

@ -0,0 +1,14 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon {
load = random nonce sha1 sha2 aes hmac pem pkcs1 x509 revocation constraints pubkey gmp curl kernel-netlink socket-default resolve updown vici
start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
}

28
testing/tests/swanctl/dhcp-dynamic/hosts/dave/etc/swanctl/swanctl.conf Executable file
View File

@ -0,0 +1,28 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
vips = 0.0.0.0
local {
auth = pubkey
certs = daveCert.pem
id = dave@strongswan.org
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}

9
testing/tests/swanctl/dhcp-dynamic/hosts/moon/etc/dhcpd.conf Normal file
View File

@ -0,0 +1,9 @@
subnet 10.1.0.0 netmask 255.255.0.0 {
option routers 10.1.0.1;
option broadcast-address 10.1.255.255;
option domain-name servers PH_IP_WINNETOU PH_IP_VENUS
option netbios-name-servers PH_IP_VENUS;
# dynamic address pool for visitors
range 10.1.0.30 10.1.0.50;
}

39
testing/tests/swanctl/dhcp-dynamic/hosts/moon/etc/iptables.rules Normal file
View File

@ -0,0 +1,39 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow bootpc and bootps
-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT
# allow broadcasts from eth1
-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
# allow esp
-A INPUT -i eth0 -p 50 -j ACCEPT
-A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
# allow crl fetch from winnetou
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# log dropped packets
-A INPUT -j LOG --log-prefix " IN: "
-A OUTPUT -j LOG --log-prefix " OUT: "
COMMIT

20
testing/tests/swanctl/dhcp-dynamic/hosts/moon/etc/strongswan.conf Executable file
View File

@ -0,0 +1,20 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 x509 revocation constraints pubkey openssl random
}
charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown attr farp dhcp
start-scripts {
creds = /usr/local/sbin/swanctl --load-creds
conns = /usr/local/sbin/swanctl --load-conns
}
plugins {
dhcp {
server = 10.1.255.255
}
}
}

26
testing/tests/swanctl/dhcp-dynamic/hosts/moon/etc/swanctl/swanctl.conf Executable file
View File

@ -0,0 +1,26 @@
connections {
rw {
local_addrs = 192.168.0.1
pools = dhcp
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}

14
testing/tests/swanctl/dhcp-dynamic/hosts/venus/etc/dhcp/dhcpd.conf Normal file
View File

@ -0,0 +1,14 @@
# dhcpd configuration file
ddns-update-style none;
subnet 10.1.0.0 netmask 255.255.0.0 {
option domain-name "strongswan.org";
option domain-name-servers PH_IP_VENUS;
option netbios-name-servers PH_IP_ALICE;
option routers PH_IP_MOON1;
option broadcast-address 10.1.255.255;
next-server PH_IP_VENUS;
range 10.1.0.50 10.1.0.60;
}

7
testing/tests/swanctl/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf Normal file
View File

@ -0,0 +1,7 @@
interface=eth0
dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255
dhcp-option=option:router,PH_IP_MOON1
dhcp-option=option:dns-server,PH_IP_VENUS
dhcp-option=option:netbios-ns,PH_IP_ALICE
dhcp-option=option:domain-name,strongswan.org
log-dhcp

12
testing/tests/swanctl/dhcp-dynamic/posttest.dat Normal file
View File

@ -0,0 +1,12 @@
carol::swanctl --terminate --ike home
dave::swanctl --terminate --ike home
carol::service charon stop 2> /dev/null
dave::service charon stop 2> /dev/null
moon::service charon stop 2> /dev/null
venus::cat /var/state/dhcp/dhcpd.leases
venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
alice::arp -d 10.1.0.50
alice::arp -d 10.1.0.51

13
testing/tests/swanctl/dhcp-dynamic/pretest.dat Normal file
View File

@ -0,0 +1,13 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
venus::cat /etc/dhcp/dhcpd.conf
venus::/etc/init.d/isc-dhcp-server start 2> /dev/null
moon::service charon start 2> /dev/null
carol::service charon start 2> /dev/null
dave::service charon start 2> /dev/null
moon::expect-connection rw
carol::expect-connection home
carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home
dave::swanctl --initiate --child home 2> /dev/null

25
testing/tests/swanctl/dhcp-dynamic/test.conf Normal file
View File

@ -0,0 +1,25 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
# charon controlled by swanctl
#
SWANCTL=1