mirror of
https://github.com/strongswan/strongswan.git
synced 2025-10-03 00:00:24 -04:00
testing: Add ha/active-passive-multi-ke scenario
This commit is contained in:
Jean-François Hren
Tobias Brunner
parent
e7848e36fa
commit
fd6ac87fc3
@ -733,8 +733,8 @@ mkdir -p ${TEST}/hosts/alice/${SWANCTL_DIR}/x509
|
||||
cp ${TEST_KEY} ${TEST}/hosts/alice/${SWANCTL_DIR}/rsa
|
||||
cp ${TEST_CERT} ${TEST}/hosts/alice/${SWANCTL_DIR}/x509
|
||||
|
||||
# Put a copy into the ha/active-passive and swanctl/redirect-active scenarios
|
||||
for t in ha/active-passive ikev2/redirect-active
|
||||
# Put a copy into the ha/active-passive, ha/active-passive-multi-ke and swanctl/redirect-active scenarios
|
||||
for t in ha/active-passive ha/active-passive-multi-ke ikev2/redirect-active
|
||||
do
|
||||
TEST="${TEST_DIR}/${t}"
|
||||
for h in alice moon
|
||||
|
||||
8
testing/tests/ha/active-passive-multi-ke/description.txt
Normal file
8
testing/tests/ha/active-passive-multi-ke/description.txt
Normal file
@ -0,0 +1,8 @@
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each using
|
||||
multiple key exchanges to the virtual gateway <b>mars</b> implemented by the
|
||||
two real gateways <b>alice</b> and <b>moon</b> in a <b>High Availability</b>
|
||||
(HA) setup based on <b>ClusterIP</b>. The HA synchronization link between the
|
||||
two gateways is secured by an IPsec transport connection. At the outset
|
||||
<b>alice</b> is the active and <b>moon</b> is the passive gateway.
|
||||
After <b>alice</b> gets killed <b>moon</b> automatically takes over
|
||||
all existing IKE_SAs and CHILD_SAs.
|
||||
34
testing/tests/ha/active-passive-multi-ke/evaltest.dat
Normal file
34
testing/tests/ha/active-passive-multi-ke/evaltest.dat
Normal file
@ -0,0 +1,34 @@
|
||||
alice::cat /var/log/daemon.log::HA segment 1 was not handled, taking::YES
|
||||
moon:: cat /var/log/daemon.log::remote node takes segment 1::YES
|
||||
alice::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=500 local-id=10.1.0.10 remote-host=10.1.0.1 remote-port=500 remote-id=10.1.0.1.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]] remote-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]]::YES
|
||||
alice::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=500 local-id=10.1.0.10 remote-host=10.1.0.1 remote-port=500 remote-id=10.1.0.1.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]] remote-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]]::YES
|
||||
alice::swanctl --list-sas --ike-id 3 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 ake1=MODP_4096 ake3=ML_KEM_768.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
alice::swanctl --list-sas --ike-id 4 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 ake1=MODP_4096.*child-sas.*net.*reqid=3 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
|
||||
moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
|
||||
moon::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
|
||||
moon ::swanctl --list-sas --ike-id 3 --raw 2> /dev/null::rw.*version=2 state=PASSIVE local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 ake1=MODP_4096 ake3=ML_KEM_768.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
moon ::swanctl --list-sas --ike-id 4 --raw 2> /dev/null::rw.*version=2 state=PASSIVE local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 ake1=MODP_4096.*child-sas.*net.*reqid=3 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.5 remote-port=4500 remote-id=mars.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 ake1=MODP_4096.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=dave@strongswan.org remote-host=192.168.0.5 remote-port=4500 remote-id=mars.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 ake1=MODP_4096.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
alice::cat /var/log/daemon.log::HA segment 1 activated::YES
|
||||
alice::cat /var/log/daemon.log::handling HA CHILD_SA::YES
|
||||
moon:: cat /var/log/daemon.log::installed HA CHILD_SA::YES
|
||||
carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
||||
alice::ip xfrm policy flush::no output expected::NO
|
||||
alice::ip xfrm state flush::no output expected::NO
|
||||
alice::systemctl kill -s SIGKILL strongswan::no output expected::NO
|
||||
carol::sleep 2::no output expected::NO
|
||||
moon:: cat /var/log/daemon.log::no heartbeat received, taking all segments::YES
|
||||
moon ::swanctl --list-sas --ike-id 3 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 ake1=MODP_4096.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
moon ::swanctl --list-sas --ike-id 4 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 ake1=MODP_4096.*child-sas.*net.*reqid=3 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
|
||||
carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
||||
carol::tcpdump::IP carol.strongswan.org > mars.strongswan.org: ESP::YES
|
||||
carol::tcpdump::IP mars.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
dave::tcpdump::IP dave.strongswan.org > mars.strongswan.org: ESP::YES
|
||||
dave::tcpdump::IP mars.strongswan.org > dave.strongswan.org: ESP::YES
|
||||
venus::tcpdump::IP carol.strongswan.org > venus.strongswan.org: ICMP echo request::YES
|
||||
venus::tcpdump::IP venus.strongswan.org > carol.strongswan.org: ICMP echo reply::YES
|
||||
venus::tcpdump::IP dave.strongswan.org > venus.strongswan.org: ICMP echo request::YES
|
||||
venus::tcpdump::IP venus.strongswan.org > dave.strongswan.org: ICMP echo reply::YES
|
||||
@ -0,0 +1,57 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# forward ESP-tunneled traffic
|
||||
-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT
|
||||
-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT
|
||||
-A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
||||
|
||||
# clusterip rules
|
||||
-A INPUT -i eth1 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:c0:a8:00:05 --total-nodes 1 --local-node 0
|
||||
-A INPUT -i eth0 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:0a:01:00:05 --total-nodes 1 --local-node 0
|
||||
|
||||
# allow esp
|
||||
-A INPUT -p 50 -j ACCEPT
|
||||
-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT
|
||||
-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT
|
||||
|
||||
# allow esp on internal interface
|
||||
-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p 50 -j ACCEPT
|
||||
|
||||
# allow IKE on internal interface
|
||||
-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow heartbeat
|
||||
-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT
|
||||
|
||||
# allow ICMP type 3
|
||||
-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT
|
||||
|
||||
# allow IGMP multicasts
|
||||
-A INPUT -d 224.0.0.1 -p igmp -j ACCEPT
|
||||
-A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
COMMIT
|
||||
@ -0,0 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default ha ml
|
||||
|
||||
plugins {
|
||||
ha {
|
||||
local = PH_IP_ALICE
|
||||
remote = PH_IP_MOON1
|
||||
secret = PliyxREnfoPaSXDJx1NrlH0kkKXT/LWZ
|
||||
segment_count = 1
|
||||
fifo_interface = yes
|
||||
monitor = yes
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -0,0 +1,25 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.5
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = marsCert.pem
|
||||
id = mars.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519-ke1_modp4096-ke3_mlkem768-ke3_none
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519-ke1_modp4096-ke3_mlkem768-ke3_none
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown ml
|
||||
}
|
||||
@ -0,0 +1,27 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.5
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = carol@strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = mars.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519-ke1_modp4096-ke3_mlkem768
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519-ke1_modp4096-ke3_mlkem768
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,6 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
|
||||
}
|
||||
|
||||
27
testing/tests/ha/active-passive-multi-ke/hosts/dave/etc/swanctl/swanctl.conf
Executable file
27
testing/tests/ha/active-passive-multi-ke/hosts/dave/etc/swanctl/swanctl.conf
Executable file
@ -0,0 +1,27 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.200
|
||||
remote_addrs = 192.168.0.5
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = daveCert.pem
|
||||
id = dave@strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = mars.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519-ke1_modp4096
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519-ke1_modp4096
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,57 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# forward ESP-tunneled traffic
|
||||
-A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT
|
||||
-A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT
|
||||
-A FORWARD -m policy -o eth0 --dir out --pol ipsec --proto esp -j ACCEPT
|
||||
|
||||
# clusterip rules
|
||||
-A INPUT -i eth0 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:c0:a8:00:05 --total-nodes 1 --local-node 0
|
||||
-A INPUT -i eth1 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:0a:01:00:05 --total-nodes 1 --local-node 0
|
||||
|
||||
# allow esp
|
||||
-A INPUT -p 50 -j ACCEPT
|
||||
-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT
|
||||
-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT
|
||||
|
||||
# allow esp on internal interface
|
||||
-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p 50 -j ACCEPT
|
||||
|
||||
# allow IKE on internal interface
|
||||
-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow heartbeat
|
||||
-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT
|
||||
-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT
|
||||
|
||||
# allow ICMP type 3
|
||||
-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT
|
||||
-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT
|
||||
|
||||
# allow IGMP multicasts
|
||||
-A INPUT -d 224.0.0.1 -p igmp -j ACCEPT
|
||||
-A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
COMMIT
|
||||
@ -0,0 +1,16 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default ha ml
|
||||
|
||||
plugins {
|
||||
ha {
|
||||
local = PH_IP_MOON1
|
||||
remote = PH_IP_ALICE
|
||||
secret = PliyxREnfoPaSXDJx1NrlH0kkKXT/LWZ
|
||||
segment_count = 1
|
||||
fifo_interface = yes
|
||||
monitor = yes
|
||||
}
|
||||
}
|
||||
}
|
||||
25
testing/tests/ha/active-passive-multi-ke/hosts/moon/etc/swanctl/swanctl.conf
Executable file
25
testing/tests/ha/active-passive-multi-ke/hosts/moon/etc/swanctl/swanctl.conf
Executable file
@ -0,0 +1,25 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.5
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = marsCert.pem
|
||||
id = mars.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519-ke1_modp4096-ke3_mlkem768-ke3_none
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519-ke1_modp4096-ke3_mlkem768-ke3_none
|
||||
}
|
||||
}
|
||||
22
testing/tests/ha/active-passive-multi-ke/posttest.dat
Normal file
22
testing/tests/ha/active-passive-multi-ke/posttest.dat
Normal file
@ -0,0 +1,22 @@
|
||||
carol::systemctl stop strongswan
|
||||
dave::systemctl stop strongswan
|
||||
moon::ip xfrm policy flush::no output expected::NO
|
||||
moon::ip xfrm state flush::no output expected::NO
|
||||
moon::systemctl kill -s SIGKILL strongswan::no output expected::NO
|
||||
moon::cd /etc/swanctl; rm rsa/marsKey.pem x509/marsCert.pem
|
||||
alice::cd /etc/swanctl; rm rsa/marsKey.pem x509/marsCert.pem
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
moon::ip addr del 192.168.0.5/24 dev eth0
|
||||
moon::ip addr del 10.1.0.5/16 dev eth1
|
||||
alice::ip addr del 192.168.0.5/24 dev eth1
|
||||
alice::ip addr del 10.1.0.5/16 dev eth0
|
||||
alice::ifdown eth1
|
||||
venus::ip route del default via 10.1.0.5 dev eth0
|
||||
venus::ip route add default via 10.1.0.1 dev eth0
|
||||
alice::sed -i s/Restart=no/Restart=on-abnormal/ /lib/systemd/system/strongswan.service
|
||||
alice::systemctl daemon-reload
|
||||
moon::sed -i s/Restart=no/Restart=on-abnormal/ /lib/systemd/system/strongswan.service
|
||||
moon::systemctl daemon-reload
|
||||
27
testing/tests/ha/active-passive-multi-ke/pretest.dat
Normal file
27
testing/tests/ha/active-passive-multi-ke/pretest.dat
Normal file
@ -0,0 +1,27 @@
|
||||
alice::sed -i s/Restart=on-abnormal/Restart=no/ /lib/systemd/system/strongswan.service
|
||||
alice::systemctl daemon-reload
|
||||
moon::sed -i s/Restart=on-abnormal/Restart=no/ /lib/systemd/system/strongswan.service
|
||||
moon::systemctl daemon-reload
|
||||
moon::ip addr add 192.168.0.5/24 dev eth0
|
||||
moon::ip addr add 10.1.0.5/16 dev eth1
|
||||
alice::ifup eth1
|
||||
alice::ip addr add 192.168.0.5/24 dev eth1
|
||||
alice::ip addr add 10.1.0.5/16 dev eth0
|
||||
venus::ip route del default via 10.1.0.1 dev eth0
|
||||
venus::ip route add default via 10.1.0.5 dev eth0
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
alice::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::cd /etc/swanctl; rm rsa/moonKey.pem x509/moonCert.pem
|
||||
alice::cd /etc/swanctl; rm rsa/aliceKey.pem x509/aliceCert.pem
|
||||
moon::systemctl start strongswan
|
||||
alice::systemctl start strongswan
|
||||
moon::sleep 2
|
||||
alice::echo "+1" > /var/run/charon.ha
|
||||
carol::systemctl start strongswan
|
||||
dave::systemctl start strongswan
|
||||
carol::expect-connection home
|
||||
dave::expect-connection home
|
||||
carol::swanctl --initiate --child home
|
||||
dave::swanctl --initiate --child home
|
||||
25
testing/tests/ha/active-passive-multi-ke/test.conf
Normal file
25
testing/tests/ha/active-passive-multi-ke/test.conf
Normal file
@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice venus moon carol winnetou dave"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-v-m-c-w-d.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="venus carol dave"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="alice moon carol dave"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
@ -5,7 +5,7 @@ alice::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::ha.*version=2 state=EST
|
||||
alice::swanctl --list-sas --ike-id 3 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
alice::swanctl --list-sas --ike-id 4 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=3 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
|
||||
moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
|
||||
moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
|
||||
moon::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
|
||||
moon ::swanctl --list-sas --ike-id 3 --raw 2> /dev/null::rw.*version=2 state=PASSIVE local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
||||
moon ::swanctl --list-sas --ike-id 4 --raw 2> /dev/null::rw.*version=2 state=PASSIVE local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=3 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.5 remote-port=4500 remote-id=mars.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user