mirror of
https://github.com/strongswan/strongswan.git
synced 2025-10-06 00:00:47 -04:00
testing: Added route-based/rw-shared-vti-ip6-in-ip4 scenario
This commit is contained in:
Robin McCorkell
Tobias Brunner
parent
a35416af1c
commit
ff7129ee6a
@ -0,0 +1,11 @@
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up an IPv6-in-IPv4 connection each to
|
||||
gateway <b>moon</b>. Both <b>carol</b> and <b>dave</b> request an IPv6 <b>virtual
|
||||
IP</b> via the IKEv2 configuration payload.
|
||||
<p/>
|
||||
The gateway <b>moon</b> uses <b>route-based forwarding</b> with <b>VTI
|
||||
tunnels</b>, with firewall rules to allow traffic to pass. The IKE daemon is
|
||||
configured to not install routes with <em>charon.install_routes=0</em>, and a
|
||||
static route is installed for the IPv6 virtual IP subnet on the VTI device.
|
||||
<p/>
|
||||
Both <b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the
|
||||
gateway <b>moon</b>.
|
||||
@ -0,0 +1,10 @@
|
||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=PH_IP_CAROL local-port=4500 local-id=carol@strongswan.org remote-host=PH_IP_MOON remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*local-vips=\[fec3:\:1] child-sas.*home.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*local-ts=\[fec3:\:1/128] remote-ts=\[fec1:\:/16]::YES
|
||||
dave::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=PH_IP_DAVE local-port=4500 local-id=dave@strongswan.org remote-host=PH_IP_MOON remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*local-vips=\[fec3:\:2] child-sas.*home.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*local-ts=\[fec3:\:2/128] remote-ts=\[fec1:\:/16]::YES
|
||||
moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=PH_IP_MOON local-port=4500 local-id=moon.strongswan.org remote-host=PH_IP_CAROL remote-port=4500 remote-id=carol@strongswan.org.*remote-vips=\[fec3:\:1] child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*local-ts=\[fec1:\:/16] remote-ts=\[fec3:\:1/128]::YES
|
||||
moon::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=PH_IP_MOON local-port=4500 local-id=moon.strongswan.org remote-host=PH_IP_DAVE remote-port=4500 remote-id=dave@strongswan.org.*remote-vips=\[fec3:\:2] child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL protocol=ESP.*local-ts=\[fec1:\:/16] remote-ts=\[fec3:\:2/128]::YES
|
||||
carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES
|
||||
dave:: ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES
|
||||
moon::tcpdump::carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::moon.strongswan.org > dave.strongswan.org: ESP::YES
|
||||
@ -0,0 +1,20 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow ICMPv6 neighbor-solicitations
|
||||
-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
||||
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
||||
|
||||
# allow ICMPv6 neighbor-advertisements
|
||||
-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
||||
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
||||
|
||||
# log dropped packets
|
||||
-A INPUT -j LOG --log-prefix " IN: "
|
||||
-A OUTPUT -j LOG --log-prefix " OUT: "
|
||||
|
||||
COMMIT
|
||||
@ -0,0 +1,9 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 revocation constraints pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
|
||||
}
|
||||
@ -0,0 +1,28 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = PH_IP_CAROL
|
||||
remote_addrs = PH_IP_MOON
|
||||
vips = ::
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = carol@strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = fec1::/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,20 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow ICMPv6 neighbor-solicitations
|
||||
-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
||||
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
||||
|
||||
# allow ICMPv6 neighbor-advertisements
|
||||
-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
||||
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
||||
|
||||
# log dropped packets
|
||||
-A INPUT -j LOG --log-prefix " IN: "
|
||||
-A OUTPUT -j LOG --log-prefix " OUT: "
|
||||
|
||||
COMMIT
|
||||
@ -0,0 +1,9 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 revocation constraints pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 hmac pem pkcs1 x509 revocation curve25519 gmp curl kernel-netlink socket-default updown vici
|
||||
}
|
||||
@ -0,0 +1,28 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = PH_IP_DAVE
|
||||
remote_addrs = PH_IP_MOON
|
||||
vips = ::
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = daveCert.pem
|
||||
id = dave@strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = fec1::/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,20 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow ICMPv6 neighbor-solicitations
|
||||
-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
||||
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
||||
|
||||
# allow ICMPv6 neighbor-advertisements
|
||||
-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
||||
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
||||
|
||||
# log dropped packets
|
||||
-A INPUT -j LOG --log-prefix " IN: "
|
||||
-A OUTPUT -j LOG --log-prefix " OUT: "
|
||||
|
||||
COMMIT
|
||||
@ -0,0 +1,13 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
swanctl {
|
||||
load = pem pkcs1 x509 revocation constraints pubkey openssl random
|
||||
}
|
||||
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
|
||||
}
|
||||
|
||||
charon {
|
||||
install_routes = 0
|
||||
}
|
||||
@ -0,0 +1,33 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = PH_IP_MOON
|
||||
pools = rw_pool
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = moonCert.pem
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
}
|
||||
children {
|
||||
net {
|
||||
local_ts = fec1::/16
|
||||
mark_in = 42
|
||||
mark_out = 42
|
||||
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
|
||||
pools {
|
||||
rw_pool {
|
||||
addrs = fec3::/120
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,13 @@
|
||||
carol::swanctl --terminate --ike home
|
||||
dave::swanctl --terminate --ike home
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
moon::ip6tables-restore < /etc/iptables.flush
|
||||
carol::ip6tables-restore < /etc/iptables.flush
|
||||
dave::ip6tables-restore < /etc/iptables.flush
|
||||
moon::ip tunnel del vti0
|
||||
alice::"ip route del fec3:\:/16 via fec1:\:1"
|
||||
@ -0,0 +1,21 @@
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::ip6tables-restore < /etc/ip6tables.rules
|
||||
carol::ip6tables-restore < /etc/ip6tables.rules
|
||||
dave::ip6tables-restore < /etc/ip6tables.rules
|
||||
alice::"ip route add fec3:\:/16 via fec1:\:1"
|
||||
moon::ip tunnel add vti0 local PH_IP_MOON remote 0.0.0.0 mode vti key 42
|
||||
moon::sysctl -w net.ipv4.conf.vti0.disable_policy=1
|
||||
moon::ip link set vti0 up
|
||||
moon::"ip route add fec3:\:/16 dev vti0"
|
||||
moon::ip6tables -A FORWARD -i vti0 -j ACCEPT
|
||||
moon::ip6tables -A FORWARD -o vti0 -j ACCEPT
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home
|
||||
dave::expect-connection home
|
||||
dave::swanctl --initiate --child home
|
||||
29
testing/tests/route-based/rw-shared-vti-ip6-in-ip4/test.conf
Normal file
29
testing/tests/route-based/rw-shared-vti-ip6-in-ip4/test.conf
Normal file
@ -0,0 +1,29 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou dave"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w-d-ip6.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol dave"
|
||||
|
||||
# IP protocol used by IPsec is IPv6
|
||||
#
|
||||
IPV6=1
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
Loading…
x
Reference in New Issue
Block a user