mirror of
https://github.com/strongswan/strongswan.git
synced 2025-10-04 00:00:14 -04:00
3b2f8cf282
Basically the same as the one without UDP encapsulation, but here the outbound SAs use random source ports.
81 lines
8.3 KiB
Plaintext
Executable File
81 lines
8.3 KiB
Plaintext
Executable File
moon::swanctl --list-pols --raw 2> /dev/null::net-net.*mode=TUNNEL local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
|
|
moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8]::YES
|
|
moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8].*cpu::NO
|
|
moon::swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*per-cpu-sas=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
|
|
sun:: swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*per-cpu-sas=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
|
|
# this triggers a per-CPU SA for CPU 1 and creates one for CPU 3 as responder,
|
|
# the packet is sent and received via fallback SA
|
|
moon::taskset -c 1 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8].*cpu {1}::YES
|
|
moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=0::YES
|
|
moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=0.*packets-out=0::YES
|
|
# this takes the per-CPU SA created above, the response most likely the one
|
|
# created as responder
|
|
moon::taskset -c 1 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=1.*packets-out=0::YES
|
|
# trigger another SA for CPU 0, request is sent via fallback SA, received via sub SA
|
|
moon::taskset -c 0 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8].*cpu {0}::YES
|
|
moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=2::YES
|
|
moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=2.*packets-out=0::YES
|
|
moon::swanctl --list-sas --child-id 5 --raw 2> /dev/null::child-sas.*net-net.*cpu=0.*packets-in=0.*packets-out=0::YES
|
|
# create a final SA for CPU 2, request is sent via fallback SA, response via one of the
|
|
# sub SAs (depends on the CPU assignment on the responder as it has to assign multiple
|
|
# SAs to the same CPU, so it could be either the one with unique ID 5, as it might
|
|
# be the newer one for that CPU, or it could be the original SA with unique ID 4)
|
|
moon::taskset -c 2 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8].*cpu {2}::YES
|
|
moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=3::YES
|
|
moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=2.*packets-out=0::YES
|
|
moon::swanctl --list-sas --child-id 5 --raw 2> /dev/null::child-sas.*net-net.*cpu=0.*packets-in=1.*packets-out=0::YES
|
|
moon::swanctl --list-sas --child-id 6 --raw 2> /dev/null::child-sas.*net-net.*cpu=2.*packets-in=0.*packets-out=0::YES
|
|
# all these pings must be sent via their respective SAs, never the fallback SA
|
|
moon::taskset -c 0 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::taskset -c 1 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::taskset -c 2 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::taskset -c 3 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=3::YES
|
|
moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=2::YES
|
|
moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=2.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 5 --raw 2> /dev/null::child-sas.*net-net.*cpu=0.*packets-in=1.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 6 --raw 2> /dev/null::child-sas.*net-net.*cpu=2.*packets-in=4.*packets-out=1::YES
|
|
# rekey an SA as initiator
|
|
moon::swanctl --rekey --child-id 5
|
|
moon::sleep .5
|
|
moon::taskset -c 0 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::swanctl --list-sas --child-id 7 --raw 2> /dev/null::child-sas.*net-net.*cpu=0.*packets-in=1.*packets-out=1::YES
|
|
# rekey an SA as responder
|
|
sun::swanctl --rekey --child-id 6
|
|
moon::sleep .5
|
|
moon::taskset -c 2 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::swanctl --list-sas --child-id 8 --raw 2> /dev/null::child-sas.*net-net.*cpu=2.*packets-in=1.*packets-out=1::YES
|
|
# rekey the fallback SA
|
|
moon::swanctl --rekey --child-id 2
|
|
moon::sleep .5
|
|
moon::swanctl --list-sas --child-id 9 --raw 2> /dev/null::child-sas.*net-net.*packets-in=0.*packets-out=0::YES
|
|
# all these pings must be sent via their respective SAs, never the fallback SA and not
|
|
# the old ones that remain to process delayed inbound packets
|
|
moon::taskset -c 0 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::taskset -c 1 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::taskset -c 2 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::taskset -c 3 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*state=DELETED.*packets-in=1.*packets-out=3::YES
|
|
moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*cpu=1.*packets-in=0.*packets-out=3::YES
|
|
moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*cpu=3.*packets-in=2.*packets-out=2::YES
|
|
moon::swanctl --list-sas --child-id 5 --raw 2> /dev/null::child-sas.*net-net.*state=DELETED.*cpu=0.*packets-in=1.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 6 --raw 2> /dev/null::child-sas.*net-net.*state=DELETED.*cpu=2.*packets-in=4.*packets-out=1::YES
|
|
moon::swanctl --list-sas --child-id 7 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*cpu=0.*packets-in=1.*packets-out=2::YES
|
|
moon::swanctl --list-sas --child-id 8 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*cpu=2.*packets-in=5.*packets-out=2::YES
|
|
moon::swanctl --list-sas --child-id 9 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*packets-in=0.*packets-out=0::YES
|
|
# also test forwarding (we don't know which SA this takes, but never the fallback SA)
|
|
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
|
moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*state=DELETED.*packets-in=1.*packets-out=3::YES
|
|
moon::swanctl --list-sas --child-id 9 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*packets-in=0.*packets-out=0::YES
|
|
sun::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES
|
|
sun::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES
|