diff options
| author | Rene Mayrhofer <rene@mayrhofer.eu.org> | 2007-04-12 20:30:08 +0000 |
|---|---|---|
| committer | Rene Mayrhofer <rene@mayrhofer.eu.org> | 2007-04-12 20:30:08 +0000 |
| commit | b0d8ed94fe9e74afb49fdf5f11e4add29879c65c (patch) | |
| tree | b20167235628771046e940a82a906a6d0991ee4a /testing/tests | |
| parent | ea939d07c84d2a8e51215458063fc05e9c399290 (diff) | |
| download | vyos-strongswan-b0d8ed94fe9e74afb49fdf5f11e4add29879c65c.tar.gz vyos-strongswan-b0d8ed94fe9e74afb49fdf5f11e4add29879c65c.zip | |
[svn-upgrade] Integrating new upstream version, strongswan (4.1.1)
Diffstat (limited to 'testing/tests')
1107 files changed, 7110 insertions, 667 deletions
diff --git a/testing/tests/compress/hosts/carol/etc/ipsec.conf b/testing/tests/compress/hosts/carol/etc/ipsec.conf deleted file mode 100755 index 9462ba5e6..000000000 --- a/testing/tests/compress/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,25 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug="control crypt" - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - compress=yes - -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add diff --git a/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf deleted file mode 100755 index ae8d2b772..000000000 --- a/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,25 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - ike=3des-sha - esp=3des-sha1 -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add diff --git a/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf deleted file mode 100755 index ae8d2b772..000000000 --- a/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,25 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - ike=3des-sha - esp=3des-sha1 -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add diff --git a/testing/tests/ike/rw-cert/description.txt b/testing/tests/ike/rw-cert/description.txt new file mode 100644 index 000000000..b48a89026 --- /dev/null +++ b/testing/tests/ike/rw-cert/description.txt @@ -0,0 +1,5 @@ +Roadwarrior <b>carol</b> sets up an IKEv1 connection and roadwarrior <b>dave</b> +an IKEv2 tunnel, respectively, to the gateway <b>moon</b>. +In order to test the established tunnels, both roadwarriors ping the client <b>alice</b> +in the subnet behind gateway <b>moon</b>. +. diff --git a/testing/tests/ike/rw-cert/evaltest.dat b/testing/tests/ike/rw-cert/evaltest.dat new file mode 100644 index 000000000..71496d2f2 --- /dev/null +++ b/testing/tests/ike/rw-cert/evaltest.dat @@ -0,0 +1,11 @@ +moon::ipsec statusall::rw.*STATE_QUICK_R2.*IPsec SA established::YES +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*STATE_QUICK_I2.*IPsec SA established::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..5d78605e9 --- /dev/null +++ b/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..841a67491 --- /dev/null +++ b/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ike/rw-cert/posttest.dat index ed530f6d9..ed530f6d9 100644 --- a/testing/tests/rw-psk-rsa-mixed/posttest.dat +++ b/testing/tests/ike/rw-cert/posttest.dat diff --git a/testing/tests/ike/rw-cert/pretest.dat b/testing/tests/ike/rw-cert/pretest.dat new file mode 100644 index 000000000..587b6aeed --- /dev/null +++ b/testing/tests/ike/rw-cert/pretest.dat @@ -0,0 +1,8 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home +dave::sleep 1 diff --git a/testing/tests/ike/rw-cert/test.conf b/testing/tests/ike/rw-cert/test.conf new file mode 100644 index 000000000..845a6dcd7 --- /dev/null +++ b/testing/tests/ike/rw-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ike/rw_v1-net_v2/description.txt b/testing/tests/ike/rw_v1-net_v2/description.txt new file mode 100644 index 000000000..292e09d40 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/description.txt @@ -0,0 +1,7 @@ +A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> +is set up using the IKEv2 key exchange protocol whereas the roadwarrior <b>carol</b> +negotiates the connection via the IKEv1 protocol. +In order to test the established tunnels, client <b>alice</b> behind gateway <b>moon</b> +pings client <b>bob</b> located behind gateway <b>sun</b> and roadwarrior <b>carol</b> +pings the client <b>alice</b> behind <b>moon</b>. +. diff --git a/testing/tests/ike/rw_v1-net_v2/evaltest.dat b/testing/tests/ike/rw_v1-net_v2/evaltest.dat new file mode 100644 index 000000000..4eace50b7 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::net-net.*ESTABLISHED::YES +sun::ipsec statusall::net-net.*ESTABLISHED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES +moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf b/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..b72a3e939 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + +conn %default + ikelifetime=60m + keylife=20m + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + +conn net-net + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + keyexchange=ikev2 + auto=add + +conn rw + right=%any + rightid=carol@strongswan.org + keyexchange=ikev1 + auto=add + diff --git a/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf b/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..e5a9fe396 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf @@ -0,0 +1,15 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ocsp-strict/posttest.dat b/testing/tests/ike/rw_v1-net_v2/posttest.dat index 117f625f6..0980371a5 100644 --- a/testing/tests/ocsp-strict/posttest.dat +++ b/testing/tests/ike/rw_v1-net_v2/posttest.dat @@ -1,3 +1,3 @@ -moon::ipsec stop carol::ipsec stop -winnetou::killall openssl +moon::ipsec stop +sun::ipsec stop diff --git a/testing/tests/ike/rw_v1-net_v2/pretest.dat b/testing/tests/ike/rw_v1-net_v2/pretest.dat new file mode 100644 index 000000000..03b8dc218 --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/pretest.dat @@ -0,0 +1,9 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::ipsec start +sun::ipsec start +carol::ipsec start +moon::sleep 1 +moon::ipsec up net-net +carol::ipsec up home +moon::sleep 1 diff --git a/testing/tests/ike/rw_v1-net_v2/test.conf b/testing/tests/ike/rw_v1-net_v2/test.conf new file mode 100644 index 000000000..983881e5d --- /dev/null +++ b/testing/tests/ike/rw_v1-net_v2/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="carol moon sun" diff --git a/testing/tests/alg-blowfish/description.txt b/testing/tests/ikev1/alg-blowfish/description.txt index cff0a1915..cff0a1915 100644 --- a/testing/tests/alg-blowfish/description.txt +++ b/testing/tests/ikev1/alg-blowfish/description.txt diff --git a/testing/tests/alg-blowfish/evaltest.dat b/testing/tests/ikev1/alg-blowfish/evaltest.dat index a9c9b803a..a9c9b803a 100644 --- a/testing/tests/alg-blowfish/evaltest.dat +++ b/testing/tests/ikev1/alg-blowfish/evaltest.dat diff --git a/testing/tests/alg-blowfish/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-blowfish/hosts/carol/etc/ipsec.conf index fa68c9d3d..04d5b977b 100755 --- a/testing/tests/alg-blowfish/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-blowfish/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-blowfish/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-blowfish/hosts/moon/etc/ipsec.conf index 39916a7ba..80163ffcd 100755 --- a/testing/tests/alg-blowfish/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-blowfish/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-blowfish/posttest.dat b/testing/tests/ikev1/alg-blowfish/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-blowfish/posttest.dat +++ b/testing/tests/ikev1/alg-blowfish/posttest.dat diff --git a/testing/tests/alg-blowfish/pretest.dat b/testing/tests/ikev1/alg-blowfish/pretest.dat index 6d2eeb5f9..6d2eeb5f9 100644 --- a/testing/tests/alg-blowfish/pretest.dat +++ b/testing/tests/ikev1/alg-blowfish/pretest.dat diff --git a/testing/tests/alg-blowfish/test.conf b/testing/tests/ikev1/alg-blowfish/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-blowfish/test.conf +++ b/testing/tests/ikev1/alg-blowfish/test.conf diff --git a/testing/tests/alg-serpent/description.txt b/testing/tests/ikev1/alg-serpent/description.txt index f49c0a1c0..f49c0a1c0 100644 --- a/testing/tests/alg-serpent/description.txt +++ b/testing/tests/ikev1/alg-serpent/description.txt diff --git a/testing/tests/alg-serpent/evaltest.dat b/testing/tests/ikev1/alg-serpent/evaltest.dat index 6b792538b..6b792538b 100644 --- a/testing/tests/alg-serpent/evaltest.dat +++ b/testing/tests/ikev1/alg-serpent/evaltest.dat diff --git a/testing/tests/alg-serpent/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-serpent/hosts/carol/etc/ipsec.conf index 5d2369924..09cd583b4 100755 --- a/testing/tests/alg-serpent/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-serpent/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-serpent/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-serpent/hosts/moon/etc/ipsec.conf index 7bdddf008..ca1eb7b19 100755 --- a/testing/tests/alg-serpent/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-serpent/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no - + charonstart=no + conn %default ikelifetime=60m keylife=20m diff --git a/testing/tests/alg-serpent/posttest.dat b/testing/tests/ikev1/alg-serpent/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-serpent/posttest.dat +++ b/testing/tests/ikev1/alg-serpent/posttest.dat diff --git a/testing/tests/alg-serpent/pretest.dat b/testing/tests/ikev1/alg-serpent/pretest.dat index 6d2eeb5f9..6d2eeb5f9 100644 --- a/testing/tests/alg-serpent/pretest.dat +++ b/testing/tests/ikev1/alg-serpent/pretest.dat diff --git a/testing/tests/alg-serpent/test.conf b/testing/tests/ikev1/alg-serpent/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-serpent/test.conf +++ b/testing/tests/ikev1/alg-serpent/test.conf diff --git a/testing/tests/alg-sha-equals-sha1/description.txt b/testing/tests/ikev1/alg-sha-equals-sha1/description.txt index aeb2e1a88..aeb2e1a88 100644 --- a/testing/tests/alg-sha-equals-sha1/description.txt +++ b/testing/tests/ikev1/alg-sha-equals-sha1/description.txt diff --git a/testing/tests/alg-sha-equals-sha1/evaltest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/evaltest.dat index c3656c690..c3656c690 100644 --- a/testing/tests/alg-sha-equals-sha1/evaltest.dat +++ b/testing/tests/ikev1/alg-sha-equals-sha1/evaltest.dat diff --git a/testing/tests/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf index c7328faae..7c1ee3bb5 100755 --- a/testing/tests/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -24,3 +23,4 @@ conn home rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add + diff --git a/testing/tests/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf index 398c07fa9..7d00b538f 100755 --- a/testing/tests/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -24,3 +23,4 @@ conn rw right=%any rightid=carol@strongswan.org auto=add + diff --git a/testing/tests/alg-sha-equals-sha1/posttest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-sha-equals-sha1/posttest.dat +++ b/testing/tests/ikev1/alg-sha-equals-sha1/posttest.dat diff --git a/testing/tests/alg-sha-equals-sha1/pretest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/alg-sha-equals-sha1/pretest.dat +++ b/testing/tests/ikev1/alg-sha-equals-sha1/pretest.dat diff --git a/testing/tests/alg-sha-equals-sha1/test.conf b/testing/tests/ikev1/alg-sha-equals-sha1/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-sha-equals-sha1/test.conf +++ b/testing/tests/ikev1/alg-sha-equals-sha1/test.conf diff --git a/testing/tests/alg-sha2_256/description.txt b/testing/tests/ikev1/alg-sha2_256/description.txt index 900fcf017..900fcf017 100644 --- a/testing/tests/alg-sha2_256/description.txt +++ b/testing/tests/ikev1/alg-sha2_256/description.txt diff --git a/testing/tests/alg-sha2_256/evaltest.dat b/testing/tests/ikev1/alg-sha2_256/evaltest.dat index 9b4caa278..9b4caa278 100644 --- a/testing/tests/alg-sha2_256/evaltest.dat +++ b/testing/tests/ikev1/alg-sha2_256/evaltest.dat diff --git a/testing/tests/alg-sha2_256/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-sha2_256/hosts/carol/etc/ipsec.conf index c55ae8ab1..b10fb08b9 100755 --- a/testing/tests/alg-sha2_256/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-sha2_256/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-sha2_256/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-sha2_256/hosts/moon/etc/ipsec.conf index 748b1b85c..de832729b 100755 --- a/testing/tests/alg-sha2_256/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-sha2_256/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-sha2_256/posttest.dat b/testing/tests/ikev1/alg-sha2_256/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-sha2_256/posttest.dat +++ b/testing/tests/ikev1/alg-sha2_256/posttest.dat diff --git a/testing/tests/alg-sha2_256/pretest.dat b/testing/tests/ikev1/alg-sha2_256/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/alg-sha2_256/pretest.dat +++ b/testing/tests/ikev1/alg-sha2_256/pretest.dat diff --git a/testing/tests/alg-sha2_256/test.conf b/testing/tests/ikev1/alg-sha2_256/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-sha2_256/test.conf +++ b/testing/tests/ikev1/alg-sha2_256/test.conf diff --git a/testing/tests/alg-twofish/description.txt b/testing/tests/ikev1/alg-twofish/description.txt index 0015561ee..0015561ee 100644 --- a/testing/tests/alg-twofish/description.txt +++ b/testing/tests/ikev1/alg-twofish/description.txt diff --git a/testing/tests/alg-twofish/evaltest.dat b/testing/tests/ikev1/alg-twofish/evaltest.dat index 0568eec6e..0568eec6e 100644 --- a/testing/tests/alg-twofish/evaltest.dat +++ b/testing/tests/ikev1/alg-twofish/evaltest.dat diff --git a/testing/tests/alg-twofish/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-twofish/hosts/carol/etc/ipsec.conf index 8e3037a3b..95ddeb2b8 100755 --- a/testing/tests/alg-twofish/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-twofish/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-twofish/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-twofish/hosts/moon/etc/ipsec.conf index 01004e94e..2d7904563 100755 --- a/testing/tests/alg-twofish/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/alg-twofish/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/alg-twofish/posttest.dat b/testing/tests/ikev1/alg-twofish/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/alg-twofish/posttest.dat +++ b/testing/tests/ikev1/alg-twofish/posttest.dat diff --git a/testing/tests/alg-twofish/pretest.dat b/testing/tests/ikev1/alg-twofish/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/alg-twofish/pretest.dat +++ b/testing/tests/ikev1/alg-twofish/pretest.dat diff --git a/testing/tests/alg-twofish/test.conf b/testing/tests/ikev1/alg-twofish/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/alg-twofish/test.conf +++ b/testing/tests/ikev1/alg-twofish/test.conf diff --git a/testing/tests/attr-cert/description.txt b/testing/tests/ikev1/attr-cert/description.txt index b7f809c36..b7f809c36 100644 --- a/testing/tests/attr-cert/description.txt +++ b/testing/tests/ikev1/attr-cert/description.txt diff --git a/testing/tests/attr-cert/evaltest.dat b/testing/tests/ikev1/attr-cert/evaltest.dat index 59f6eb76a..59f6eb76a 100644 --- a/testing/tests/attr-cert/evaltest.dat +++ b/testing/tests/ikev1/attr-cert/evaltest.dat diff --git a/testing/tests/attr-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/carol/etc/ipsec.conf index 62fc49868..eae669641 100755 --- a/testing/tests/attr-cert/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/attr-cert/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/attr-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/dave/etc/ipsec.conf index 9d932dc54..989784124 100755 --- a/testing/tests/attr-cert/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/attr-cert/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/attr-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.conf index bd72715ff..6c16db587 100755 --- a/testing/tests/attr-cert/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem index 3c5c5d91d..3c5c5d91d 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/aaKey.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/aaKey.pem index 209b48f3a..209b48f3a 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/openac/aaKey.pem +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/aaKey.pem diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/carolCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/carolCert.pem index 8492fbd45..8492fbd45 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/openac/carolCert.pem +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/carolCert.pem diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/daveCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/daveCert.pem index abd1554e5..abd1554e5 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/openac/daveCert.pem +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/daveCert.pem diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/default.conf b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/default.conf index 134218eec..134218eec 100644 --- a/testing/tests/attr-cert/hosts/moon/etc/openac/default.conf +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/default.conf diff --git a/testing/tests/attr-cert/posttest.dat b/testing/tests/ikev1/attr-cert/posttest.dat index a59c3ff63..a59c3ff63 100644 --- a/testing/tests/attr-cert/posttest.dat +++ b/testing/tests/ikev1/attr-cert/posttest.dat diff --git a/testing/tests/attr-cert/pretest.dat b/testing/tests/ikev1/attr-cert/pretest.dat index b3fecaf3c..b3fecaf3c 100644 --- a/testing/tests/attr-cert/pretest.dat +++ b/testing/tests/ikev1/attr-cert/pretest.dat diff --git a/testing/tests/attr-cert/test.conf b/testing/tests/ikev1/attr-cert/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/attr-cert/test.conf +++ b/testing/tests/ikev1/attr-cert/test.conf diff --git a/testing/tests/compress/description.txt b/testing/tests/ikev1/compress/description.txt index 47829839d..47829839d 100644 --- a/testing/tests/compress/description.txt +++ b/testing/tests/ikev1/compress/description.txt diff --git a/testing/tests/compress/evaltest.dat b/testing/tests/ikev1/compress/evaltest.dat index ff72e1762..ff72e1762 100644 --- a/testing/tests/compress/evaltest.dat +++ b/testing/tests/ikev1/compress/evaltest.dat diff --git a/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..abf3049d8 --- /dev/null +++ b/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug="control crypt" + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + compress=yes + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/compress/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/compress/hosts/moon/etc/ipsec.conf index b8dfae646..855718f5d 100755 --- a/testing/tests/compress/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/compress/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/compress/posttest.dat b/testing/tests/ikev1/compress/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/compress/posttest.dat +++ b/testing/tests/ikev1/compress/posttest.dat diff --git a/testing/tests/compress/pretest.dat b/testing/tests/ikev1/compress/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/compress/pretest.dat +++ b/testing/tests/ikev1/compress/pretest.dat diff --git a/testing/tests/compress/test.conf b/testing/tests/ikev1/compress/test.conf index fd33cfb57..fd33cfb57 100644 --- a/testing/tests/compress/test.conf +++ b/testing/tests/ikev1/compress/test.conf diff --git a/testing/tests/crl-from-cache/description.txt b/testing/tests/ikev1/crl-from-cache/description.txt index 17866f572..17866f572 100644 --- a/testing/tests/crl-from-cache/description.txt +++ b/testing/tests/ikev1/crl-from-cache/description.txt diff --git a/testing/tests/crl-from-cache/evaltest.dat b/testing/tests/ikev1/crl-from-cache/evaltest.dat index dd200c8ef..dd200c8ef 100644 --- a/testing/tests/crl-from-cache/evaltest.dat +++ b/testing/tests/ikev1/crl-from-cache/evaltest.dat diff --git a/testing/tests/crl-from-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-from-cache/hosts/carol/etc/ipsec.conf index 93c4d7956..59cbe67ba 100755 --- a/testing/tests/crl-from-cache/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-from-cache/hosts/carol/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes cachecrls=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-from-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-from-cache/hosts/moon/etc/ipsec.conf index ef9237518..9a2efb73d 100755 --- a/testing/tests/crl-from-cache/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-from-cache/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes cachecrls=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-from-cache/posttest.dat b/testing/tests/ikev1/crl-from-cache/posttest.dat index be17847c1..be17847c1 100644 --- a/testing/tests/crl-from-cache/posttest.dat +++ b/testing/tests/ikev1/crl-from-cache/posttest.dat diff --git a/testing/tests/crl-from-cache/pretest.dat b/testing/tests/ikev1/crl-from-cache/pretest.dat index acdb265ed..acdb265ed 100644 --- a/testing/tests/crl-from-cache/pretest.dat +++ b/testing/tests/ikev1/crl-from-cache/pretest.dat diff --git a/testing/tests/crl-from-cache/test.conf b/testing/tests/ikev1/crl-from-cache/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-from-cache/test.conf +++ b/testing/tests/ikev1/crl-from-cache/test.conf diff --git a/testing/tests/crl-ldap/description.txt b/testing/tests/ikev1/crl-ldap/description.txt index 02dc0cbbe..02dc0cbbe 100644 --- a/testing/tests/crl-ldap/description.txt +++ b/testing/tests/ikev1/crl-ldap/description.txt diff --git a/testing/tests/crl-ldap/evaltest.dat b/testing/tests/ikev1/crl-ldap/evaltest.dat index 2b98e086a..2b98e086a 100644 --- a/testing/tests/crl-ldap/evaltest.dat +++ b/testing/tests/ikev1/crl-ldap/evaltest.dat diff --git a/testing/tests/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/init.d/iptables index 571459bae..571459bae 100755 --- a/testing/tests/crl-ldap/hosts/carol/etc/init.d/iptables +++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/init.d/iptables diff --git a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.conf index 669a47d06..40e32f14a 100755 --- a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes cachecrls=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl Binary files differindex 75e8b0959..75e8b0959 100644 --- a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl +++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl diff --git a/testing/tests/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/init.d/iptables index 8de514a2e..8de514a2e 100755 --- a/testing/tests/crl-ldap/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.conf index d5c0dd163..eaaaa3f42 100755 --- a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes cachecrls=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl Binary files differindex 75e8b0959..75e8b0959 100644 --- a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl +++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl diff --git a/testing/tests/crl-ldap/posttest.dat b/testing/tests/ikev1/crl-ldap/posttest.dat index 04f762331..bddd87424 100644 --- a/testing/tests/crl-ldap/posttest.dat +++ b/testing/tests/ikev1/crl-ldap/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop winnetou::/etc/init.d/slapd stop diff --git a/testing/tests/crl-ldap/pretest.dat b/testing/tests/ikev1/crl-ldap/pretest.dat index 64fa8116b..64fa8116b 100644 --- a/testing/tests/crl-ldap/pretest.dat +++ b/testing/tests/ikev1/crl-ldap/pretest.dat diff --git a/testing/tests/crl-ldap/test.conf b/testing/tests/ikev1/crl-ldap/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-ldap/test.conf +++ b/testing/tests/ikev1/crl-ldap/test.conf diff --git a/testing/tests/crl-revoked/description.txt b/testing/tests/ikev1/crl-revoked/description.txt index 780068ce6..780068ce6 100644 --- a/testing/tests/crl-revoked/description.txt +++ b/testing/tests/ikev1/crl-revoked/description.txt diff --git a/testing/tests/crl-revoked/evaltest.dat b/testing/tests/ikev1/crl-revoked/evaltest.dat index 0fd1cae8c..0fd1cae8c 100644 --- a/testing/tests/crl-revoked/evaltest.dat +++ b/testing/tests/ikev1/crl-revoked/evaltest.dat diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.conf index 5a1d246a6..6b4650fb8 100755 --- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem index 5b742fc9e..5b742fc9e 100644 --- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem +++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem index 8aefcc5a6..8aefcc5a6 100644 --- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem +++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.secrets index 8e31be4cb..8e31be4cb 100644 --- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/crl-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-revoked/hosts/moon/etc/ipsec.conf index a8953f557..143bace9a 100755 --- a/testing/tests/crl-revoked/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-revoked/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-revoked/posttest.dat b/testing/tests/ikev1/crl-revoked/posttest.dat index d742e8410..d742e8410 100644 --- a/testing/tests/crl-revoked/posttest.dat +++ b/testing/tests/ikev1/crl-revoked/posttest.dat diff --git a/testing/tests/crl-revoked/pretest.dat b/testing/tests/ikev1/crl-revoked/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/crl-revoked/pretest.dat +++ b/testing/tests/ikev1/crl-revoked/pretest.dat diff --git a/testing/tests/crl-revoked/test.conf b/testing/tests/ikev1/crl-revoked/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-revoked/test.conf +++ b/testing/tests/ikev1/crl-revoked/test.conf diff --git a/testing/tests/crl-strict/description.txt b/testing/tests/ikev1/crl-strict/description.txt index 97011482e..97011482e 100644 --- a/testing/tests/crl-strict/description.txt +++ b/testing/tests/ikev1/crl-strict/description.txt diff --git a/testing/tests/crl-strict/evaltest.dat b/testing/tests/ikev1/crl-strict/evaltest.dat index 1d7adb05e..1d7adb05e 100644 --- a/testing/tests/crl-strict/evaltest.dat +++ b/testing/tests/ikev1/crl-strict/evaltest.dat diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-strict/hosts/carol/etc/ipsec.conf index 6d0aee86a..93bd80758 100755 --- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-strict/hosts/moon/etc/ipsec.conf index a8953f557..143bace9a 100755 --- a/testing/tests/crl-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-strict/posttest.dat b/testing/tests/ikev1/crl-strict/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/crl-strict/posttest.dat +++ b/testing/tests/ikev1/crl-strict/posttest.dat diff --git a/testing/tests/crl-strict/pretest.dat b/testing/tests/ikev1/crl-strict/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/crl-strict/pretest.dat +++ b/testing/tests/ikev1/crl-strict/pretest.dat diff --git a/testing/tests/crl-strict/test.conf b/testing/tests/ikev1/crl-strict/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-strict/test.conf +++ b/testing/tests/ikev1/crl-strict/test.conf diff --git a/testing/tests/crl-to-cache/description.txt b/testing/tests/ikev1/crl-to-cache/description.txt index 9f542e73d..9f542e73d 100644 --- a/testing/tests/crl-to-cache/description.txt +++ b/testing/tests/ikev1/crl-to-cache/description.txt diff --git a/testing/tests/crl-to-cache/evaltest.dat b/testing/tests/ikev1/crl-to-cache/evaltest.dat index be7737185..be7737185 100644 --- a/testing/tests/crl-to-cache/evaltest.dat +++ b/testing/tests/ikev1/crl-to-cache/evaltest.dat diff --git a/testing/tests/crl-to-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-to-cache/hosts/carol/etc/ipsec.conf index 955f08b1f..e64a8fb5a 100755 --- a/testing/tests/crl-to-cache/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-to-cache/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 cachecrls=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-to-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-to-cache/hosts/moon/etc/ipsec.conf index 885354ab5..666fc0698 100755 --- a/testing/tests/crl-to-cache/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/crl-to-cache/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 cachecrls=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/crl-to-cache/posttest.dat b/testing/tests/ikev1/crl-to-cache/posttest.dat index be17847c1..be17847c1 100644 --- a/testing/tests/crl-to-cache/posttest.dat +++ b/testing/tests/ikev1/crl-to-cache/posttest.dat diff --git a/testing/tests/crl-to-cache/pretest.dat b/testing/tests/ikev1/crl-to-cache/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/crl-to-cache/pretest.dat +++ b/testing/tests/ikev1/crl-to-cache/pretest.dat diff --git a/testing/tests/crl-to-cache/test.conf b/testing/tests/ikev1/crl-to-cache/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/crl-to-cache/test.conf +++ b/testing/tests/ikev1/crl-to-cache/test.conf diff --git a/testing/tests/default-keys/description.txt b/testing/tests/ikev1/default-keys/description.txt index 639e909da..639e909da 100644 --- a/testing/tests/default-keys/description.txt +++ b/testing/tests/ikev1/default-keys/description.txt diff --git a/testing/tests/self-signed/evaltest.dat b/testing/tests/ikev1/default-keys/evaltest.dat index f190d7066..a18e3997e 100644 --- a/testing/tests/self-signed/evaltest.dat +++ b/testing/tests/ikev1/default-keys/evaltest.dat @@ -1,3 +1,5 @@ +carol::cat /var/log/auth.log::scepclient::YES +moon::cat /var/log/auth.log::scepclient::YES carol::cat /var/log/auth.log::we have a cert but are not sending it::YES moon::cat /var/log/auth.log::we have a cert but are not sending it::YES carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES diff --git a/testing/tests/default-keys/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/default-keys/hosts/carol/etc/ipsec.conf index c4bb10a65..0ec9d47ed 100755 --- a/testing/tests/default-keys/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/default-keys/hosts/carol/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=0 strictcrlpolicy=no nocrsend=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/default-keys/hosts/moon/etc/init.d/iptables index 13ad3063f..13ad3063f 100755 --- a/testing/tests/default-keys/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/default-keys/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/default-keys/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/default-keys/hosts/moon/etc/ipsec.conf index eeeec645b..ed1b40549 100755 --- a/testing/tests/default-keys/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/default-keys/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=0 strictcrlpolicy=no nocrsend=yes + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default keyingtries=1 conn carol - left=192.168.0.1 + left=PH_IP_MOON leftnexthop=%direct leftcert=selfCert.der leftsendcert=never diff --git a/testing/tests/default-keys/posttest.dat b/testing/tests/ikev1/default-keys/posttest.dat index 52b48b9ef..8cada5e7e 100644 --- a/testing/tests/default-keys/posttest.dat +++ b/testing/tests/ikev1/default-keys/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/default-keys/pretest.dat b/testing/tests/ikev1/default-keys/pretest.dat index 54f70cbe9..88f9a2ca9 100644 --- a/testing/tests/default-keys/pretest.dat +++ b/testing/tests/ikev1/default-keys/pretest.dat @@ -10,7 +10,7 @@ moon::rm /etc/ipsec.d/private/* moon::rm /etc/ipsec.d/certs/* moon::rm /etc/ipsec.d/cacerts/* moon::ipsec start -moon::sleep 4 +moon::sleep 5 moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der moon::ipsec reload diff --git a/testing/tests/default-keys/test.conf b/testing/tests/ikev1/default-keys/test.conf index 0baa48d90..0baa48d90 100644 --- a/testing/tests/default-keys/test.conf +++ b/testing/tests/ikev1/default-keys/test.conf diff --git a/testing/tests/double-nat-net/description.txt b/testing/tests/ikev1/double-nat-net/description.txt index ff09155f6..ff09155f6 100644 --- a/testing/tests/double-nat-net/description.txt +++ b/testing/tests/ikev1/double-nat-net/description.txt diff --git a/testing/tests/double-nat-net/evaltest.dat b/testing/tests/ikev1/double-nat-net/evaltest.dat index 41eba6501..d00613c07 100644 --- a/testing/tests/double-nat-net/evaltest.dat +++ b/testing/tests/ikev1/double-nat-net/evaltest.dat @@ -1,5 +1,5 @@ alice::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES bob::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES -alice::ping -c 1 PH_IP1_SUN::64 bytes from PH_IP1_SUN: icmp_seq=1::YES +alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/double-nat-net/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/double-nat-net/hosts/alice/etc/ipsec.conf index 395e62e7c..5c0763734 100755 --- a/testing/tests/double-nat-net/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev1/double-nat-net/hosts/alice/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/double-nat-net/hosts/bob/etc/ipsec.conf b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/ipsec.conf index 6927a5ce4..e79b2ca35 100755 --- a/testing/tests/double-nat-net/hosts/bob/etc/ipsec.conf +++ b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/double-nat-net/posttest.dat b/testing/tests/ikev1/double-nat-net/posttest.dat index 0eb2c0d6c..484297418 100644 --- a/testing/tests/double-nat-net/posttest.dat +++ b/testing/tests/ikev1/double-nat-net/posttest.dat @@ -1,9 +1,9 @@ -alice::iptables -v -n -L -bob::iptables -v -n -L bob::ipsec stop alice::ipsec stop alice::/etc/init.d/iptables stop 2> /dev/null bob::/etc/init.d/iptables stop 2> /dev/null moon::iptables -t nat -F sun::iptables -t nat -F +moon::conntrack -F +sun::conntrack -F sun::ip route del 10.1.0.0/16 via PH_IP_BOB diff --git a/testing/tests/double-nat-net/pretest.dat b/testing/tests/ikev1/double-nat-net/pretest.dat index 84bc15092..84bc15092 100644 --- a/testing/tests/double-nat-net/pretest.dat +++ b/testing/tests/ikev1/double-nat-net/pretest.dat diff --git a/testing/tests/double-nat-net/test.conf b/testing/tests/ikev1/double-nat-net/test.conf index 1ca2ffe5a..1ca2ffe5a 100644 --- a/testing/tests/double-nat-net/test.conf +++ b/testing/tests/ikev1/double-nat-net/test.conf diff --git a/testing/tests/double-nat/description.txt b/testing/tests/ikev1/double-nat/description.txt index ce7de0e56..ce7de0e56 100644 --- a/testing/tests/double-nat/description.txt +++ b/testing/tests/ikev1/double-nat/description.txt diff --git a/testing/tests/double-nat/evaltest.dat b/testing/tests/ikev1/double-nat/evaltest.dat index 05e751422..05e751422 100644 --- a/testing/tests/double-nat/evaltest.dat +++ b/testing/tests/ikev1/double-nat/evaltest.dat diff --git a/testing/tests/double-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/double-nat/hosts/alice/etc/ipsec.conf index 5b3cddb63..3533c3f8b 100755 --- a/testing/tests/double-nat/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev1/double-nat/hosts/alice/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/double-nat/posttest.dat b/testing/tests/ikev1/double-nat/posttest.dat index 07f22d07d..5d39e406d 100644 --- a/testing/tests/double-nat/posttest.dat +++ b/testing/tests/ikev1/double-nat/posttest.dat @@ -1,8 +1,8 @@ -alice::iptables -v -n -L -bob::iptables -v -n -L bob::ipsec stop alice::ipsec stop alice::/etc/init.d/iptables stop 2> /dev/null bob::/etc/init.d/iptables stop 2> /dev/null moon::iptables -t nat -F sun::iptables -t nat -F +moon::conntrack -F +sun::conntrack -F diff --git a/testing/tests/double-nat/pretest.dat b/testing/tests/ikev1/double-nat/pretest.dat index cf495b778..cf495b778 100644 --- a/testing/tests/double-nat/pretest.dat +++ b/testing/tests/ikev1/double-nat/pretest.dat diff --git a/testing/tests/double-nat/test.conf b/testing/tests/ikev1/double-nat/test.conf index 1ca2ffe5a..1ca2ffe5a 100644 --- a/testing/tests/double-nat/test.conf +++ b/testing/tests/ikev1/double-nat/test.conf diff --git a/testing/tests/dpd-clear/description.txt b/testing/tests/ikev1/dpd-clear/description.txt index f76b2d741..f76b2d741 100644 --- a/testing/tests/dpd-clear/description.txt +++ b/testing/tests/ikev1/dpd-clear/description.txt diff --git a/testing/tests/dpd-clear/evaltest.dat b/testing/tests/ikev1/dpd-clear/evaltest.dat index da3567d3e..98d5b146b 100644 --- a/testing/tests/dpd-clear/evaltest.dat +++ b/testing/tests/ikev1/dpd-clear/evaltest.dat @@ -1,6 +1,5 @@ carol::ipsec status::STATE_MAIN_I4 (ISAKMP SA established)::YES carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO -moon::ipsec statusall::DPD active::YES moon::sleep 50::no output expected::NO moon::cat /var/log/auth.log::inserting event EVENT_DPD::YES moon::cat /var/log/auth.log::DPD: No response from peer - declaring peer dead::YES diff --git a/testing/tests/dpd-clear/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/dpd-clear/hosts/moon/etc/ipsec.conf index cac521c8f..281293545 100755 --- a/testing/tests/dpd-clear/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/dpd-clear/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/dpd-clear/posttest.dat b/testing/tests/ikev1/dpd-clear/posttest.dat index 931db4272..931db4272 100644 --- a/testing/tests/dpd-clear/posttest.dat +++ b/testing/tests/ikev1/dpd-clear/posttest.dat diff --git a/testing/tests/dpd-clear/pretest.dat b/testing/tests/ikev1/dpd-clear/pretest.dat index 14ed95322..14ed95322 100644 --- a/testing/tests/dpd-clear/pretest.dat +++ b/testing/tests/ikev1/dpd-clear/pretest.dat diff --git a/testing/tests/dpd-clear/test.conf b/testing/tests/ikev1/dpd-clear/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/dpd-clear/test.conf +++ b/testing/tests/ikev1/dpd-clear/test.conf diff --git a/testing/tests/esp-ah-transport/description.txt b/testing/tests/ikev1/esp-ah-transport/description.txt index c7918fa38..c7918fa38 100644 --- a/testing/tests/esp-ah-transport/description.txt +++ b/testing/tests/ikev1/esp-ah-transport/description.txt diff --git a/testing/tests/esp-ah-transport/evaltest.dat b/testing/tests/ikev1/esp-ah-transport/evaltest.dat index 7c498ad83..7c498ad83 100644 --- a/testing/tests/esp-ah-transport/evaltest.dat +++ b/testing/tests/ikev1/esp-ah-transport/evaltest.dat diff --git a/testing/tests/esp-ah-transport/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/init.d/iptables index 8c8817539..8c8817539 100755 --- a/testing/tests/esp-ah-transport/hosts/carol/etc/init.d/iptables +++ b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/init.d/iptables diff --git a/testing/tests/esp-ah-transport/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/ipsec.conf index 13ab3e07f..21f56705c 100755 --- a/testing/tests/esp-ah-transport/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-ah-transport/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/init.d/iptables index 3e8922581..3e8922581 100755 --- a/testing/tests/esp-ah-transport/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/esp-ah-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/ipsec.conf index 809f3c74b..274a1aa18 100755 --- a/testing/tests/esp-ah-transport/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-ah-transport/posttest.dat b/testing/tests/ikev1/esp-ah-transport/posttest.dat index 26848212b..94a400606 100644 --- a/testing/tests/esp-ah-transport/posttest.dat +++ b/testing/tests/ikev1/esp-ah-transport/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/esp-ah-transport/pretest.dat b/testing/tests/ikev1/esp-ah-transport/pretest.dat index bd68efb0b..bd68efb0b 100644 --- a/testing/tests/esp-ah-transport/pretest.dat +++ b/testing/tests/ikev1/esp-ah-transport/pretest.dat diff --git a/testing/tests/esp-ah-transport/test.conf b/testing/tests/ikev1/esp-ah-transport/test.conf index fd33cfb57..fd33cfb57 100644 --- a/testing/tests/esp-ah-transport/test.conf +++ b/testing/tests/ikev1/esp-ah-transport/test.conf diff --git a/testing/tests/esp-ah-tunnel/description.txt b/testing/tests/ikev1/esp-ah-tunnel/description.txt index 809f28c57..809f28c57 100644 --- a/testing/tests/esp-ah-tunnel/description.txt +++ b/testing/tests/ikev1/esp-ah-tunnel/description.txt diff --git a/testing/tests/esp-ah-tunnel/evaltest.dat b/testing/tests/ikev1/esp-ah-tunnel/evaltest.dat index 8f4a99641..8f4a99641 100644 --- a/testing/tests/esp-ah-tunnel/evaltest.dat +++ b/testing/tests/ikev1/esp-ah-tunnel/evaltest.dat diff --git a/testing/tests/esp-ah-tunnel/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/init.d/iptables index 8c8817539..8c8817539 100755 --- a/testing/tests/esp-ah-tunnel/hosts/carol/etc/init.d/iptables +++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/init.d/iptables diff --git a/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..8c72a7b7f --- /dev/null +++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + auth=ah + ike=aes128-sha + esp=aes128-sha1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/esp-ah-tunnel/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/init.d/iptables index 3e8922581..3e8922581 100755 --- a/testing/tests/esp-ah-tunnel/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/esp-ah-tunnel/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/ipsec.conf index 7f976376d..ccf8e91fa 100755 --- a/testing/tests/esp-ah-tunnel/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-ah-tunnel/posttest.dat b/testing/tests/ikev1/esp-ah-tunnel/posttest.dat index 26848212b..94a400606 100644 --- a/testing/tests/esp-ah-tunnel/posttest.dat +++ b/testing/tests/ikev1/esp-ah-tunnel/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/esp-ah-tunnel/pretest.dat b/testing/tests/ikev1/esp-ah-tunnel/pretest.dat index bd68efb0b..bd68efb0b 100644 --- a/testing/tests/esp-ah-tunnel/pretest.dat +++ b/testing/tests/ikev1/esp-ah-tunnel/pretest.dat diff --git a/testing/tests/esp-ah-tunnel/test.conf b/testing/tests/ikev1/esp-ah-tunnel/test.conf index fd33cfb57..fd33cfb57 100644 --- a/testing/tests/esp-ah-tunnel/test.conf +++ b/testing/tests/ikev1/esp-ah-tunnel/test.conf diff --git a/testing/tests/esp-alg-des/description.txt b/testing/tests/ikev1/esp-alg-des/description.txt index 9546569dd..9546569dd 100644 --- a/testing/tests/esp-alg-des/description.txt +++ b/testing/tests/ikev1/esp-alg-des/description.txt diff --git a/testing/tests/esp-alg-des/evaltest.dat b/testing/tests/ikev1/esp-alg-des/evaltest.dat index 8e06392f1..8e06392f1 100644 --- a/testing/tests/esp-alg-des/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-des/evaltest.dat diff --git a/testing/tests/esp-alg-weak/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-des/hosts/carol/etc/ipsec.conf index b4f067b6d..b8ef03cfe 100755 --- a/testing/tests/esp-alg-weak/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-des/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-des/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-des/hosts/moon/etc/ipsec.conf index 9513f810d..3ac0bf4cf 100755 --- a/testing/tests/esp-alg-des/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-des/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-des/posttest.dat b/testing/tests/ikev1/esp-alg-des/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-des/posttest.dat +++ b/testing/tests/ikev1/esp-alg-des/posttest.dat diff --git a/testing/tests/esp-alg-des/pretest.dat b/testing/tests/ikev1/esp-alg-des/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/esp-alg-des/pretest.dat +++ b/testing/tests/ikev1/esp-alg-des/pretest.dat diff --git a/testing/tests/esp-alg-des/test.conf b/testing/tests/ikev1/esp-alg-des/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/esp-alg-des/test.conf +++ b/testing/tests/ikev1/esp-alg-des/test.conf diff --git a/testing/tests/esp-alg-null/description.txt b/testing/tests/ikev1/esp-alg-null/description.txt index 7880a799c..7880a799c 100644 --- a/testing/tests/esp-alg-null/description.txt +++ b/testing/tests/ikev1/esp-alg-null/description.txt diff --git a/testing/tests/esp-alg-null/evaltest.dat b/testing/tests/ikev1/esp-alg-null/evaltest.dat index de2f2a571..de2f2a571 100644 --- a/testing/tests/esp-alg-null/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-null/evaltest.dat diff --git a/testing/tests/esp-alg-null/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-null/hosts/carol/etc/ipsec.conf index b732eba93..7a8ae37c9 100755 --- a/testing/tests/esp-alg-null/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-null/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-null/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-null/hosts/moon/etc/ipsec.conf index af11591a1..187a3fb17 100755 --- a/testing/tests/esp-alg-null/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-null/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-null/posttest.dat b/testing/tests/ikev1/esp-alg-null/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-null/posttest.dat +++ b/testing/tests/ikev1/esp-alg-null/posttest.dat diff --git a/testing/tests/esp-alg-weak/pretest.dat b/testing/tests/ikev1/esp-alg-null/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/esp-alg-weak/pretest.dat +++ b/testing/tests/ikev1/esp-alg-null/pretest.dat diff --git a/testing/tests/esp-alg-null/test.conf b/testing/tests/ikev1/esp-alg-null/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/esp-alg-null/test.conf +++ b/testing/tests/ikev1/esp-alg-null/test.conf diff --git a/testing/tests/esp-alg-strict-fail/description.txt b/testing/tests/ikev1/esp-alg-strict-fail/description.txt index 03c655480..03c655480 100644 --- a/testing/tests/esp-alg-strict-fail/description.txt +++ b/testing/tests/ikev1/esp-alg-strict-fail/description.txt diff --git a/testing/tests/esp-alg-strict-fail/evaltest.dat b/testing/tests/ikev1/esp-alg-strict-fail/evaltest.dat index 6f2024ff9..6f2024ff9 100644 --- a/testing/tests/esp-alg-strict-fail/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-strict-fail/evaltest.dat diff --git a/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..4ed2fb645 --- /dev/null +++ b/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + ike=3des-sha + esp=3des-sha1 +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf index 2dd1c763a..f8c27ad7c 100755 --- a/testing/tests/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-strict-fail/posttest.dat b/testing/tests/ikev1/esp-alg-strict-fail/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-strict-fail/posttest.dat +++ b/testing/tests/ikev1/esp-alg-strict-fail/posttest.dat diff --git a/testing/tests/esp-alg-null/pretest.dat b/testing/tests/ikev1/esp-alg-strict-fail/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/esp-alg-null/pretest.dat +++ b/testing/tests/ikev1/esp-alg-strict-fail/pretest.dat diff --git a/testing/tests/esp-alg-strict-fail/test.conf b/testing/tests/ikev1/esp-alg-strict-fail/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/esp-alg-strict-fail/test.conf +++ b/testing/tests/ikev1/esp-alg-strict-fail/test.conf diff --git a/testing/tests/esp-alg-strict/description.txt b/testing/tests/ikev1/esp-alg-strict/description.txt index b4fc08253..b4fc08253 100644 --- a/testing/tests/esp-alg-strict/description.txt +++ b/testing/tests/ikev1/esp-alg-strict/description.txt diff --git a/testing/tests/esp-alg-strict/evaltest.dat b/testing/tests/ikev1/esp-alg-strict/evaltest.dat index d5dd12d4e..d5dd12d4e 100644 --- a/testing/tests/esp-alg-strict/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-strict/evaltest.dat diff --git a/testing/tests/esp-alg-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict/hosts/carol/etc/ipsec.conf index 5a14de070..da86d14df 100755 --- a/testing/tests/esp-alg-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict/hosts/moon/etc/ipsec.conf index 2dd1c763a..f8c27ad7c 100755 --- a/testing/tests/esp-alg-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-strict/posttest.dat b/testing/tests/ikev1/esp-alg-strict/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-strict/posttest.dat +++ b/testing/tests/ikev1/esp-alg-strict/posttest.dat diff --git a/testing/tests/esp-alg-strict-fail/pretest.dat b/testing/tests/ikev1/esp-alg-strict/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/esp-alg-strict-fail/pretest.dat +++ b/testing/tests/ikev1/esp-alg-strict/pretest.dat diff --git a/testing/tests/esp-alg-strict/test.conf b/testing/tests/ikev1/esp-alg-strict/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/esp-alg-strict/test.conf +++ b/testing/tests/ikev1/esp-alg-strict/test.conf diff --git a/testing/tests/esp-alg-weak/description.txt b/testing/tests/ikev1/esp-alg-weak/description.txt index ffb6882f5..ffb6882f5 100644 --- a/testing/tests/esp-alg-weak/description.txt +++ b/testing/tests/ikev1/esp-alg-weak/description.txt diff --git a/testing/tests/esp-alg-weak/evaltest.dat b/testing/tests/ikev1/esp-alg-weak/evaltest.dat index 72b14e805..72b14e805 100644 --- a/testing/tests/esp-alg-weak/evaltest.dat +++ b/testing/tests/ikev1/esp-alg-weak/evaltest.dat diff --git a/testing/tests/esp-alg-des/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-weak/hosts/carol/etc/ipsec.conf index b4f067b6d..b8ef03cfe 100755 --- a/testing/tests/esp-alg-des/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-weak/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-weak/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-weak/hosts/moon/etc/ipsec.conf index 3f07213ae..691b6b74f 100755 --- a/testing/tests/esp-alg-weak/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/esp-alg-weak/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/esp-alg-weak/posttest.dat b/testing/tests/ikev1/esp-alg-weak/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/esp-alg-weak/posttest.dat +++ b/testing/tests/ikev1/esp-alg-weak/posttest.dat diff --git a/testing/tests/ike-alg-sha2_512/pretest.dat b/testing/tests/ikev1/esp-alg-weak/pretest.dat index 7d077c126..7d077c126 100644 --- a/testing/tests/ike-alg-sha2_512/pretest.dat +++ b/testing/tests/ikev1/esp-alg-weak/pretest.dat diff --git a/testing/tests/esp-alg-weak/test.conf b/testing/tests/ikev1/esp-alg-weak/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/esp-alg-weak/test.conf +++ b/testing/tests/ikev1/esp-alg-weak/test.conf diff --git a/testing/tests/host2host-cert/description.txt b/testing/tests/ikev1/host2host-cert/description.txt index 6be21bf8f..6be21bf8f 100644 --- a/testing/tests/host2host-cert/description.txt +++ b/testing/tests/ikev1/host2host-cert/description.txt diff --git a/testing/tests/host2host-cert/evaltest.dat b/testing/tests/ikev1/host2host-cert/evaltest.dat index d19f970f2..d19f970f2 100644 --- a/testing/tests/host2host-cert/evaltest.dat +++ b/testing/tests/ikev1/host2host-cert/evaltest.dat diff --git a/testing/tests/host2host-transport/posttest.dat b/testing/tests/ikev1/host2host-cert/posttest.dat index 52979508d..5a9150bc8 100644 --- a/testing/tests/host2host-transport/posttest.dat +++ b/testing/tests/ikev1/host2host-cert/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/host2host-cert/pretest.dat b/testing/tests/ikev1/host2host-cert/pretest.dat index 3536fd886..3536fd886 100644 --- a/testing/tests/host2host-cert/pretest.dat +++ b/testing/tests/ikev1/host2host-cert/pretest.dat diff --git a/testing/tests/host2host-cert/test.conf b/testing/tests/ikev1/host2host-cert/test.conf index cf2e704fd..cf2e704fd 100644 --- a/testing/tests/host2host-cert/test.conf +++ b/testing/tests/ikev1/host2host-cert/test.conf diff --git a/testing/tests/host2host-swapped/description.txt b/testing/tests/ikev1/host2host-swapped/description.txt index 34cfe43cc..34cfe43cc 100644 --- a/testing/tests/host2host-swapped/description.txt +++ b/testing/tests/ikev1/host2host-swapped/description.txt diff --git a/testing/tests/host2host-swapped/evaltest.dat b/testing/tests/ikev1/host2host-swapped/evaltest.dat index d19f970f2..d19f970f2 100644 --- a/testing/tests/host2host-swapped/evaltest.dat +++ b/testing/tests/ikev1/host2host-swapped/evaltest.dat diff --git a/testing/tests/host2host-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/host2host-swapped/hosts/moon/etc/ipsec.conf index 4b66a5ecb..10597bc58 100755 --- a/testing/tests/host2host-swapped/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/host2host-swapped/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/host2host-swapped/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/host2host-swapped/hosts/sun/etc/ipsec.conf index a58894b33..45121d967 100755 --- a/testing/tests/host2host-swapped/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/host2host-swapped/hosts/sun/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-cert/posttest.dat b/testing/tests/ikev1/host2host-swapped/posttest.dat index 52979508d..5a9150bc8 100644 --- a/testing/tests/net2net-cert/posttest.dat +++ b/testing/tests/ikev1/host2host-swapped/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/host2host-swapped/pretest.dat b/testing/tests/ikev1/host2host-swapped/pretest.dat index e2d98f2eb..e2d98f2eb 100644 --- a/testing/tests/host2host-swapped/pretest.dat +++ b/testing/tests/ikev1/host2host-swapped/pretest.dat diff --git a/testing/tests/host2host-swapped/test.conf b/testing/tests/ikev1/host2host-swapped/test.conf index cf2e704fd..cf2e704fd 100644 --- a/testing/tests/host2host-swapped/test.conf +++ b/testing/tests/ikev1/host2host-swapped/test.conf diff --git a/testing/tests/host2host-transport/description.txt b/testing/tests/ikev1/host2host-transport/description.txt index fe3482c96..fe3482c96 100644 --- a/testing/tests/host2host-transport/description.txt +++ b/testing/tests/ikev1/host2host-transport/description.txt diff --git a/testing/tests/host2host-transport/evaltest.dat b/testing/tests/ikev1/host2host-transport/evaltest.dat index d19f970f2..d19f970f2 100644 --- a/testing/tests/host2host-transport/evaltest.dat +++ b/testing/tests/ikev1/host2host-transport/evaltest.dat diff --git a/testing/tests/host2host-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/host2host-transport/hosts/moon/etc/ipsec.conf index af5000fa8..44ac885ce 100755 --- a/testing/tests/host2host-transport/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/host2host-transport/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/host2host-transport/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/host2host-transport/hosts/sun/etc/ipsec.conf index 10bea9847..a89e799bd 100755 --- a/testing/tests/host2host-transport/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/host2host-transport/hosts/sun/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/host2host-cert/posttest.dat b/testing/tests/ikev1/host2host-transport/posttest.dat index 52979508d..5a9150bc8 100644 --- a/testing/tests/host2host-cert/posttest.dat +++ b/testing/tests/ikev1/host2host-transport/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/host2host-transport/pretest.dat b/testing/tests/ikev1/host2host-transport/pretest.dat index e2d98f2eb..e2d98f2eb 100644 --- a/testing/tests/host2host-transport/pretest.dat +++ b/testing/tests/ikev1/host2host-transport/pretest.dat diff --git a/testing/tests/host2host-transport/test.conf b/testing/tests/ikev1/host2host-transport/test.conf index cf2e704fd..cf2e704fd 100644 --- a/testing/tests/host2host-transport/test.conf +++ b/testing/tests/ikev1/host2host-transport/test.conf diff --git a/testing/tests/ike-alg-sha2_384/description.txt b/testing/tests/ikev1/ike-alg-sha2_384/description.txt index a347a3fed..a347a3fed 100644 --- a/testing/tests/ike-alg-sha2_384/description.txt +++ b/testing/tests/ikev1/ike-alg-sha2_384/description.txt diff --git a/testing/tests/ike-alg-sha2_384/evaltest.dat b/testing/tests/ikev1/ike-alg-sha2_384/evaltest.dat index 31959f53a..31959f53a 100644 --- a/testing/tests/ike-alg-sha2_384/evaltest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_384/evaltest.dat diff --git a/testing/tests/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf index 027ad4fd2..2bf2f8740 100755 --- a/testing/tests/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf index 46742d8fb..5baf8f1d9 100755 --- a/testing/tests/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-sha2_384/posttest.dat b/testing/tests/ikev1/ike-alg-sha2_384/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/ike-alg-sha2_384/posttest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_384/posttest.dat diff --git a/testing/tests/ike-alg-sha2_384/pretest.dat b/testing/tests/ikev1/ike-alg-sha2_384/pretest.dat index 87e219e73..7d077c126 100644 --- a/testing/tests/ike-alg-sha2_384/pretest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_384/pretest.dat @@ -1,5 +1,5 @@ moon::echo 1 > /proc/sys/net/ipv4/ip_forward carol::ipsec start moon::ipsec start -carol::sleep 3 +carol::sleep 2 carol::ipsec up home diff --git a/testing/tests/ike-alg-sha2_384/test.conf b/testing/tests/ikev1/ike-alg-sha2_384/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/ike-alg-sha2_384/test.conf +++ b/testing/tests/ikev1/ike-alg-sha2_384/test.conf diff --git a/testing/tests/ike-alg-sha2_512/description.txt b/testing/tests/ikev1/ike-alg-sha2_512/description.txt index 1bec4b8c6..1bec4b8c6 100644 --- a/testing/tests/ike-alg-sha2_512/description.txt +++ b/testing/tests/ikev1/ike-alg-sha2_512/description.txt diff --git a/testing/tests/ike-alg-sha2_512/evaltest.dat b/testing/tests/ikev1/ike-alg-sha2_512/evaltest.dat index dbd35429c..dbd35429c 100644 --- a/testing/tests/ike-alg-sha2_512/evaltest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_512/evaltest.dat diff --git a/testing/tests/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf index 1f73cdc21..8b1052f91 100755 --- a/testing/tests/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf index 90911997e..62b93c428 100755 --- a/testing/tests/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug="control crypt" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-sha2_512/posttest.dat b/testing/tests/ikev1/ike-alg-sha2_512/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/ike-alg-sha2_512/posttest.dat +++ b/testing/tests/ikev1/ike-alg-sha2_512/posttest.dat diff --git a/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat b/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat new file mode 100644 index 000000000..7d077c126 --- /dev/null +++ b/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat @@ -0,0 +1,5 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +carol::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ike-alg-sha2_512/test.conf b/testing/tests/ikev1/ike-alg-sha2_512/test.conf index a6c8f026c..a6c8f026c 100644 --- a/testing/tests/ike-alg-sha2_512/test.conf +++ b/testing/tests/ikev1/ike-alg-sha2_512/test.conf diff --git a/testing/tests/ike-alg-strict-fail/description.txt b/testing/tests/ikev1/ike-alg-strict-fail/description.txt index 03c655480..03c655480 100644 --- a/testing/tests/ike-alg-strict-fail/description.txt +++ b/testing/tests/ikev1/ike-alg-strict-fail/description.txt diff --git a/testing/tests/ike-alg-strict-fail/evaltest.dat b/testing/tests/ikev1/ike-alg-strict-fail/evaltest.dat index 931b8855a..931b8855a 100644 --- a/testing/tests/ike-alg-strict-fail/evaltest.dat +++ b/testing/tests/ikev1/ike-alg-strict-fail/evaltest.dat diff --git a/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..4ed2fb645 --- /dev/null +++ b/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + ike=3des-sha + esp=3des-sha1 +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ike-alg-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf index 85cd235dc..1a8b0b966 100755 --- a/testing/tests/ike-alg-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-strict-fail/posttest.dat b/testing/tests/ikev1/ike-alg-strict-fail/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/ike-alg-strict-fail/posttest.dat +++ b/testing/tests/ikev1/ike-alg-strict-fail/posttest.dat diff --git a/testing/tests/esp-alg-strict/pretest.dat b/testing/tests/ikev1/ike-alg-strict-fail/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/esp-alg-strict/pretest.dat +++ b/testing/tests/ikev1/ike-alg-strict-fail/pretest.dat diff --git a/testing/tests/ike-alg-strict-fail/test.conf b/testing/tests/ikev1/ike-alg-strict-fail/test.conf index 7e7848831..7e7848831 100644 --- a/testing/tests/ike-alg-strict-fail/test.conf +++ b/testing/tests/ikev1/ike-alg-strict-fail/test.conf diff --git a/testing/tests/ike-alg-strict/description.txt b/testing/tests/ikev1/ike-alg-strict/description.txt index 35d266e20..35d266e20 100644 --- a/testing/tests/ike-alg-strict/description.txt +++ b/testing/tests/ikev1/ike-alg-strict/description.txt diff --git a/testing/tests/ike-alg-strict/evaltest.dat b/testing/tests/ikev1/ike-alg-strict/evaltest.dat index 46140be8a..46140be8a 100644 --- a/testing/tests/ike-alg-strict/evaltest.dat +++ b/testing/tests/ikev1/ike-alg-strict/evaltest.dat diff --git a/testing/tests/ike-alg-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict/hosts/carol/etc/ipsec.conf index 5a14de070..da86d14df 100755 --- a/testing/tests/ike-alg-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict/hosts/moon/etc/ipsec.conf index 85cd235dc..1a8b0b966 100755 --- a/testing/tests/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ike-alg-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ike-alg-strict/posttest.dat b/testing/tests/ikev1/ike-alg-strict/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/ike-alg-strict/posttest.dat +++ b/testing/tests/ikev1/ike-alg-strict/posttest.dat diff --git a/testing/tests/ike-alg-strict-fail/pretest.dat b/testing/tests/ikev1/ike-alg-strict/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/ike-alg-strict-fail/pretest.dat +++ b/testing/tests/ikev1/ike-alg-strict/pretest.dat diff --git a/testing/tests/ike-alg-strict/test.conf b/testing/tests/ikev1/ike-alg-strict/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/ike-alg-strict/test.conf +++ b/testing/tests/ikev1/ike-alg-strict/test.conf diff --git a/testing/tests/mode-config-push/description.txt b/testing/tests/ikev1/mode-config-push/description.txt index 387c3b409..387c3b409 100644 --- a/testing/tests/mode-config-push/description.txt +++ b/testing/tests/ikev1/mode-config-push/description.txt diff --git a/testing/tests/mode-config-push/evaltest.dat b/testing/tests/ikev1/mode-config-push/evaltest.dat index 7de32d681..7de32d681 100644 --- a/testing/tests/mode-config-push/evaltest.dat +++ b/testing/tests/ikev1/mode-config-push/evaltest.dat diff --git a/testing/tests/mode-config-push/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/carol/etc/ipsec.conf index d66c4d329..db8cfd5c4 100755 --- a/testing/tests/mode-config-push/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-push/hosts/carol/etc/ipsec.conf @@ -1,18 +1,16 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 - modeconfig=push conn home left=PH_IP_CAROL @@ -24,6 +22,7 @@ conn home right=PH_IP_MOON rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org + modeconfig=push auto=add diff --git a/testing/tests/mode-config-push/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/dave/etc/ipsec.conf index bf2625148..cc330b47f 100755 --- a/testing/tests/mode-config-push/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-push/hosts/dave/etc/ipsec.conf @@ -1,18 +1,16 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 - modeconfig=push conn home left=PH_IP_DAVE @@ -24,6 +22,7 @@ conn home right=PH_IP_MOON rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org + modeconfig=push auto=add diff --git a/testing/tests/mode-config-push/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/moon/etc/ipsec.conf index 3416c5d68..3de856642 100755 --- a/testing/tests/mode-config-push/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-push/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default modeconfig=push left=PH_IP_MOON leftsubnet=10.1.0.0/16 - leftsourceip=PH_IP1_MOON + leftsourceip=PH_IP_MOON1 leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org @@ -24,11 +23,11 @@ conn %default conn rw-carol right=%any rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 auto=add conn rw-dave right=%any rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/ikev1/mode-config-push/posttest.dat b/testing/tests/ikev1/mode-config-push/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/mode-config-push/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/mode-config-swapped/pretest.dat b/testing/tests/ikev1/mode-config-push/pretest.dat index 1e45f00fd..bb222992e 100644 --- a/testing/tests/mode-config-swapped/pretest.dat +++ b/testing/tests/ikev1/mode-config-push/pretest.dat @@ -7,3 +7,4 @@ moon::ipsec start carol::sleep 2 carol::ipsec up home dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/mode-config-push/test.conf b/testing/tests/ikev1/mode-config-push/test.conf index 1a8f2a4e0..1a8f2a4e0 100644 --- a/testing/tests/mode-config-push/test.conf +++ b/testing/tests/ikev1/mode-config-push/test.conf diff --git a/testing/tests/mode-config-swapped/description.txt b/testing/tests/ikev1/mode-config-swapped/description.txt index e29e6f654..e29e6f654 100644 --- a/testing/tests/mode-config-swapped/description.txt +++ b/testing/tests/ikev1/mode-config-swapped/description.txt diff --git a/testing/tests/starter-includes/evaltest.dat b/testing/tests/ikev1/mode-config-swapped/evaltest.dat index 7de32d681..9d60cf7b0 100644 --- a/testing/tests/starter-includes/evaltest.dat +++ b/testing/tests/ikev1/mode-config-swapped/evaltest.dat @@ -1,7 +1,7 @@ -carol::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.1::YES +carol::cat /var/log/auth.log::setting virtual IP source address to PH_IP_CAROL1::YES carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.2::YES +dave::cat /var/log/auth.log::setting virtual IP source address to PH_IP_DAVE1::YES dave::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::ipsec status::rw-carol.*STATE_QUICK_R2.*IPsec SA established::YES diff --git a/testing/tests/mode-config-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/carol/etc/ipsec.conf index bee23f4df..3bcc0ff25 100755 --- a/testing/tests/mode-config-swapped/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-swapped/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/mode-config-swapped/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/dave/etc/ipsec.conf index 698cd9673..7933ef15a 100755 --- a/testing/tests/mode-config-swapped/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-swapped/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/mode-config-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/moon/etc/ipsec.conf index b9e401080..53b81a534 100755 --- a/testing/tests/mode-config-swapped/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config-swapped/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -14,7 +13,7 @@ conn %default keyingtries=1 right=PH_IP_MOON rightsubnet=10.1.0.0/16 - rightsourceip=PH_IP1_MOON + rightsourceip=PH_IP_MOON1 rightnexthop=%direct rightcert=moonCert.pem rightid=@moon.strongswan.org @@ -23,11 +22,11 @@ conn %default conn rw-carol left=%any leftid=carol@strongswan.org - leftsourceip=PH_IP1_CAROL + leftsourceip=PH_IP_CAROL1 auto=add conn rw-dave left=%any leftid=dave@strongswan.org - leftsourceip=PH_IP1_DAVE + leftsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/ikev1/mode-config-swapped/posttest.dat b/testing/tests/ikev1/mode-config-swapped/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/mode-config-swapped/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/mode-config-push/pretest.dat b/testing/tests/ikev1/mode-config-swapped/pretest.dat index 1e45f00fd..1e45f00fd 100644 --- a/testing/tests/mode-config-push/pretest.dat +++ b/testing/tests/ikev1/mode-config-swapped/pretest.dat diff --git a/testing/tests/mode-config-swapped/test.conf b/testing/tests/ikev1/mode-config-swapped/test.conf index 1a8f2a4e0..1a8f2a4e0 100644 --- a/testing/tests/mode-config-swapped/test.conf +++ b/testing/tests/ikev1/mode-config-swapped/test.conf diff --git a/testing/tests/mode-config/description.txt b/testing/tests/ikev1/mode-config/description.txt index 3e67f83f1..3e67f83f1 100644 --- a/testing/tests/mode-config/description.txt +++ b/testing/tests/ikev1/mode-config/description.txt diff --git a/testing/tests/mode-config/evaltest.dat b/testing/tests/ikev1/mode-config/evaltest.dat index 7de32d681..9d60cf7b0 100644 --- a/testing/tests/mode-config/evaltest.dat +++ b/testing/tests/ikev1/mode-config/evaltest.dat @@ -1,7 +1,7 @@ -carol::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.1::YES +carol::cat /var/log/auth.log::setting virtual IP source address to PH_IP_CAROL1::YES carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -dave::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.2::YES +dave::cat /var/log/auth.log::setting virtual IP source address to PH_IP_DAVE1::YES dave::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::ipsec status::rw-carol.*STATE_QUICK_R2.*IPsec SA established::YES diff --git a/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..2fd734579 --- /dev/null +++ b/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftsourceip=%modeconfig + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/starter-includes/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/dave/etc/ipsec.conf index da601389c..128c4aa29 100755 --- a/testing/tests/starter-includes/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/moon/etc/ipsec.conf index 49333e217..3367544eb 100755 --- a/testing/tests/mode-config/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/mode-config/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -14,7 +13,7 @@ conn %default keyingtries=1 left=PH_IP_MOON leftsubnet=10.1.0.0/16 - leftsourceip=PH_IP1_MOON + leftsourceip=PH_IP_MOON1 leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org @@ -23,11 +22,11 @@ conn %default conn rw-carol right=%any rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 auto=add conn rw-dave right=%any rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/ikev1/mode-config/posttest.dat b/testing/tests/ikev1/mode-config/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/mode-config/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/mode-config/pretest.dat b/testing/tests/ikev1/mode-config/pretest.dat index 1e45f00fd..bb222992e 100644 --- a/testing/tests/mode-config/pretest.dat +++ b/testing/tests/ikev1/mode-config/pretest.dat @@ -7,3 +7,4 @@ moon::ipsec start carol::sleep 2 carol::ipsec up home dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/mode-config/test.conf b/testing/tests/ikev1/mode-config/test.conf index 1a8f2a4e0..1a8f2a4e0 100644 --- a/testing/tests/mode-config/test.conf +++ b/testing/tests/ikev1/mode-config/test.conf diff --git a/testing/tests/multi-level-ca-ldap/description.txt b/testing/tests/ikev1/multi-level-ca-ldap/description.txt index 18fb88840..18fb88840 100644 --- a/testing/tests/multi-level-ca-ldap/description.txt +++ b/testing/tests/ikev1/multi-level-ca-ldap/description.txt diff --git a/testing/tests/multi-level-ca-ldap/evaltest.dat b/testing/tests/ikev1/multi-level-ca-ldap/evaltest.dat index f504706e2..f504706e2 100644 --- a/testing/tests/multi-level-ca-ldap/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca-ldap/evaltest.dat diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf index 222c3cf67..2917edd8a 100755 --- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf index bfa0ebba3..3c8227f19 100755 --- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem index b76032480..b76032480 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem index 022436de4..022436de4 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables index 8de514a2e..8de514a2e 100755 --- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf index e2b60589b..9b1d03320 100755 --- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem index 154cff654..154cff654 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem index e50477872..e50477872 100644 --- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem +++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem diff --git a/testing/tests/multi-level-ca-ldap/posttest.dat b/testing/tests/ikev1/multi-level-ca-ldap/posttest.dat index e618fc419..ec4ba6e10 100644 --- a/testing/tests/multi-level-ca-ldap/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca-ldap/posttest.dat @@ -1,4 +1,3 @@ -moon::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/multi-level-ca-ldap/pretest.dat b/testing/tests/ikev1/multi-level-ca-ldap/pretest.dat index 322f42102..322f42102 100644 --- a/testing/tests/multi-level-ca-ldap/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-ldap/pretest.dat diff --git a/testing/tests/multi-level-ca-ldap/test.conf b/testing/tests/ikev1/multi-level-ca-ldap/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/multi-level-ca-ldap/test.conf +++ b/testing/tests/ikev1/multi-level-ca-ldap/test.conf diff --git a/testing/tests/multi-level-ca-loop/description.txt b/testing/tests/ikev1/multi-level-ca-loop/description.txt index 9b63c2c66..9b63c2c66 100644 --- a/testing/tests/multi-level-ca-loop/description.txt +++ b/testing/tests/ikev1/multi-level-ca-loop/description.txt diff --git a/testing/tests/multi-level-ca-loop/evaltest.dat b/testing/tests/ikev1/multi-level-ca-loop/evaltest.dat index 781a7b4ac..781a7b4ac 100644 --- a/testing/tests/multi-level-ca-loop/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca-loop/evaltest.dat diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.conf index c56678b59..2c645ead6 100755 --- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.conf index 343042f15..dcf3c94c7 100755 --- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem index efb939e3a..efb939e3a 100644 --- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem index 90e207c4b..90e207c4b 100644 --- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem diff --git a/testing/tests/multi-level-ca-loop/posttest.dat b/testing/tests/ikev1/multi-level-ca-loop/posttest.dat index 076f51f4d..076f51f4d 100644 --- a/testing/tests/multi-level-ca-loop/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca-loop/posttest.dat diff --git a/testing/tests/multi-level-ca-loop/pretest.dat b/testing/tests/ikev1/multi-level-ca-loop/pretest.dat index 0a0ec22bf..0a0ec22bf 100644 --- a/testing/tests/multi-level-ca-loop/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-loop/pretest.dat diff --git a/testing/tests/multi-level-ca-loop/test.conf b/testing/tests/ikev1/multi-level-ca-loop/test.conf index 3189fdfc7..3189fdfc7 100644 --- a/testing/tests/multi-level-ca-loop/test.conf +++ b/testing/tests/ikev1/multi-level-ca-loop/test.conf diff --git a/testing/tests/multi-level-ca-revoked/description.txt b/testing/tests/ikev1/multi-level-ca-revoked/description.txt index c91ac285b..c91ac285b 100644 --- a/testing/tests/multi-level-ca-revoked/description.txt +++ b/testing/tests/ikev1/multi-level-ca-revoked/description.txt diff --git a/testing/tests/multi-level-ca-revoked/evaltest.dat b/testing/tests/ikev1/multi-level-ca-revoked/evaltest.dat index 0fd1cae8c..0fd1cae8c 100644 --- a/testing/tests/multi-level-ca-revoked/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca-revoked/evaltest.dat diff --git a/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..93bd80758 --- /dev/null +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf index 39a298de9..ab336c3c8 100755 --- a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem index c380a5110..c380a5110 100644 --- a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem diff --git a/testing/tests/multi-level-ca-revoked/posttest.dat b/testing/tests/ikev1/multi-level-ca-revoked/posttest.dat index f84b7e37b..f84b7e37b 100644 --- a/testing/tests/multi-level-ca-revoked/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca-revoked/posttest.dat diff --git a/testing/tests/multi-level-ca-revoked/pretest.dat b/testing/tests/ikev1/multi-level-ca-revoked/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/multi-level-ca-revoked/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-revoked/pretest.dat diff --git a/testing/tests/multi-level-ca-revoked/test.conf b/testing/tests/ikev1/multi-level-ca-revoked/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/multi-level-ca-revoked/test.conf +++ b/testing/tests/ikev1/multi-level-ca-revoked/test.conf diff --git a/testing/tests/multi-level-ca-strict/description.txt b/testing/tests/ikev1/multi-level-ca-strict/description.txt index 32413e3de..32413e3de 100644 --- a/testing/tests/multi-level-ca-strict/description.txt +++ b/testing/tests/ikev1/multi-level-ca-strict/description.txt diff --git a/testing/tests/multi-level-ca-strict/evaltest.dat b/testing/tests/ikev1/multi-level-ca-strict/evaltest.dat index 5a181a62d..5a181a62d 100644 --- a/testing/tests/multi-level-ca-strict/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca-strict/evaltest.dat diff --git a/testing/tests/wildcards/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.conf index de179c565..d6d32a39d 100755 --- a/testing/tests/wildcards/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.conf index 2fb6a301e..6156fadba 100755 --- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem index b76032480..b76032480 100644 --- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem index 022436de4..022436de4 100644 --- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.conf index 6ed262d20..6b4e37b35 100755 --- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem index 154cff654..154cff654 100644 --- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem index e50477872..e50477872 100644 --- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem +++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem diff --git a/testing/tests/multi-level-ca-strict/posttest.dat b/testing/tests/ikev1/multi-level-ca-strict/posttest.dat index 1646d5ed2..1646d5ed2 100644 --- a/testing/tests/multi-level-ca-strict/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca-strict/posttest.dat diff --git a/testing/tests/multi-level-ca-strict/pretest.dat b/testing/tests/ikev1/multi-level-ca-strict/pretest.dat index 67c50c2ef..67c50c2ef 100644 --- a/testing/tests/multi-level-ca-strict/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca-strict/pretest.dat diff --git a/testing/tests/multi-level-ca-strict/test.conf b/testing/tests/ikev1/multi-level-ca-strict/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/multi-level-ca-strict/test.conf +++ b/testing/tests/ikev1/multi-level-ca-strict/test.conf diff --git a/testing/tests/multi-level-ca/description.txt b/testing/tests/ikev1/multi-level-ca/description.txt index 64825cb30..64825cb30 100644 --- a/testing/tests/multi-level-ca/description.txt +++ b/testing/tests/ikev1/multi-level-ca/description.txt diff --git a/testing/tests/multi-level-ca/evaltest.dat b/testing/tests/ikev1/multi-level-ca/evaltest.dat index 72f620b8e..72f620b8e 100644 --- a/testing/tests/multi-level-ca/evaltest.dat +++ b/testing/tests/ikev1/multi-level-ca/evaltest.dat diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.conf index e851a82f0..316cdaecc 100755 --- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem index 2990d6a12..2990d6a12 100644 --- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem index b91f9bf81..b91f9bf81 100644 --- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.conf index 458a4ca5e..5838f5f2f 100755 --- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem index b76032480..b76032480 100644 --- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem index 022436de4..022436de4 100644 --- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.conf index e60bbc016..e47d453e4 100755 --- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem index 154cff654..154cff654 100644 --- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem index e50477872..e50477872 100644 --- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem +++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem diff --git a/testing/tests/multi-level-ca/posttest.dat b/testing/tests/ikev1/multi-level-ca/posttest.dat index 1646d5ed2..1646d5ed2 100644 --- a/testing/tests/multi-level-ca/posttest.dat +++ b/testing/tests/ikev1/multi-level-ca/posttest.dat diff --git a/testing/tests/multi-level-ca/pretest.dat b/testing/tests/ikev1/multi-level-ca/pretest.dat index 67c50c2ef..67c50c2ef 100644 --- a/testing/tests/multi-level-ca/pretest.dat +++ b/testing/tests/ikev1/multi-level-ca/pretest.dat diff --git a/testing/tests/multi-level-ca/test.conf b/testing/tests/ikev1/multi-level-ca/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/multi-level-ca/test.conf +++ b/testing/tests/ikev1/multi-level-ca/test.conf diff --git a/testing/tests/ikev1/nat-before-esp/description.txt b/testing/tests/ikev1/nat-before-esp/description.txt new file mode 100644 index 000000000..e42ace476 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/description.txt @@ -0,0 +1,6 @@ +An IPsec tunnel connecting the gateway <b>moon</b> with the subnet behind +gateway <b>sun</b> is set up. This host-to-net connection can also be +used by the clients <b>alice</b> and <b>venus</b> via the trick of NAT-ing +them to the outer IP address of gateway <b>moon</b> prior to tunnelling. +The IPsec tunnel is first tested by <b>moon</b> pinging <b>bob</b> and vice versa, +followed by the NAT-ed clients <b>alice</b> and <b>venus</b> pinging <b>bob</b>. diff --git a/testing/tests/ikev1/nat-before-esp/evaltest.dat b/testing/tests/ikev1/nat-before-esp/evaltest.dat new file mode 100644 index 000000000..d466038ed --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/evaltest.dat @@ -0,0 +1,9 @@ +moon::ipsec status::host-net.*STATE_QUICK_I2.*IPsec SA established::YES +sun::ipsec status::host-net.*STATE_QUICK_R2.*IPsec SA established::YES +moon::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +bob::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES +bob::tcpdump::ICMP::YES diff --git a/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables new file mode 100755 index 000000000..f87ec0e58 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables @@ -0,0 +1,83 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +opts="start stop reload" + +depend() { + before net + need logger +} + +start() { + ebegin "Starting firewall" + + # enable IP forwarding + echo 1 > /proc/sys/net/ipv4/ip_forward + + # default policy is DROP + /sbin/iptables -P INPUT DROP + /sbin/iptables -P OUTPUT DROP + /sbin/iptables -P FORWARD DROP + + # NAT traffic from 10.1.0.0/16 + iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -j MASQUERADE + + # forward traffic from 10.1.0.0/16 to POSTROUTING chain + iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -d 10.2.0.0/16 -j ACCEPT + iptables -A FORWARD -o eth1 -i eth0 -d 10.1.0.0/16 -s 10.2.0.0/16 -j ACCEPT + + # allow esp + iptables -A INPUT -i eth0 -p 50 -j ACCEPT + iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT + + # allow IKE + iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT + iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + + # allow crl fetch from winnetou + iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT + iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + + # allow ssh + iptables -A INPUT -p tcp --dport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + + eend $? +} + +stop() { + ebegin "Stopping firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + + if [ $a == nat ]; then + /sbin/iptables -t nat -P PREROUTING ACCEPT + /sbin/iptables -t nat -P POSTROUTING ACCEPT + /sbin/iptables -t nat -P OUTPUT ACCEPT + elif [ $a == mangle ]; then + /sbin/iptables -t mangle -P PREROUTING ACCEPT + /sbin/iptables -t mangle -P INPUT ACCEPT + /sbin/iptables -t mangle -P FORWARD ACCEPT + /sbin/iptables -t mangle -P OUTPUT ACCEPT + /sbin/iptables -t mangle -P POSTROUTING ACCEPT + elif [ $a == filter ]; then + /sbin/iptables -t filter -P INPUT ACCEPT + /sbin/iptables -t filter -P FORWARD ACCEPT + /sbin/iptables -t filter -P OUTPUT ACCEPT + fi + done + eend $? +} + +reload() { + ebegin "Flushing firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + done; + eend $? + start +} + diff --git a/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..9637dcf06 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn host-net + left=192.168.0.1 + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=192.168.0.2 + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=add diff --git a/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..506417867 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + nat_traversal=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn host-net + left=192.168.0.2 + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + leftsubnet=10.2.0.0/16 + right=%any + auto=add diff --git a/testing/tests/host2host-swapped/posttest.dat b/testing/tests/ikev1/nat-before-esp/posttest.dat index 52979508d..307b96888 100644 --- a/testing/tests/host2host-swapped/posttest.dat +++ b/testing/tests/ikev1/nat-before-esp/posttest.dat @@ -1,5 +1,4 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L +moon::iptables -t nat -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev1/nat-before-esp/pretest.dat b/testing/tests/ikev1/nat-before-esp/pretest.dat new file mode 100644 index 000000000..75565540a --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 2 +moon::ipsec up host-net diff --git a/testing/tests/ikev1/nat-before-esp/test.conf b/testing/tests/ikev1/nat-before-esp/test.conf new file mode 100644 index 000000000..4234eaf63 --- /dev/null +++ b/testing/tests/ikev1/nat-before-esp/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun bob" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/nat-one-rw/description.txt b/testing/tests/ikev1/nat-one-rw/description.txt index c3b9bb820..c3b9bb820 100644 --- a/testing/tests/nat-one-rw/description.txt +++ b/testing/tests/ikev1/nat-one-rw/description.txt diff --git a/testing/tests/nat-one-rw/evaltest.dat b/testing/tests/ikev1/nat-one-rw/evaltest.dat index bc193963d..bc193963d 100644 --- a/testing/tests/nat-one-rw/evaltest.dat +++ b/testing/tests/ikev1/nat-one-rw/evaltest.dat diff --git a/testing/tests/nat-one-rw/posttest.dat b/testing/tests/ikev1/nat-one-rw/posttest.dat index af8e00575..cd0d4df25 100644 --- a/testing/tests/nat-one-rw/posttest.dat +++ b/testing/tests/ikev1/nat-one-rw/posttest.dat @@ -1,8 +1,6 @@ -alice::iptables -v -n -L -sun::iptables -v -n -L alice::ipsec stop sun::ipsec stop alice::/etc/init.d/iptables stop 2> /dev/null sun::/etc/init.d/iptables stop 2> /dev/null moon::iptables -t nat -F - +moon::conntrack -F diff --git a/testing/tests/nat-one-rw/pretest.dat b/testing/tests/ikev1/nat-one-rw/pretest.dat index 9dacc672c..9dacc672c 100644 --- a/testing/tests/nat-one-rw/pretest.dat +++ b/testing/tests/ikev1/nat-one-rw/pretest.dat diff --git a/testing/tests/nat-one-rw/test.conf b/testing/tests/ikev1/nat-one-rw/test.conf index d84149aaf..d84149aaf 100644 --- a/testing/tests/nat-one-rw/test.conf +++ b/testing/tests/ikev1/nat-one-rw/test.conf diff --git a/testing/tests/ikev1/nat-two-rw-psk/description.txt b/testing/tests/ikev1/nat-two-rw-psk/description.txt new file mode 100644 index 000000000..c74897d9a --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up +tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +Both roadwarriors share the same Pre-Shared Key (PSK) with the gateway <b>sun</b>. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b> +ping the client <b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat b/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat new file mode 100644 index 000000000..e8aaf0b5f --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat @@ -0,0 +1,9 @@ +alice::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES +venus::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES +sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES +sun::ipsec status::nat-t.*\[PH_IP_ALICE\]::YES +sun::ipsec status::nat-t.*\[PH_IP_VENUS\]::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..e8576f0e7 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + nat_traversal=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + +conn nat-t + left=%defaultroute + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets index e8c151f05..e8c151f05 100644 --- a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..573069f75 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + nat_traversal=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + leftnexthop=%direct + +conn nat-t + left=PH_IP_SUN + leftsubnet=10.2.0.0/16 + leftfirewall=yes + right=%any + rightsubnetwithin=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets new file mode 100644 index 000000000..e8c151f05 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf new file mode 100755 index 000000000..e8576f0e7 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + nat_traversal=yes + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + +conn nat-t + left=%defaultroute + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets new file mode 100644 index 000000000..e8c151f05 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL diff --git a/testing/tests/nat-two-rw/posttest.dat b/testing/tests/ikev1/nat-two-rw-psk/posttest.dat index f019842ed..52572ece8 100644 --- a/testing/tests/nat-two-rw/posttest.dat +++ b/testing/tests/ikev1/nat-two-rw-psk/posttest.dat @@ -1,6 +1,3 @@ -alice::iptables -v -n -L -venus::iptables -v -n -L -sun::iptables -v -n -L sun::ipsec stop alice::ipsec stop venus::ipsec stop @@ -8,4 +5,4 @@ alice::/etc/init.d/iptables stop 2> /dev/null venus::/etc/init.d/iptables stop 2> /dev/null sun::/etc/init.d/iptables stop 2> /dev/null moon::iptables -t nat -F - +moon::conntrack -F diff --git a/testing/tests/ikev1/nat-two-rw-psk/pretest.dat b/testing/tests/ikev1/nat-two-rw-psk/pretest.dat new file mode 100644 index 000000000..6172bd088 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw-psk/pretest.dat @@ -0,0 +1,16 @@ +alice::/etc/init.d/iptables start 2> /dev/null +venus::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +alice::rm /etc/ipsec.d/cacerts/* +venus::rm /etc/ipsec.d/cacerts/* +sun::rm /etc/ipsec.d/cacerts/* +alice::ipsec start +venus::ipsec start +sun::ipsec start +alice::sleep 5 +alice::ipsec up nat-t +venus::sleep 5 +venus::ipsec up nat-t diff --git a/testing/tests/nat-two-rw/test.conf b/testing/tests/ikev1/nat-two-rw-psk/test.conf index 84317fd70..84317fd70 100644 --- a/testing/tests/nat-two-rw/test.conf +++ b/testing/tests/ikev1/nat-two-rw-psk/test.conf diff --git a/testing/tests/nat-two-rw/description.txt b/testing/tests/ikev1/nat-two-rw/description.txt index dcf4b94bd..dcf4b94bd 100644 --- a/testing/tests/nat-two-rw/description.txt +++ b/testing/tests/ikev1/nat-two-rw/description.txt diff --git a/testing/tests/nat-two-rw/evaltest.dat b/testing/tests/ikev1/nat-two-rw/evaltest.dat index b1a7d59ee..b1a7d59ee 100644 --- a/testing/tests/nat-two-rw/evaltest.dat +++ b/testing/tests/ikev1/nat-two-rw/evaltest.dat diff --git a/testing/tests/ikev1/nat-two-rw/posttest.dat b/testing/tests/ikev1/nat-two-rw/posttest.dat new file mode 100644 index 000000000..52572ece8 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw/posttest.dat @@ -0,0 +1,8 @@ +sun::ipsec stop +alice::ipsec stop +venus::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/nat-two-rw/pretest.dat b/testing/tests/ikev1/nat-two-rw/pretest.dat index dd5259936..dd5259936 100644 --- a/testing/tests/nat-two-rw/pretest.dat +++ b/testing/tests/ikev1/nat-two-rw/pretest.dat diff --git a/testing/tests/ikev1/nat-two-rw/test.conf b/testing/tests/ikev1/nat-two-rw/test.conf new file mode 100644 index 000000000..84317fd70 --- /dev/null +++ b/testing/tests/ikev1/nat-two-rw/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice venus sun" diff --git a/testing/tests/net2net-cert/description.txt b/testing/tests/ikev1/net2net-cert/description.txt index 7eea9192f..7eea9192f 100644 --- a/testing/tests/net2net-cert/description.txt +++ b/testing/tests/ikev1/net2net-cert/description.txt diff --git a/testing/tests/net2net-cert/evaltest.dat b/testing/tests/ikev1/net2net-cert/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-cert/evaltest.dat +++ b/testing/tests/ikev1/net2net-cert/evaltest.dat diff --git a/testing/tests/ikev1/net2net-cert/posttest.dat b/testing/tests/ikev1/net2net-cert/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-cert/pretest.dat b/testing/tests/ikev1/net2net-cert/pretest.dat index 9f60760c6..9f60760c6 100644 --- a/testing/tests/net2net-cert/pretest.dat +++ b/testing/tests/ikev1/net2net-cert/pretest.dat diff --git a/testing/tests/net2net-cert/test.conf b/testing/tests/ikev1/net2net-cert/test.conf index d9a61590f..d9a61590f 100644 --- a/testing/tests/net2net-cert/test.conf +++ b/testing/tests/ikev1/net2net-cert/test.conf diff --git a/testing/tests/net2net-pgp/description.txt b/testing/tests/ikev1/net2net-pgp/description.txt index c85f2e5d0..c85f2e5d0 100644 --- a/testing/tests/net2net-pgp/description.txt +++ b/testing/tests/ikev1/net2net-pgp/description.txt diff --git a/testing/tests/net2net-pgp/evaltest.dat b/testing/tests/ikev1/net2net-pgp/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-pgp/evaltest.dat +++ b/testing/tests/ikev1/net2net-pgp/evaltest.dat diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.conf index e7de6cf0b..eb72ed85f 100755 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.conf @@ -1,10 +1,9 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control nocrsend=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc index 135cfaec0..135cfaec0 100644 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc index 32f204b10..32f204b10 100644 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc index 6524773e0..6524773e0 100644 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.secrets index afb1ff927..afb1ff927 100644 --- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.conf index 5dd8a8587..205f235c8 100755 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.conf @@ -1,10 +1,9 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control nocrsend=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc index 135cfaec0..135cfaec0 100644 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc index 32f204b10..32f204b10 100644 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc index de2393649..de2393649 100644 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.secrets index ee98b1611..ee98b1611 100644 --- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.secrets diff --git a/testing/tests/net2net-pgp/posttest.dat b/testing/tests/ikev1/net2net-pgp/posttest.dat index 80e765dfc..fafcde975 100644 --- a/testing/tests/net2net-pgp/posttest.dat +++ b/testing/tests/ikev1/net2net-pgp/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L moon::ipsec stop sun::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-pgp/pretest.dat b/testing/tests/ikev1/net2net-pgp/pretest.dat index 9e40684ab..9e40684ab 100644 --- a/testing/tests/net2net-pgp/pretest.dat +++ b/testing/tests/ikev1/net2net-pgp/pretest.dat diff --git a/testing/tests/net2net-pgp/test.conf b/testing/tests/ikev1/net2net-pgp/test.conf index f74d0f7d6..f74d0f7d6 100644 --- a/testing/tests/net2net-pgp/test.conf +++ b/testing/tests/ikev1/net2net-pgp/test.conf diff --git a/testing/tests/net2net-psk-fail/description.txt b/testing/tests/ikev1/net2net-psk-fail/description.txt index 5a794bd17..5a794bd17 100644 --- a/testing/tests/net2net-psk-fail/description.txt +++ b/testing/tests/ikev1/net2net-psk-fail/description.txt diff --git a/testing/tests/net2net-psk-fail/evaltest.dat b/testing/tests/ikev1/net2net-psk-fail/evaltest.dat index 7f7cb9726..7f7cb9726 100644 --- a/testing/tests/net2net-psk-fail/evaltest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/evaltest.dat diff --git a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.conf index 87396e455..e095c0b7b 100755 --- a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.secrets index be95c4d99..be95c4d99 100644 --- a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.conf index 7e102b25c..b21f863f5 100755 --- a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.secrets index b53577e1d..b53577e1d 100644 --- a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.secrets diff --git a/testing/tests/net2net-psk-fail/posttest.dat b/testing/tests/ikev1/net2net-psk-fail/posttest.dat index dff181797..dff181797 100644 --- a/testing/tests/net2net-psk-fail/posttest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/posttest.dat diff --git a/testing/tests/net2net-psk-fail/pretest.dat b/testing/tests/ikev1/net2net-psk-fail/pretest.dat index aa8e332e0..aa8e332e0 100644 --- a/testing/tests/net2net-psk-fail/pretest.dat +++ b/testing/tests/ikev1/net2net-psk-fail/pretest.dat diff --git a/testing/tests/net2net-psk-fail/test.conf b/testing/tests/ikev1/net2net-psk-fail/test.conf index f6e064e7d..f6e064e7d 100644 --- a/testing/tests/net2net-psk-fail/test.conf +++ b/testing/tests/ikev1/net2net-psk-fail/test.conf diff --git a/testing/tests/net2net-psk/description.txt b/testing/tests/ikev1/net2net-psk/description.txt index 02cddbb83..02cddbb83 100644 --- a/testing/tests/net2net-psk/description.txt +++ b/testing/tests/ikev1/net2net-psk/description.txt diff --git a/testing/tests/net2net-psk/evaltest.dat b/testing/tests/ikev1/net2net-psk/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-psk/evaltest.dat +++ b/testing/tests/ikev1/net2net-psk/evaltest.dat diff --git a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.conf index 51c53a505..a3536e2b2 100755 --- a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.secrets index be95c4d99..be95c4d99 100644 --- a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.conf index 9c3695178..12e38962e 100755 --- a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.secrets index be95c4d99..be95c4d99 100644 --- a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.secrets diff --git a/testing/tests/ikev1/net2net-psk/posttest.dat b/testing/tests/ikev1/net2net-psk/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-psk/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-psk/pretest.dat b/testing/tests/ikev1/net2net-psk/pretest.dat index 9e40684ab..9e40684ab 100644 --- a/testing/tests/net2net-psk/pretest.dat +++ b/testing/tests/ikev1/net2net-psk/pretest.dat diff --git a/testing/tests/net2net-psk/test.conf b/testing/tests/ikev1/net2net-psk/test.conf index f74d0f7d6..f74d0f7d6 100644 --- a/testing/tests/net2net-psk/test.conf +++ b/testing/tests/ikev1/net2net-psk/test.conf diff --git a/testing/tests/net2net-route/description.txt b/testing/tests/ikev1/net2net-route/description.txt index 323f09555..323f09555 100644 --- a/testing/tests/net2net-route/description.txt +++ b/testing/tests/ikev1/net2net-route/description.txt diff --git a/testing/tests/net2net-route/evaltest.dat b/testing/tests/ikev1/net2net-route/evaltest.dat index 38d589e5a..38d589e5a 100644 --- a/testing/tests/net2net-route/evaltest.dat +++ b/testing/tests/ikev1/net2net-route/evaltest.dat diff --git a/testing/tests/net2net-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-route/hosts/moon/etc/ipsec.conf index 4063ae05f..466235099 100755 --- a/testing/tests/net2net-route/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-route/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ikev1/net2net-route/posttest.dat b/testing/tests/ikev1/net2net-route/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-route/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-route/pretest.dat b/testing/tests/ikev1/net2net-route/pretest.dat index 2eef7de19..2eef7de19 100644 --- a/testing/tests/net2net-route/pretest.dat +++ b/testing/tests/ikev1/net2net-route/pretest.dat diff --git a/testing/tests/net2net-route/test.conf b/testing/tests/ikev1/net2net-route/test.conf index d9a61590f..d9a61590f 100644 --- a/testing/tests/net2net-route/test.conf +++ b/testing/tests/ikev1/net2net-route/test.conf diff --git a/testing/tests/net2net-rsa/description.txt b/testing/tests/ikev1/net2net-rsa/description.txt index a23fae8c3..a23fae8c3 100644 --- a/testing/tests/net2net-rsa/description.txt +++ b/testing/tests/ikev1/net2net-rsa/description.txt diff --git a/testing/tests/net2net-rsa/evaltest.dat b/testing/tests/ikev1/net2net-rsa/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-rsa/evaltest.dat +++ b/testing/tests/ikev1/net2net-rsa/evaltest.dat diff --git a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.conf index 772762321..e4c0614a1 100755 --- a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.secrets index 9859ae8ed..9859ae8ed 100644 --- a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.conf index 9626ef168..d0c8752a3 100755 --- a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.secrets index bf976a8d3..bf976a8d3 100644 --- a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.secrets +++ b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.secrets diff --git a/testing/tests/ikev1/net2net-rsa/posttest.dat b/testing/tests/ikev1/net2net-rsa/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-rsa/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-rsa/pretest.dat b/testing/tests/ikev1/net2net-rsa/pretest.dat index 9e40684ab..9e40684ab 100644 --- a/testing/tests/net2net-rsa/pretest.dat +++ b/testing/tests/ikev1/net2net-rsa/pretest.dat diff --git a/testing/tests/net2net-rsa/test.conf b/testing/tests/ikev1/net2net-rsa/test.conf index f74d0f7d6..f74d0f7d6 100644 --- a/testing/tests/net2net-rsa/test.conf +++ b/testing/tests/ikev1/net2net-rsa/test.conf diff --git a/testing/tests/net2net-start/description.txt b/testing/tests/ikev1/net2net-start/description.txt index f5320685e..f5320685e 100644 --- a/testing/tests/net2net-start/description.txt +++ b/testing/tests/ikev1/net2net-start/description.txt diff --git a/testing/tests/net2net-start/evaltest.dat b/testing/tests/ikev1/net2net-start/evaltest.dat index 7cbf92687..7cbf92687 100644 --- a/testing/tests/net2net-start/evaltest.dat +++ b/testing/tests/ikev1/net2net-start/evaltest.dat diff --git a/testing/tests/net2net-start/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-start/hosts/moon/etc/ipsec.conf index 677955bc1..95abd046a 100755 --- a/testing/tests/net2net-start/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/net2net-start/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ikev1/net2net-start/posttest.dat b/testing/tests/ikev1/net2net-start/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev1/net2net-start/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-start/pretest.dat b/testing/tests/ikev1/net2net-start/pretest.dat index ed8f39316..ed8f39316 100644 --- a/testing/tests/net2net-start/pretest.dat +++ b/testing/tests/ikev1/net2net-start/pretest.dat diff --git a/testing/tests/net2net-start/test.conf b/testing/tests/ikev1/net2net-start/test.conf index d9a61590f..d9a61590f 100644 --- a/testing/tests/net2net-start/test.conf +++ b/testing/tests/ikev1/net2net-start/test.conf diff --git a/testing/tests/no-priv-key/description.txt b/testing/tests/ikev1/no-priv-key/description.txt index 21b8eccb1..21b8eccb1 100644 --- a/testing/tests/no-priv-key/description.txt +++ b/testing/tests/ikev1/no-priv-key/description.txt diff --git a/testing/tests/no-priv-key/evaltest.dat b/testing/tests/ikev1/no-priv-key/evaltest.dat index 9bd85ba12..9bd85ba12 100644 --- a/testing/tests/no-priv-key/evaltest.dat +++ b/testing/tests/ikev1/no-priv-key/evaltest.dat diff --git a/testing/tests/no-priv-key/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/no-priv-key/hosts/carol/etc/ipsec.secrets index 23b311aa6..23b311aa6 100644 --- a/testing/tests/no-priv-key/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/no-priv-key/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/no-priv-key/posttest.dat b/testing/tests/ikev1/no-priv-key/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/no-priv-key/posttest.dat +++ b/testing/tests/ikev1/no-priv-key/posttest.dat diff --git a/testing/tests/no-priv-key/pretest.dat b/testing/tests/ikev1/no-priv-key/pretest.dat index d92333d86..d92333d86 100644 --- a/testing/tests/no-priv-key/pretest.dat +++ b/testing/tests/ikev1/no-priv-key/pretest.dat diff --git a/testing/tests/no-priv-key/test.conf b/testing/tests/ikev1/no-priv-key/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/no-priv-key/test.conf +++ b/testing/tests/ikev1/no-priv-key/test.conf diff --git a/testing/tests/ocsp-revoked/description.txt b/testing/tests/ikev1/ocsp-revoked/description.txt index cbdd1305a..cbdd1305a 100644 --- a/testing/tests/ocsp-revoked/description.txt +++ b/testing/tests/ikev1/ocsp-revoked/description.txt diff --git a/testing/tests/ocsp-revoked/evaltest.dat b/testing/tests/ikev1/ocsp-revoked/evaltest.dat index f5286cb61..f5286cb61 100644 --- a/testing/tests/ocsp-revoked/evaltest.dat +++ b/testing/tests/ikev1/ocsp-revoked/evaltest.dat diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.conf index 7d4384767..5b32ef007 100755 --- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem index 5b742fc9e..5b742fc9e 100644 --- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem +++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem index 8aefcc5a6..8aefcc5a6 100644 --- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem +++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.secrets index 8e31be4cb..8e31be4cb 100644 --- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/ocsp-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ocsp-revoked/hosts/moon/etc/ipsec.conf index 7134b6ee9..d9da3f78a 100755 --- a/testing/tests/ocsp-strict/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ocsp-revoked/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/ocsp-revoked/posttest.dat b/testing/tests/ikev1/ocsp-revoked/posttest.dat index d883459e7..d742e8410 100644 --- a/testing/tests/ocsp-revoked/posttest.dat +++ b/testing/tests/ikev1/ocsp-revoked/posttest.dat @@ -1,5 +1,4 @@ moon::ipsec stop carol::ipsec stop -winnetou::killall openssl carol::rm /etc/ipsec.d/private/* carol::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/xauth-rsa-nosecret/pretest.dat b/testing/tests/ikev1/ocsp-revoked/pretest.dat index f5aa989fe..d92333d86 100644 --- a/testing/tests/xauth-rsa-nosecret/pretest.dat +++ b/testing/tests/ikev1/ocsp-revoked/pretest.dat @@ -1,4 +1,4 @@ -carol::ipsec start moon::ipsec start +carol::ipsec start carol::sleep 2 carol::ipsec up home diff --git a/testing/tests/ocsp-revoked/test.conf b/testing/tests/ikev1/ocsp-revoked/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/ocsp-revoked/test.conf +++ b/testing/tests/ikev1/ocsp-revoked/test.conf diff --git a/testing/tests/ocsp-strict/description.txt b/testing/tests/ikev1/ocsp-strict/description.txt index 7cb983140..7cb983140 100644 --- a/testing/tests/ocsp-strict/description.txt +++ b/testing/tests/ikev1/ocsp-strict/description.txt diff --git a/testing/tests/ocsp-strict/evaltest.dat b/testing/tests/ikev1/ocsp-strict/evaltest.dat index 66b27aaac..66b27aaac 100644 --- a/testing/tests/ocsp-strict/evaltest.dat +++ b/testing/tests/ikev1/ocsp-strict/evaltest.dat diff --git a/testing/tests/ocsp-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ocsp-strict/hosts/carol/etc/ipsec.conf index b34719401..fd950ecd5 100755 --- a/testing/tests/ocsp-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/ocsp-strict/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/ocsp-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ocsp-strict/hosts/moon/etc/ipsec.conf index 7134b6ee9..d9da3f78a 100755 --- a/testing/tests/ocsp-revoked/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/ocsp-strict/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=yes + charonstart=no ca strongswan cacert=strongswanCert.pem diff --git a/testing/tests/rw-psk-no-policy/posttest.dat b/testing/tests/ikev1/ocsp-strict/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/rw-psk-no-policy/posttest.dat +++ b/testing/tests/ikev1/ocsp-strict/posttest.dat diff --git a/testing/tests/ocsp-revoked/pretest.dat b/testing/tests/ikev1/ocsp-strict/pretest.dat index d5516fd3b..d92333d86 100644 --- a/testing/tests/ocsp-revoked/pretest.dat +++ b/testing/tests/ikev1/ocsp-strict/pretest.dat @@ -1,4 +1,3 @@ -winnetou::/etc/openssl/start-ocsp moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ocsp-strict/test.conf b/testing/tests/ikev1/ocsp-strict/test.conf index 2b240d895..2b240d895 100644 --- a/testing/tests/ocsp-strict/test.conf +++ b/testing/tests/ikev1/ocsp-strict/test.conf diff --git a/testing/tests/protoport-dual/description.txt b/testing/tests/ikev1/protoport-dual/description.txt index 7bed8b959..7bed8b959 100644 --- a/testing/tests/protoport-dual/description.txt +++ b/testing/tests/ikev1/protoport-dual/description.txt diff --git a/testing/tests/protoport-pass/evaltest.dat b/testing/tests/ikev1/protoport-dual/evaltest.dat index 625c8c54c..11c34929f 100644 --- a/testing/tests/protoport-pass/evaltest.dat +++ b/testing/tests/ikev1/protoport-dual/evaltest.dat @@ -1,7 +1,7 @@ carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/protoport-dual/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-dual/hosts/carol/etc/ipsec.conf index 9e05ecf61..0dc25b7bb 100755 --- a/testing/tests/protoport-dual/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-dual/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-dual/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-dual/hosts/moon/etc/ipsec.conf index 84b9b0ba3..3b01128c2 100755 --- a/testing/tests/protoport-dual/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-dual/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-pass/posttest.dat b/testing/tests/ikev1/protoport-dual/posttest.dat index 26848212b..94a400606 100644 --- a/testing/tests/protoport-pass/posttest.dat +++ b/testing/tests/ikev1/protoport-dual/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/protoport-dual/pretest.dat b/testing/tests/ikev1/protoport-dual/pretest.dat index d3d0061c3..d3d0061c3 100644 --- a/testing/tests/protoport-dual/pretest.dat +++ b/testing/tests/ikev1/protoport-dual/pretest.dat diff --git a/testing/tests/protoport-dual/test.conf b/testing/tests/ikev1/protoport-dual/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/protoport-dual/test.conf +++ b/testing/tests/ikev1/protoport-dual/test.conf diff --git a/testing/tests/protoport-pass/description.txt b/testing/tests/ikev1/protoport-pass/description.txt index 63744fa47..63744fa47 100644 --- a/testing/tests/protoport-pass/description.txt +++ b/testing/tests/ikev1/protoport-pass/description.txt diff --git a/testing/tests/protoport-dual/evaltest.dat b/testing/tests/ikev1/protoport-pass/evaltest.dat index 625c8c54c..11c34929f 100644 --- a/testing/tests/protoport-dual/evaltest.dat +++ b/testing/tests/ikev1/protoport-pass/evaltest.dat @@ -1,7 +1,7 @@ carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/protoport-pass/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-pass/hosts/carol/etc/ipsec.conf index ade7308f6..093f9b1fc 100755 --- a/testing/tests/protoport-pass/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-pass/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-pass/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-pass/hosts/moon/etc/ipsec.conf index fd67e2b4b..e64b3be7a 100755 --- a/testing/tests/protoport-pass/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-pass/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-dual/posttest.dat b/testing/tests/ikev1/protoport-pass/posttest.dat index 26848212b..94a400606 100644 --- a/testing/tests/protoport-dual/posttest.dat +++ b/testing/tests/ikev1/protoport-pass/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/protoport-pass/pretest.dat b/testing/tests/ikev1/protoport-pass/pretest.dat index 13b4ad4a0..13b4ad4a0 100644 --- a/testing/tests/protoport-pass/pretest.dat +++ b/testing/tests/ikev1/protoport-pass/pretest.dat diff --git a/testing/tests/protoport-pass/test.conf b/testing/tests/ikev1/protoport-pass/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/protoport-pass/test.conf +++ b/testing/tests/ikev1/protoport-pass/test.conf diff --git a/testing/tests/protoport-route/description.txt b/testing/tests/ikev1/protoport-route/description.txt index ec7ec69b0..ec7ec69b0 100644 --- a/testing/tests/protoport-route/description.txt +++ b/testing/tests/ikev1/protoport-route/description.txt diff --git a/testing/tests/protoport-route/evaltest.dat b/testing/tests/ikev1/protoport-route/evaltest.dat index 8f3eb208f..759295675 100644 --- a/testing/tests/protoport-route/evaltest.dat +++ b/testing/tests/ikev1/protoport-route/evaltest.dat @@ -1,5 +1,5 @@ carol::ping -c 2 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES -carol::ping -c 2 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq::YES +carol::ping -c 2 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES carol::ssh PH_IP_ALICE hostname::alice::YES carol::cat /var/log/auth.log::initiate on demand::YES carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES diff --git a/testing/tests/protoport-route/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-route/hosts/carol/etc/ipsec.conf index 31c25c12f..99b410c32 100755 --- a/testing/tests/protoport-route/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-route/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/protoport-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-route/hosts/moon/etc/ipsec.conf index 84b9b0ba3..3b01128c2 100755 --- a/testing/tests/protoport-route/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/protoport-route/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/ikev1/protoport-route/posttest.dat b/testing/tests/ikev1/protoport-route/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/protoport-route/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/protoport-route/pretest.dat b/testing/tests/ikev1/protoport-route/pretest.dat index f233ad48f..f233ad48f 100644 --- a/testing/tests/protoport-route/pretest.dat +++ b/testing/tests/ikev1/protoport-route/pretest.dat diff --git a/testing/tests/protoport-route/test.conf b/testing/tests/ikev1/protoport-route/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/protoport-route/test.conf +++ b/testing/tests/ikev1/protoport-route/test.conf diff --git a/testing/tests/req-pkcs10/description.txt b/testing/tests/ikev1/req-pkcs10/description.txt index a958cb8e8..a958cb8e8 100644 --- a/testing/tests/req-pkcs10/description.txt +++ b/testing/tests/ikev1/req-pkcs10/description.txt diff --git a/testing/tests/req-pkcs10/evaltest.dat b/testing/tests/ikev1/req-pkcs10/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/req-pkcs10/evaltest.dat +++ b/testing/tests/ikev1/req-pkcs10/evaltest.dat diff --git a/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..e32aca0b9 --- /dev/null +++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=myCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.secrets index 167d743df..167d743df 100644 --- a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/scepclient.conf b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/scepclient.conf index 6afd3fa11..6afd3fa11 100644 --- a/testing/tests/req-pkcs10/hosts/carol/etc/scepclient.conf +++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/scepclient.conf diff --git a/testing/tests/req-pkcs10/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/ipsec.secrets index b9ec17dbc..b9ec17dbc 100644 --- a/testing/tests/req-pkcs10/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/req-pkcs10/hosts/moon/etc/scepclient.conf b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/scepclient.conf index da8177348..da8177348 100644 --- a/testing/tests/req-pkcs10/hosts/moon/etc/scepclient.conf +++ b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/scepclient.conf diff --git a/testing/tests/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt b/testing/tests/ikev1/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt index 9b48ee4cf..9b48ee4cf 100644 --- a/testing/tests/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt +++ b/testing/tests/ikev1/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt diff --git a/testing/tests/req-pkcs10/posttest.dat b/testing/tests/ikev1/req-pkcs10/posttest.dat index 534e3af20..933b4b6c4 100644 --- a/testing/tests/req-pkcs10/posttest.dat +++ b/testing/tests/ikev1/req-pkcs10/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/req-pkcs10/pretest.dat b/testing/tests/ikev1/req-pkcs10/pretest.dat index 18b8b16e6..18b8b16e6 100644 --- a/testing/tests/req-pkcs10/pretest.dat +++ b/testing/tests/ikev1/req-pkcs10/pretest.dat diff --git a/testing/tests/req-pkcs10/test.conf b/testing/tests/ikev1/req-pkcs10/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/req-pkcs10/test.conf +++ b/testing/tests/ikev1/req-pkcs10/test.conf diff --git a/testing/tests/rw-cert/description.txt b/testing/tests/ikev1/rw-cert/description.txt index 8df6b1c0d..8df6b1c0d 100644 --- a/testing/tests/rw-cert/description.txt +++ b/testing/tests/ikev1/rw-cert/description.txt diff --git a/testing/tests/rw-cert/evaltest.dat b/testing/tests/ikev1/rw-cert/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/rw-cert/evaltest.dat +++ b/testing/tests/ikev1/rw-cert/evaltest.dat diff --git a/testing/tests/ikev1/rw-cert/posttest.dat b/testing/tests/ikev1/rw-cert/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/rw-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/virtual-ip-swapped/pretest.dat b/testing/tests/ikev1/rw-cert/pretest.dat index 4fe0ee90b..4fe0ee90b 100644 --- a/testing/tests/virtual-ip-swapped/pretest.dat +++ b/testing/tests/ikev1/rw-cert/pretest.dat diff --git a/testing/tests/rw-cert/test.conf b/testing/tests/ikev1/rw-cert/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/rw-cert/test.conf +++ b/testing/tests/ikev1/rw-cert/test.conf diff --git a/testing/tests/rw-psk-fqdn-named/description.txt b/testing/tests/ikev1/rw-psk-fqdn-named/description.txt index adfab2f4d..adfab2f4d 100644 --- a/testing/tests/rw-psk-fqdn-named/description.txt +++ b/testing/tests/ikev1/rw-psk-fqdn-named/description.txt diff --git a/testing/tests/rw-psk-fqdn-named/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/rw-psk-fqdn-named/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn-named/evaltest.dat diff --git a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf index da5e198a8..1e9a27129 100755 --- a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets index db3884e57..db3884e57 100644 --- a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf index c32dfaf9b..05d209c44 100755 --- a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets index 6281340ae..6281340ae 100644 --- a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-fqdn-named/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/pretest.dat index dbf03f552..dbf03f552 100644 --- a/testing/tests/rw-psk-fqdn-named/pretest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn-named/pretest.dat diff --git a/testing/tests/rw-psk-fqdn-named/test.conf b/testing/tests/ikev1/rw-psk-fqdn-named/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/rw-psk-fqdn-named/test.conf +++ b/testing/tests/ikev1/rw-psk-fqdn-named/test.conf diff --git a/testing/tests/rw-psk-fqdn/description.txt b/testing/tests/ikev1/rw-psk-fqdn/description.txt index d6c79afb2..d6c79afb2 100644 --- a/testing/tests/rw-psk-fqdn/description.txt +++ b/testing/tests/ikev1/rw-psk-fqdn/description.txt diff --git a/testing/tests/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/rw-psk-fqdn/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat diff --git a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.conf index da5e198a8..1e9a27129 100755 --- a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets index db3884e57..db3884e57 100644 --- a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.conf index 9a894806c..beda12b3c 100755 --- a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets index 6281340ae..661168fb5 100644 --- a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets @@ -1,7 +1,3 @@ # /etc/ipsec.secrets - strongSwan IPsec secrets file @moon.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL - - - - diff --git a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-fqdn/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat index dbf03f552..dbf03f552 100644 --- a/testing/tests/rw-psk-fqdn/pretest.dat +++ b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat diff --git a/testing/tests/rw-psk-fqdn/test.conf b/testing/tests/ikev1/rw-psk-fqdn/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/rw-psk-fqdn/test.conf +++ b/testing/tests/ikev1/rw-psk-fqdn/test.conf diff --git a/testing/tests/rw-psk-ipv4/description.txt b/testing/tests/ikev1/rw-psk-ipv4/description.txt index b3a0bc192..b3a0bc192 100644 --- a/testing/tests/rw-psk-ipv4/description.txt +++ b/testing/tests/ikev1/rw-psk-ipv4/description.txt diff --git a/testing/tests/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/rw-psk-ipv4/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat diff --git a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.conf index 2c0227b7a..8e27a9ecd 100755 --- a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets index 69313b289..69313b289 100644 --- a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.conf index a75d4e222..f8ce5569c 100755 --- a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets index a8e367950..a8e367950 100644 --- a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-ipv4/pretest.dat b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat index dbf03f552..dbf03f552 100644 --- a/testing/tests/rw-psk-ipv4/pretest.dat +++ b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat diff --git a/testing/tests/rw-psk-ipv4/test.conf b/testing/tests/ikev1/rw-psk-ipv4/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/rw-psk-ipv4/test.conf +++ b/testing/tests/ikev1/rw-psk-ipv4/test.conf diff --git a/testing/tests/rw-psk-no-policy/description.txt b/testing/tests/ikev1/rw-psk-no-policy/description.txt index 0e359414f..0e359414f 100644 --- a/testing/tests/rw-psk-no-policy/description.txt +++ b/testing/tests/ikev1/rw-psk-no-policy/description.txt diff --git a/testing/tests/rw-psk-no-policy/evaltest.dat b/testing/tests/ikev1/rw-psk-no-policy/evaltest.dat index a28377dbd..a28377dbd 100644 --- a/testing/tests/rw-psk-no-policy/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-no-policy/evaltest.dat diff --git a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.conf index 413eff762..c62605bd0 100755 --- a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets index 1b721dc58..1b721dc58 100644 --- a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-no-policy/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-no-policy/hosts/moon/etc/ipsec.conf index ac63abdc9..4584e1408 100755 --- a/testing/tests/rw-psk-no-policy/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-rsa-no-policy/posttest.dat b/testing/tests/ikev1/rw-psk-no-policy/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/rw-rsa-no-policy/posttest.dat +++ b/testing/tests/ikev1/rw-psk-no-policy/posttest.dat diff --git a/testing/tests/rw-psk-no-policy/pretest.dat b/testing/tests/ikev1/rw-psk-no-policy/pretest.dat index 3a7804ddd..3a7804ddd 100644 --- a/testing/tests/rw-psk-no-policy/pretest.dat +++ b/testing/tests/ikev1/rw-psk-no-policy/pretest.dat diff --git a/testing/tests/rw-psk-no-policy/test.conf b/testing/tests/ikev1/rw-psk-no-policy/test.conf index f622c18b7..f622c18b7 100644 --- a/testing/tests/rw-psk-no-policy/test.conf +++ b/testing/tests/ikev1/rw-psk-no-policy/test.conf diff --git a/testing/tests/rw-psk-rsa-mixed/description.txt b/testing/tests/ikev1/rw-psk-rsa-mixed/description.txt index b99a8e5b3..b99a8e5b3 100644 --- a/testing/tests/rw-psk-rsa-mixed/description.txt +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/description.txt diff --git a/testing/tests/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/evaltest.dat index 9e1354121..9e1354121 100644 --- a/testing/tests/rw-psk-rsa-mixed/evaltest.dat +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/evaltest.dat diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf index 69e13b538..b142c75bb 100755 --- a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets index 1b721dc58..1b721dc58 100644 --- a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf index b23248b5b..5916d8fd8 100755 --- a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf @@ -1,9 +1,8 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets index fd33507a7..fd33507a7 100644 --- a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/wildcards/posttest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/posttest.dat index ed530f6d9..ed530f6d9 100644 --- a/testing/tests/wildcards/posttest.dat +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/posttest.dat diff --git a/testing/tests/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/pretest.dat index 35797b589..35797b589 100644 --- a/testing/tests/rw-psk-rsa-mixed/pretest.dat +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/pretest.dat diff --git a/testing/tests/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/test.conf index 699b88e88..699b88e88 100644 --- a/testing/tests/rw-psk-rsa-mixed/test.conf +++ b/testing/tests/ikev1/rw-psk-rsa-mixed/test.conf diff --git a/testing/tests/rw-rsa-no-policy/description.txt b/testing/tests/ikev1/rw-rsa-no-policy/description.txt index c3336b769..c3336b769 100644 --- a/testing/tests/rw-rsa-no-policy/description.txt +++ b/testing/tests/ikev1/rw-rsa-no-policy/description.txt diff --git a/testing/tests/rw-rsa-no-policy/evaltest.dat b/testing/tests/ikev1/rw-rsa-no-policy/evaltest.dat index 188b7bbb5..188b7bbb5 100644 --- a/testing/tests/rw-rsa-no-policy/evaltest.dat +++ b/testing/tests/ikev1/rw-rsa-no-policy/evaltest.dat diff --git a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf index b9318c058..2abe3c147 100755 --- a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf @@ -1,7 +1,5 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control diff --git a/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..e8c151f05 --- /dev/null +++ b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL diff --git a/testing/tests/xauth-rsa-fail/posttest.dat b/testing/tests/ikev1/rw-rsa-no-policy/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/xauth-rsa-fail/posttest.dat +++ b/testing/tests/ikev1/rw-rsa-no-policy/posttest.dat diff --git a/testing/tests/rw-rsa-no-policy/pretest.dat b/testing/tests/ikev1/rw-rsa-no-policy/pretest.dat index 0d2a0dd1f..0d2a0dd1f 100644 --- a/testing/tests/rw-rsa-no-policy/pretest.dat +++ b/testing/tests/ikev1/rw-rsa-no-policy/pretest.dat diff --git a/testing/tests/rw-rsa-no-policy/test.conf b/testing/tests/ikev1/rw-rsa-no-policy/test.conf index f622c18b7..f622c18b7 100644 --- a/testing/tests/rw-rsa-no-policy/test.conf +++ b/testing/tests/ikev1/rw-rsa-no-policy/test.conf diff --git a/testing/tests/self-signed/description.txt b/testing/tests/ikev1/self-signed/description.txt index 2d7bfc2bf..2d7bfc2bf 100644 --- a/testing/tests/self-signed/description.txt +++ b/testing/tests/ikev1/self-signed/description.txt diff --git a/testing/tests/default-keys/evaltest.dat b/testing/tests/ikev1/self-signed/evaltest.dat index f190d7066..f190d7066 100644 --- a/testing/tests/default-keys/evaltest.dat +++ b/testing/tests/ikev1/self-signed/evaltest.dat diff --git a/testing/tests/self-signed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.conf index fcf7a1754..93ea3a80e 100755 --- a/testing/tests/self-signed/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=0 strictcrlpolicy=no nocrsend=yes + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/self-signed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.secrets index 167d743df..167d743df 100644 --- a/testing/tests/self-signed/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/self-signed/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/self-signed/hosts/moon/etc/init.d/iptables index 13ad3063f..13ad3063f 100755 --- a/testing/tests/self-signed/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/self-signed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.conf index 7d7f42b06..98b0030d8 100755 --- a/testing/tests/self-signed/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=0 strictcrlpolicy=no nocrsend=yes + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default keyingtries=1 conn carol - left=192.168.0.1 + left=PH_IP_MOON leftnexthop=%direct leftcert=moonCert.der leftid=@moon.strongswan.org diff --git a/testing/tests/self-signed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.secrets index b9ec17dbc..b9ec17dbc 100644 --- a/testing/tests/self-signed/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/self-signed/hosts/moon/etc/scepclient.conf b/testing/tests/ikev1/self-signed/hosts/moon/etc/scepclient.conf index b84f3e131..b84f3e131 100644 --- a/testing/tests/self-signed/hosts/moon/etc/scepclient.conf +++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/scepclient.conf diff --git a/testing/tests/self-signed/posttest.dat b/testing/tests/ikev1/self-signed/posttest.dat index 52b48b9ef..8cada5e7e 100644 --- a/testing/tests/self-signed/posttest.dat +++ b/testing/tests/ikev1/self-signed/posttest.dat @@ -1,5 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L moon::ipsec stop carol::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/self-signed/pretest.dat b/testing/tests/ikev1/self-signed/pretest.dat index a7cddf677..a7cddf677 100644 --- a/testing/tests/self-signed/pretest.dat +++ b/testing/tests/ikev1/self-signed/pretest.dat diff --git a/testing/tests/self-signed/test.conf b/testing/tests/ikev1/self-signed/test.conf index 0baa48d90..0baa48d90 100644 --- a/testing/tests/self-signed/test.conf +++ b/testing/tests/ikev1/self-signed/test.conf diff --git a/testing/tests/starter-also-loop/description.txt b/testing/tests/ikev1/starter-also-loop/description.txt index 7451f4e12..7451f4e12 100644 --- a/testing/tests/starter-also-loop/description.txt +++ b/testing/tests/ikev1/starter-also-loop/description.txt diff --git a/testing/tests/starter-also-loop/evaltest.dat b/testing/tests/ikev1/starter-also-loop/evaltest.dat index 161772f8e..161772f8e 100644 --- a/testing/tests/starter-also-loop/evaltest.dat +++ b/testing/tests/ikev1/starter-also-loop/evaltest.dat diff --git a/testing/tests/starter-also-loop/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-also-loop/hosts/moon/etc/ipsec.conf index e1d210253..b58d1deb7 100755 --- a/testing/tests/starter-also-loop/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/starter-also-loop/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -30,7 +29,7 @@ conn rw auto=add conn moon - left=192.168.0.1 + left=PH_IP_MOON leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org @@ -41,7 +40,7 @@ conn moon-net leftsubnet=10.1.0.0/16 conn sun - right=192.168.0.2 + right=PH_IP_SUN rightid=@sun.strongswan.org conn sun-net diff --git a/testing/tests/starter-also-loop/posttest.dat b/testing/tests/ikev1/starter-also-loop/posttest.dat index e69de29bb..e69de29bb 100644 --- a/testing/tests/starter-also-loop/posttest.dat +++ b/testing/tests/ikev1/starter-also-loop/posttest.dat diff --git a/testing/tests/starter-also-loop/pretest.dat b/testing/tests/ikev1/starter-also-loop/pretest.dat index b135b12c3..b135b12c3 100644 --- a/testing/tests/starter-also-loop/pretest.dat +++ b/testing/tests/ikev1/starter-also-loop/pretest.dat diff --git a/testing/tests/starter-also-loop/test.conf b/testing/tests/ikev1/starter-also-loop/test.conf index e7735308f..e7735308f 100644 --- a/testing/tests/starter-also-loop/test.conf +++ b/testing/tests/ikev1/starter-also-loop/test.conf diff --git a/testing/tests/starter-also/description.txt b/testing/tests/ikev1/starter-also/description.txt index 3d4ff7dbf..3d4ff7dbf 100644 --- a/testing/tests/starter-also/description.txt +++ b/testing/tests/ikev1/starter-also/description.txt diff --git a/testing/tests/starter-also/evaltest.dat b/testing/tests/ikev1/starter-also/evaltest.dat index c7657801e..c7657801e 100644 --- a/testing/tests/starter-also/evaltest.dat +++ b/testing/tests/ikev1/starter-also/evaltest.dat diff --git a/testing/tests/starter-also/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-also/hosts/moon/etc/ipsec.conf index 74d009cfa..09f3bb94d 100755 --- a/testing/tests/starter-also/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/starter-also/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -30,7 +29,7 @@ conn rw auto=add conn moon - left=192.168.0.1 + left=PH_IP_MOON leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org @@ -40,7 +39,7 @@ conn moon-net leftsubnet=10.1.0.0/16 conn sun - right=192.168.0.2 + right=PH_IP_SUN rightid=@sun.strongswan.org conn sun-net diff --git a/testing/tests/ikev1/starter-also/posttest.dat b/testing/tests/ikev1/starter-also/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev1/starter-also/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/starter-also/pretest.dat b/testing/tests/ikev1/starter-also/pretest.dat index 4f96e61df..4f96e61df 100644 --- a/testing/tests/starter-also/pretest.dat +++ b/testing/tests/ikev1/starter-also/pretest.dat diff --git a/testing/tests/starter-also/test.conf b/testing/tests/ikev1/starter-also/test.conf index 9cd583b16..9cd583b16 100644 --- a/testing/tests/starter-also/test.conf +++ b/testing/tests/ikev1/starter-also/test.conf diff --git a/testing/tests/starter-includes/description.txt b/testing/tests/ikev1/starter-includes/description.txt index 6a05c0cca..6a05c0cca 100644 --- a/testing/tests/starter-includes/description.txt +++ b/testing/tests/ikev1/starter-includes/description.txt diff --git a/testing/tests/mode-config-swapped/evaltest.dat b/testing/tests/ikev1/starter-includes/evaltest.dat index 7de32d681..7de32d681 100644 --- a/testing/tests/mode-config-swapped/evaltest.dat +++ b/testing/tests/ikev1/starter-includes/evaltest.dat diff --git a/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..2fd734579 --- /dev/null +++ b/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftsourceip=%modeconfig + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..128c4aa29 --- /dev/null +++ b/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_DAVE + leftsourceip=%modeconfig + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.conf index aa9116252..4e7bfc1b4 100755 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.conf @@ -1,10 +1,9 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no include /etc/ipsec.connections diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.connections b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.connections index 7cd938628..7cd938628 100644 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.connections +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.connections diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.host b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.host index e84e5cdc6..acf753cc0 100755 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.host +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.host @@ -3,7 +3,7 @@ conn %default left=PH_IP_MOON leftsubnet=10.1.0.0/16 - leftsourceip=PH_IP1_MOON + leftsourceip=PH_IP_MOON1 leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol index 9212a9e96..84bedfef6 100644 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol @@ -3,6 +3,6 @@ conn rw-carol right=%any rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 auto=add diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave index 482d15a21..ee021c9be 100644 --- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave +++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave @@ -3,6 +3,6 @@ conn rw-dave right=%any rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/starter-includes/posttest.dat b/testing/tests/ikev1/starter-includes/posttest.dat index 121aa8aea..ebf7525ef 100644 --- a/testing/tests/starter-includes/posttest.dat +++ b/testing/tests/ikev1/starter-includes/posttest.dat @@ -1,13 +1,10 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null carol::/etc/init.d/iptables stop 2> /dev/null dave::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 -dave::ip addr del PH_IP1_DAVE/32 dev eth0 +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 moon::rm /etc/ipsec.connections /etc/ipsec.host moon::rm -r /etc/ipsec.peers diff --git a/testing/tests/starter-includes/pretest.dat b/testing/tests/ikev1/starter-includes/pretest.dat index 0af79a6d2..b034a0c03 100644 --- a/testing/tests/starter-includes/pretest.dat +++ b/testing/tests/ikev1/starter-includes/pretest.dat @@ -8,3 +8,4 @@ moon::ipsec start --debug-all carol::sleep 2 carol::ipsec up home dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/starter-includes/test.conf b/testing/tests/ikev1/starter-includes/test.conf index 1a8f2a4e0..1a8f2a4e0 100644 --- a/testing/tests/starter-includes/test.conf +++ b/testing/tests/ikev1/starter-includes/test.conf diff --git a/testing/tests/strong-certs/description.txt b/testing/tests/ikev1/strong-certs/description.txt index 22b58668d..22b58668d 100644 --- a/testing/tests/strong-certs/description.txt +++ b/testing/tests/ikev1/strong-certs/description.txt diff --git a/testing/tests/strong-certs/evaltest.dat b/testing/tests/ikev1/strong-certs/evaltest.dat index 2fe4de76f..2fe4de76f 100644 --- a/testing/tests/strong-certs/evaltest.dat +++ b/testing/tests/ikev1/strong-certs/evaltest.dat diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.conf index 6ab379636..81d1ae8b6 100755 --- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control strictcrlpolicy=no crlcheckinterval=180 + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem index d4b532323..d4b532323 100644 --- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem +++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem index f719e4455..f719e4455 100644 --- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem +++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.secrets index fac55d63b..fac55d63b 100644 --- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.conf index 90cee47c2..468be8afb 100755 --- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control strictcrlpolicy=no crlcheckinterval=180 + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem index 73088cd1d..73088cd1d 100644 --- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem +++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem index a4a8a4f22..a4a8a4f22 100644 --- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem +++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.secrets index 9031f323a..9031f323a 100644 --- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.conf index 76c89aa6b..7aed142a4 100755 --- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control strictcrlpolicy=no crlcheckinterval=180 + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem index 307f4953e..307f4953e 100644 --- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem +++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem index 58ddc1525..58ddc1525 100644 --- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem +++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.secrets index e86d6aa5c..e86d6aa5c 100644 --- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/strong-certs/posttest.dat b/testing/tests/ikev1/strong-certs/posttest.dat index 12b540b53..fc0fbeb38 100644 --- a/testing/tests/strong-certs/posttest.dat +++ b/testing/tests/ikev1/strong-certs/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/strong-certs/pretest.dat b/testing/tests/ikev1/strong-certs/pretest.dat index de51ccdfa..de51ccdfa 100644 --- a/testing/tests/strong-certs/pretest.dat +++ b/testing/tests/ikev1/strong-certs/pretest.dat diff --git a/testing/tests/strong-certs/test.conf b/testing/tests/ikev1/strong-certs/test.conf index 70416826e..70416826e 100644 --- a/testing/tests/strong-certs/test.conf +++ b/testing/tests/ikev1/strong-certs/test.conf diff --git a/testing/tests/virtual-ip-swapped/description.txt b/testing/tests/ikev1/virtual-ip-swapped/description.txt index 230906c5d..230906c5d 100644 --- a/testing/tests/virtual-ip-swapped/description.txt +++ b/testing/tests/ikev1/virtual-ip-swapped/description.txt diff --git a/testing/tests/virtual-ip-swapped/evaltest.dat b/testing/tests/ikev1/virtual-ip-swapped/evaltest.dat index bf3965727..23e109838 100644 --- a/testing/tests/virtual-ip-swapped/evaltest.dat +++ b/testing/tests/ikev1/virtual-ip-swapped/evaltest.dat @@ -1,8 +1,8 @@ carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES -moon::ping -c 1 PH_IP1_CAROL::64 bytes from PH_IP1_CAROL: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +moon::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/virtual-ip-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip-swapped/hosts/carol/etc/ipsec.conf index 0e239b707..f4f2dedd0 100755 --- a/testing/tests/virtual-ip-swapped/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/virtual-ip-swapped/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default conn home right=PH_IP_CAROL - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 rightnexthop=%direct rightcert=carolCert.pem rightid=carol@strongswan.org diff --git a/testing/tests/virtual-ip-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip-swapped/hosts/moon/etc/ipsec.conf index db6effbac..de7f07eb9 100755 --- a/testing/tests/virtual-ip-swapped/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/virtual-ip-swapped/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default conn rw right=PH_IP_MOON - rightsourceip=PH_IP1_MOON + rightsourceip=PH_IP_MOON1 rightnexthop=%direct rightcert=moonCert.pem rightid=@moon.strongswan.org diff --git a/testing/tests/ikev1/virtual-ip-swapped/posttest.dat b/testing/tests/ikev1/virtual-ip-swapped/posttest.dat new file mode 100644 index 000000000..2116e86e0 --- /dev/null +++ b/testing/tests/ikev1/virtual-ip-swapped/posttest.dat @@ -0,0 +1,5 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 diff --git a/testing/tests/virtual-ip/pretest.dat b/testing/tests/ikev1/virtual-ip-swapped/pretest.dat index 4fe0ee90b..4fe0ee90b 100644 --- a/testing/tests/virtual-ip/pretest.dat +++ b/testing/tests/ikev1/virtual-ip-swapped/pretest.dat diff --git a/testing/tests/virtual-ip-swapped/test.conf b/testing/tests/ikev1/virtual-ip-swapped/test.conf index f106524e2..f106524e2 100644 --- a/testing/tests/virtual-ip-swapped/test.conf +++ b/testing/tests/ikev1/virtual-ip-swapped/test.conf diff --git a/testing/tests/virtual-ip/description.txt b/testing/tests/ikev1/virtual-ip/description.txt index 4ec6021ea..4ec6021ea 100644 --- a/testing/tests/virtual-ip/description.txt +++ b/testing/tests/ikev1/virtual-ip/description.txt diff --git a/testing/tests/virtual-ip/evaltest.dat b/testing/tests/ikev1/virtual-ip/evaltest.dat index bf3965727..23e109838 100644 --- a/testing/tests/virtual-ip/evaltest.dat +++ b/testing/tests/ikev1/virtual-ip/evaltest.dat @@ -1,8 +1,8 @@ carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES -carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES -moon::ping -c 1 PH_IP1_CAROL::64 bytes from PH_IP1_CAROL: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +moon::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES diff --git a/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..a863df33e --- /dev/null +++ b/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftsourceip=PH_IP_CAROL1 + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + + + + diff --git a/testing/tests/virtual-ip/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip/hosts/moon/etc/ipsec.conf index 1cd8aab25..c0310692a 100755 --- a/testing/tests/virtual-ip/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/virtual-ip/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -15,7 +14,7 @@ conn %default conn rw left=PH_IP_MOON - leftsourceip=PH_IP1_MOON + leftsourceip=PH_IP_MOON1 leftnexthop=%direct leftcert=moonCert.pem leftid=@moon.strongswan.org diff --git a/testing/tests/ikev1/virtual-ip/posttest.dat b/testing/tests/ikev1/virtual-ip/posttest.dat new file mode 100644 index 000000000..2116e86e0 --- /dev/null +++ b/testing/tests/ikev1/virtual-ip/posttest.dat @@ -0,0 +1,5 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 diff --git a/testing/tests/rw-cert/pretest.dat b/testing/tests/ikev1/virtual-ip/pretest.dat index bd68efb0b..0b2ae8d2b 100644 --- a/testing/tests/rw-cert/pretest.dat +++ b/testing/tests/ikev1/virtual-ip/pretest.dat @@ -2,5 +2,6 @@ moon::/etc/init.d/iptables start 2> /dev/null carol::/etc/init.d/iptables start 2> /dev/null carol::ipsec start moon::ipsec start -sleep 2 +carol::sleep 2 carol::ipsec up home +carol::sleep 1 diff --git a/testing/tests/virtual-ip/test.conf b/testing/tests/ikev1/virtual-ip/test.conf index f106524e2..f106524e2 100644 --- a/testing/tests/virtual-ip/test.conf +++ b/testing/tests/ikev1/virtual-ip/test.conf diff --git a/testing/tests/wildcards/description.txt b/testing/tests/ikev1/wildcards/description.txt index e485f7066..e485f7066 100644 --- a/testing/tests/wildcards/description.txt +++ b/testing/tests/ikev1/wildcards/description.txt diff --git a/testing/tests/wildcards/evaltest.dat b/testing/tests/ikev1/wildcards/evaltest.dat index cbc94b75a..cbc94b75a 100644 --- a/testing/tests/wildcards/evaltest.dat +++ b/testing/tests/ikev1/wildcards/evaltest.dat diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/carol/etc/ipsec.conf index de179c565..d6d32a39d 100755 --- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/wildcards/hosts/carol/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/wildcards/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/dave/etc/ipsec.conf index 2fb6a301e..6156fadba 100755 --- a/testing/tests/wildcards/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/wildcards/hosts/dave/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/wildcards/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/moon/etc/ipsec.conf index ee7bc8115..162e22c43 100755 --- a/testing/tests/wildcards/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/wildcards/hosts/moon/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -22,10 +21,9 @@ conn alice right=%any rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*" auto=add - + conn venus leftsubnet=PH_IP_VENUS/32 right=%any rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*" auto=add - diff --git a/testing/tests/ikev1/wildcards/posttest.dat b/testing/tests/ikev1/wildcards/posttest.dat new file mode 100644 index 000000000..ed530f6d9 --- /dev/null +++ b/testing/tests/ikev1/wildcards/posttest.dat @@ -0,0 +1,3 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop diff --git a/testing/tests/wildcards/pretest.dat b/testing/tests/ikev1/wildcards/pretest.dat index 67c50c2ef..67c50c2ef 100644 --- a/testing/tests/wildcards/pretest.dat +++ b/testing/tests/ikev1/wildcards/pretest.dat diff --git a/testing/tests/wildcards/test.conf b/testing/tests/ikev1/wildcards/test.conf index 08e5cc145..08e5cc145 100644 --- a/testing/tests/wildcards/test.conf +++ b/testing/tests/ikev1/wildcards/test.conf diff --git a/testing/tests/wlan/description.txt b/testing/tests/ikev1/wlan/description.txt index e018148bd..e018148bd 100644 --- a/testing/tests/wlan/description.txt +++ b/testing/tests/ikev1/wlan/description.txt diff --git a/testing/tests/wlan/evaltest.dat b/testing/tests/ikev1/wlan/evaltest.dat index 1936c93a3..079ac4429 100644 --- a/testing/tests/wlan/evaltest.dat +++ b/testing/tests/ikev1/wlan/evaltest.dat @@ -3,7 +3,7 @@ venus::ipsec status::wlan.*STATE_QUICK_I2.*IPsec SA established::YES moon::ipsec status::alice.*STATE_QUICK_R2.*IPsec SA established::YES moon::ipsec status::venus.*STATE_QUICK_R2.*IPsec SA established::YES alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES -alice::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES +alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES alice::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES alice::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES venus::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES diff --git a/testing/tests/wlan/hosts/alice/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables index 86a76e2db..86a76e2db 100755 --- a/testing/tests/wlan/hosts/alice/etc/init.d/iptables +++ b/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables diff --git a/testing/tests/wlan/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf index a658e4fe8..665ce592f 100755 --- a/testing/tests/wlan/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=no + charonstart=no conn %default ikelifetime=60m @@ -30,7 +29,7 @@ conn wlan leftcert=aliceCert.pem leftid=alice@strongswan.org leftfirewall=yes - right=PH_IP1_MOON + right=PH_IP_MOON1 rightid=@moon.strongswan.org rightsubnet=0.0.0.0/0 auto=add diff --git a/testing/tests/wlan/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables index e95ef44c6..e95ef44c6 100755 --- a/testing/tests/wlan/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables diff --git a/testing/tests/wlan/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf index f873479e8..44f980422 100755 --- a/testing/tests/wlan/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=no + charonstart=no conn %default ikelifetime=60m @@ -27,7 +26,7 @@ conn venus auto=add conn wlan - left=PH_IP1_MOON + left=PH_IP_MOON1 leftnexthop=%direct leftsubnet=0.0.0.0/0 leftcert=moonCert.pem diff --git a/testing/tests/wlan/hosts/venus/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables index 6f95e7576..6f95e7576 100755 --- a/testing/tests/wlan/hosts/venus/etc/init.d/iptables +++ b/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables diff --git a/testing/tests/wlan/hosts/venus/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf index 742c1dbce..5d861548d 100755 --- a/testing/tests/wlan/hosts/venus/etc/ipsec.conf +++ b/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf @@ -1,12 +1,11 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=no + charonstart=no conn %default ikelifetime=60m @@ -30,7 +29,7 @@ conn wlan leftcert=venusCert.pem leftid=@venus.strongswan.org leftfirewall=yes - right=PH_IP1_MOON + right=PH_IP_MOON1 rightid=@moon.strongswan.org rightsubnet=0.0.0.0/0 auto=add diff --git a/testing/tests/wlan/posttest.dat b/testing/tests/ikev1/wlan/posttest.dat index cc873d1ff..6bd2379d8 100644 --- a/testing/tests/wlan/posttest.dat +++ b/testing/tests/ikev1/wlan/posttest.dat @@ -1,10 +1,8 @@ -alice::iptables -v -n -L -venus::iptables -v -n -L moon::iptables -t nat -v -n -L POSTROUTING -moon::iptables -v -n -L moon::ipsec stop alice::ipsec stop venus::ipsec stop alice::/etc/init.d/iptables stop 2> /dev/null venus::/etc/init.d/iptables stop 2> /dev/null moon::/etc/init.d/iptables stop 2> /dev/null +moon::conntrack -F diff --git a/testing/tests/wlan/pretest.dat b/testing/tests/ikev1/wlan/pretest.dat index de4a6ad31..de4a6ad31 100644 --- a/testing/tests/wlan/pretest.dat +++ b/testing/tests/ikev1/wlan/pretest.dat diff --git a/testing/tests/wlan/test.conf b/testing/tests/ikev1/wlan/test.conf index b141c4f1b..b141c4f1b 100644 --- a/testing/tests/wlan/test.conf +++ b/testing/tests/ikev1/wlan/test.conf diff --git a/testing/tests/xauth-psk-mode-config/description.txt b/testing/tests/ikev1/xauth-psk-mode-config/description.txt index 9abe6298c..9abe6298c 100644 --- a/testing/tests/xauth-psk-mode-config/description.txt +++ b/testing/tests/ikev1/xauth-psk-mode-config/description.txt diff --git a/testing/tests/xauth-psk-mode-config/evaltest.dat b/testing/tests/ikev1/xauth-psk-mode-config/evaltest.dat index 15dd054a0..15dd054a0 100644 --- a/testing/tests/xauth-psk-mode-config/evaltest.dat +++ b/testing/tests/ikev1/xauth-psk-mode-config/evaltest.dat diff --git a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf index ff1628fb0..3fd0ebf85 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets index 70ea1dab6..70ea1dab6 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf index 65c8d534e..8d20a5d20 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets index 0690d9cde..0690d9cde 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf index 1e543b2fe..66f705e79 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -22,8 +23,8 @@ conn %default conn carol rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 conn dave rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 diff --git a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets index 1ea69f998..1ea69f998 100644 --- a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat b/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/xauth-psk-mode-config/pretest.dat b/testing/tests/ikev1/xauth-psk-mode-config/pretest.dat index 95a6be131..95a6be131 100644 --- a/testing/tests/xauth-psk-mode-config/pretest.dat +++ b/testing/tests/ikev1/xauth-psk-mode-config/pretest.dat diff --git a/testing/tests/xauth-psk-mode-config/test.conf b/testing/tests/ikev1/xauth-psk-mode-config/test.conf index 75510b295..75510b295 100644 --- a/testing/tests/xauth-psk-mode-config/test.conf +++ b/testing/tests/ikev1/xauth-psk-mode-config/test.conf diff --git a/testing/tests/xauth-psk/description.txt b/testing/tests/ikev1/xauth-psk/description.txt index 0ac2043c2..0ac2043c2 100644 --- a/testing/tests/xauth-psk/description.txt +++ b/testing/tests/ikev1/xauth-psk/description.txt diff --git a/testing/tests/xauth-psk/evaltest.dat b/testing/tests/ikev1/xauth-psk/evaltest.dat index e1dc6b5b0..e1dc6b5b0 100644 --- a/testing/tests/xauth-psk/evaltest.dat +++ b/testing/tests/ikev1/xauth-psk/evaltest.dat diff --git a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.conf index b9af32c65..3e8ddf0fe 100644 --- a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.secrets index 70ea1dab6..70ea1dab6 100644 --- a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.conf index f392a3e66..9aee88cfe 100644 --- a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.secrets index 0690d9cde..0690d9cde 100644 --- a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.conf index 4c423b017..dfaa44521 100644 --- a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.secrets index 047d6c235..047d6c235 100644 --- a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk-mode-config/posttest.dat b/testing/tests/ikev1/xauth-psk/posttest.dat index 530cfc7b9..7cebd7f25 100644 --- a/testing/tests/xauth-psk-mode-config/posttest.dat +++ b/testing/tests/ikev1/xauth-psk/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/xauth-psk/pretest.dat b/testing/tests/ikev1/xauth-psk/pretest.dat index 95a6be131..95a6be131 100644 --- a/testing/tests/xauth-psk/pretest.dat +++ b/testing/tests/ikev1/xauth-psk/pretest.dat diff --git a/testing/tests/xauth-psk/test.conf b/testing/tests/ikev1/xauth-psk/test.conf index 70416826e..70416826e 100644 --- a/testing/tests/xauth-psk/test.conf +++ b/testing/tests/ikev1/xauth-psk/test.conf diff --git a/testing/tests/xauth-rsa-fail/description.txt b/testing/tests/ikev1/xauth-rsa-fail/description.txt index 83e9d2726..83e9d2726 100644 --- a/testing/tests/xauth-rsa-fail/description.txt +++ b/testing/tests/ikev1/xauth-rsa-fail/description.txt diff --git a/testing/tests/xauth-rsa-fail/evaltest.dat b/testing/tests/ikev1/xauth-rsa-fail/evaltest.dat index 0bcef388d..0bcef388d 100644 --- a/testing/tests/xauth-rsa-fail/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa-fail/evaltest.dat diff --git a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.conf index bfee72421..d49bc1490 100755 --- a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets index 24506be09..24506be09 100644 --- a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.conf index f7cf06fae..6a48cf6ee 100755 --- a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets index a18e885f8..a18e885f8 100644 --- a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-nosecret/posttest.dat b/testing/tests/ikev1/xauth-rsa-fail/posttest.dat index c6d6235f9..c6d6235f9 100644 --- a/testing/tests/xauth-rsa-nosecret/posttest.dat +++ b/testing/tests/ikev1/xauth-rsa-fail/posttest.dat diff --git a/testing/tests/xauth-rsa-fail/pretest.dat b/testing/tests/ikev1/xauth-rsa-fail/pretest.dat index 1b8fc3b79..1b8fc3b79 100644 --- a/testing/tests/xauth-rsa-fail/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa-fail/pretest.dat diff --git a/testing/tests/xauth-rsa-fail/test.conf b/testing/tests/ikev1/xauth-rsa-fail/test.conf index 5442565f8..5442565f8 100644 --- a/testing/tests/xauth-rsa-fail/test.conf +++ b/testing/tests/ikev1/xauth-rsa-fail/test.conf diff --git a/testing/tests/xauth-rsa-mode-config/description.txt b/testing/tests/ikev1/xauth-rsa-mode-config/description.txt index aa2b31542..aa2b31542 100644 --- a/testing/tests/xauth-rsa-mode-config/description.txt +++ b/testing/tests/ikev1/xauth-rsa-mode-config/description.txt diff --git a/testing/tests/xauth-rsa-mode-config/evaltest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/evaltest.dat index 15dd054a0..15dd054a0 100644 --- a/testing/tests/xauth-rsa-mode-config/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa-mode-config/evaltest.dat diff --git a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf index 751c2a29d..90539650f 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets index 48fd260c1..48fd260c1 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf index c97e815df..19618145d 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets index 14f088501..14f088501 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf index e3b2219c4..eccdc2b70 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug="control" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -23,8 +24,8 @@ conn %default conn rw-carol rightid=carol@strongswan.org - rightsourceip=PH_IP1_CAROL + rightsourceip=PH_IP_CAROL1 conn rw-dave rightid=dave@strongswan.org - rightsourceip=PH_IP1_DAVE + rightsourceip=PH_IP_DAVE1 diff --git a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets index 8d41919fc..8d41919fc 100644 --- a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat new file mode 100644 index 000000000..42fa8359b --- /dev/null +++ b/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +carol::ip addr del PH_IP_CAROL1/32 dev eth0 +dave::ip addr del PH_IP_DAVE1/32 dev eth0 diff --git a/testing/tests/xauth-rsa-mode-config/pretest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/pretest.dat index 78e2d57f8..78e2d57f8 100644 --- a/testing/tests/xauth-rsa-mode-config/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa-mode-config/pretest.dat diff --git a/testing/tests/xauth-rsa-mode-config/test.conf b/testing/tests/ikev1/xauth-rsa-mode-config/test.conf index 75510b295..75510b295 100644 --- a/testing/tests/xauth-rsa-mode-config/test.conf +++ b/testing/tests/ikev1/xauth-rsa-mode-config/test.conf diff --git a/testing/tests/xauth-rsa-nosecret/description.txt b/testing/tests/ikev1/xauth-rsa-nosecret/description.txt index ffbb47c04..ffbb47c04 100644 --- a/testing/tests/xauth-rsa-nosecret/description.txt +++ b/testing/tests/ikev1/xauth-rsa-nosecret/description.txt diff --git a/testing/tests/xauth-rsa-nosecret/evaltest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/evaltest.dat index ddbb3ae2d..ddbb3ae2d 100644 --- a/testing/tests/xauth-rsa-nosecret/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa-nosecret/evaltest.dat diff --git a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf index bfee72421..d49bc1490 100644..100755 --- a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets index 6a2aea811..6a2aea811 100644 --- a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf index f7cf06fae..6a48cf6ee 100755 --- a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets index a18e885f8..a18e885f8 100644 --- a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ike-alg-strict/pretest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/pretest.dat index f5aa989fe..f5aa989fe 100644 --- a/testing/tests/ike-alg-strict/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa-nosecret/pretest.dat diff --git a/testing/tests/xauth-rsa-nosecret/test.conf b/testing/tests/ikev1/xauth-rsa-nosecret/test.conf index 5442565f8..5442565f8 100644 --- a/testing/tests/xauth-rsa-nosecret/test.conf +++ b/testing/tests/ikev1/xauth-rsa-nosecret/test.conf diff --git a/testing/tests/xauth-rsa/description.txt b/testing/tests/ikev1/xauth-rsa/description.txt index 0cdaba1c5..0cdaba1c5 100644 --- a/testing/tests/xauth-rsa/description.txt +++ b/testing/tests/ikev1/xauth-rsa/description.txt diff --git a/testing/tests/xauth-rsa/evaltest.dat b/testing/tests/ikev1/xauth-rsa/evaltest.dat index e1dc6b5b0..e1dc6b5b0 100644 --- a/testing/tests/xauth-rsa/evaltest.dat +++ b/testing/tests/ikev1/xauth-rsa/evaltest.dat diff --git a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.conf index bfee72421..d49bc1490 100755..100644 --- a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.secrets index 48fd260c1..48fd260c1 100644 --- a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.conf index 0f34a209a..5c1de3372 100644 --- a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.conf @@ -4,6 +4,7 @@ config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.secrets index 14f088501..14f088501 100644 --- a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.secrets diff --git a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.conf index f7cf06fae..a997fb73f 100644 --- a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.conf @@ -1,9 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - plutodebug=control + plutodebug="control" crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m diff --git a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.secrets index 8d41919fc..8d41919fc 100644 --- a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.secrets +++ b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.secrets diff --git a/testing/tests/xauth-psk/posttest.dat b/testing/tests/ikev1/xauth-rsa/posttest.dat index 530cfc7b9..7cebd7f25 100644 --- a/testing/tests/xauth-psk/posttest.dat +++ b/testing/tests/ikev1/xauth-rsa/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/xauth-rsa/pretest.dat b/testing/tests/ikev1/xauth-rsa/pretest.dat index 78e2d57f8..78e2d57f8 100644 --- a/testing/tests/xauth-rsa/pretest.dat +++ b/testing/tests/ikev1/xauth-rsa/pretest.dat diff --git a/testing/tests/xauth-rsa/test.conf b/testing/tests/ikev1/xauth-rsa/test.conf index 70416826e..70416826e 100644 --- a/testing/tests/xauth-rsa/test.conf +++ b/testing/tests/ikev1/xauth-rsa/test.conf diff --git a/testing/tests/ikev2/config-payload-swapped/description.txt b/testing/tests/ikev2/config-payload-swapped/description.txt new file mode 100644 index 000000000..2160e6b92 --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/description.txt @@ -0,0 +1,3 @@ +Same scenario as test <a href="../config-payload/"><b>mode-config</b></a> but with +swapped end definitions: <b>right</b> denotes the <b>local</b> side whereas +<b>left</b> stands for the <b>remote</b> peer. diff --git a/testing/tests/ikev2/config-payload-swapped/evaltest.dat b/testing/tests/ikev2/config-payload-swapped/evaltest.dat new file mode 100644 index 000000000..40cb4339b --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/evaltest.dat @@ -0,0 +1,20 @@ +carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES +carol::ip addr list dev eth0::PH_IP_CAROL1::YES +carol::ip route list dev eth0::10.1.0.0/16.*src PH_IP_CAROL1::YES +carol::ipsec status::home.*INSTALLED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES +dave::ip addr list dev eth0::PH_IP_DAVE1::YES +dave::ip route list dev eth0::10.1.0.0/16.*src PH_IP_DAVE1::YES +dave::ipsec status::home.*INSTALLED::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::ipsec status::rw-carol.*INSTALLED::YES +moon::ipsec status::rw-dave.*INSTALLED::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES +alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES +alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..6e2cbd153 --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + right=PH_IP_CAROL + rightsourceip=%config + rightnexthop=%direct + rightcert=carolCert.pem + rightid=carol@strongswan.org + rightfirewall=yes + righthostaccess=yes + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..f148757db --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + right=PH_IP_DAVE + rightsourceip=%config + rightnexthop=%direct + rightcert=daveCert.pem + rightid=dave@strongswan.org + rightfirewall=yes + righthostaccess=yes + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftid=@moon.strongswan.org + auto=add diff --git a/testing/tests/esp-ah-tunnel/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/moon/etc/ipsec.conf index 98cdaab7a..5cb49cfc8 100755 --- a/testing/tests/esp-ah-tunnel/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/config-payload-swapped/hosts/moon/etc/ipsec.conf @@ -1,28 +1,32 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup - plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + plutostart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 - auth=ah - ike=aes128-sha - esp=aes128-sha1 - -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - leftfirewall=yes + keyexchange=ikev2 right=PH_IP_MOON rightsubnet=10.1.0.0/16 + rightsourceip=PH_IP_MOON1 + rightnexthop=%direct + rightcert=moonCert.pem rightid=@moon.strongswan.org + rightfirewall=yes + +conn rw-carol + left=%any + leftid=carol@strongswan.org + leftsourceip=PH_IP_CAROL1 + auto=add + +conn rw-dave + left=%any + leftid=dave@strongswan.org + leftsourceip=PH_IP_DAVE1 auto=add diff --git a/testing/tests/xauth-rsa-mode-config/posttest.dat b/testing/tests/ikev2/config-payload-swapped/posttest.dat index 530cfc7b9..7cebd7f25 100644 --- a/testing/tests/xauth-rsa-mode-config/posttest.dat +++ b/testing/tests/ikev2/config-payload-swapped/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/ikev2/config-payload-swapped/pretest.dat b/testing/tests/ikev2/config-payload-swapped/pretest.dat new file mode 100644 index 000000000..014e80517 --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/pretest.dat @@ -0,0 +1,10 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up home +dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/config-payload-swapped/test.conf b/testing/tests/ikev2/config-payload-swapped/test.conf new file mode 100644 index 000000000..1a8f2a4e0 --- /dev/null +++ b/testing/tests/ikev2/config-payload-swapped/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon alice" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/config-payload/description.txt b/testing/tests/ikev2/config-payload/description.txt new file mode 100644 index 000000000..7690e7dce --- /dev/null +++ b/testing/tests/ikev2/config-payload/description.txt @@ -0,0 +1,7 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>. +Both <b>carol</b> and <b>dave</b> request a <b>virtual IP</b> via the IKEv2 configuration payload +by using the <b>leftsourceip=%config</b> parameter. <b>leftfirewall=yes</b> automatically +inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test the +tunnels, <b>carol</b> and <b>dave</b> then ping the client <b>alice</b> behind the gateway +<b>moon</b>. The source IP addresses of the two pings will be the virtual IPs <b>carol1</b> +and <b>dave1</b>, respectively. diff --git a/testing/tests/ikev2/config-payload/evaltest.dat b/testing/tests/ikev2/config-payload/evaltest.dat new file mode 100644 index 000000000..40cb4339b --- /dev/null +++ b/testing/tests/ikev2/config-payload/evaltest.dat @@ -0,0 +1,20 @@ +carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES +carol::ip addr list dev eth0::PH_IP_CAROL1::YES +carol::ip route list dev eth0::10.1.0.0/16.*src PH_IP_CAROL1::YES +carol::ipsec status::home.*INSTALLED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES +dave::ip addr list dev eth0::PH_IP_DAVE1::YES +dave::ip route list dev eth0::10.1.0.0/16.*src PH_IP_DAVE1::YES +dave::ipsec status::home.*INSTALLED::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::ipsec status::rw-carol.*INSTALLED::YES +moon::ipsec status::rw-dave.*INSTALLED::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES +alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES +alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES +alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES diff --git a/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..4ea2b22f7 --- /dev/null +++ b/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftsourceip=%config + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..dad3f3440 --- /dev/null +++ b/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_DAVE + leftsourceip=%config + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a4c4b3553 --- /dev/null +++ b/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf @@ -0,0 +1,32 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftsourceip=PH_IP_MOON1 + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + +conn rw-carol + right=%any + rightid=carol@strongswan.org + rightsourceip=PH_IP_CAROL1 + auto=add + +conn rw-dave + right=%any + rightid=dave@strongswan.org + rightsourceip=PH_IP_DAVE1 + auto=add diff --git a/testing/tests/xauth-rsa/posttest.dat b/testing/tests/ikev2/config-payload/posttest.dat index 530cfc7b9..7cebd7f25 100644 --- a/testing/tests/xauth-rsa/posttest.dat +++ b/testing/tests/ikev2/config-payload/posttest.dat @@ -1,6 +1,3 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L moon::ipsec stop carol::ipsec stop dave::ipsec stop diff --git a/testing/tests/ikev2/config-payload/pretest.dat b/testing/tests/ikev2/config-payload/pretest.dat new file mode 100644 index 000000000..014e80517 --- /dev/null +++ b/testing/tests/ikev2/config-payload/pretest.dat @@ -0,0 +1,10 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up home +dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/config-payload/test.conf b/testing/tests/ikev2/config-payload/test.conf new file mode 100644 index 000000000..1a8f2a4e0 --- /dev/null +++ b/testing/tests/ikev2/config-payload/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon alice" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/crl-from-cache/description.txt b/testing/tests/ikev2/crl-from-cache/description.txt new file mode 100644 index 000000000..17866f572 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/description.txt @@ -0,0 +1,5 @@ +By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. When <b>carol</b> initiates +an IPsec connection to <b>moon</b>, both VPN endpoints find a cached CRL in +their <b>/etc/ipsec.d/crls/</b> directories which allows them to immediately verify +the certificate received from their peer. diff --git a/testing/tests/ikev2/crl-from-cache/evaltest.dat b/testing/tests/ikev2/crl-from-cache/evaltest.dat new file mode 100644 index 000000000..9aa53fb64 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/evaltest.dat @@ -0,0 +1,8 @@ +moon::cat /var/log/daemon.log::loading crl file::YES +carol::cat /var/log/daemon.log::loading crl file::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES +moon::cat /var/log/auth.log::written crl file::NO +carol::cat /var/log/auth.log::written crl file::NO +moon::ipsec listcrls:: ok::YES +carol::ipsec listcrls:: ok::YES diff --git a/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..cea581bc2 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..fe2179885 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/crl-from-cache/posttest.dat b/testing/tests/ikev2/crl-from-cache/posttest.dat new file mode 100644 index 000000000..be17847c1 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::rm /etc/ipsec.d/crls/* +carol::rm /etc/ipsec.d/crls/* diff --git a/testing/tests/ikev2/crl-from-cache/pretest.dat b/testing/tests/ikev2/crl-from-cache/pretest.dat new file mode 100644 index 000000000..acdb265ed --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/pretest.dat @@ -0,0 +1,8 @@ +moon::wget -q http://crl.strongswan.org/strongswan.crl +moon::mv strongswan.crl /etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl +carol::wget -q http://crl.strongswan.org/strongswan.crl +carol::mv strongswan.crl /etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/crl-from-cache/test.conf b/testing/tests/ikev2/crl-from-cache/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-from-cache/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-ldap/description.txt b/testing/tests/ikev2/crl-ldap/description.txt new file mode 100644 index 000000000..d7ed591cc --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/description.txt @@ -0,0 +1,6 @@ +By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. Thus when <b>carol</b> initiates +the connection and only an expired CRL cache file in <b>/etc/ipsec.d/crls</b> is +availabl, an ldap fetch to get the CRL from the LDAP server <b>winnetou</b> is +successfully started and the IKE authentication completes. The new CRL is again +cached locally as a file in <b>/etc/ipsec.d/crls</b> due to the <b>cachecrls=yes</b> option. diff --git a/testing/tests/ikev2/crl-ldap/evaltest.dat b/testing/tests/ikev2/crl-ldap/evaltest.dat new file mode 100644 index 000000000..05e818e21 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/evaltest.dat @@ -0,0 +1,12 @@ +moon::cat /var/log/daemon.log::loading crl file::YES +carol::cat /var/log/daemon.log::loading crl file::YES +moon::cat /var/log/daemon.log::crl is stale::YES +carol::cat /var/log/daemon.log::crl is stale::YES +moon::cat /var/log/daemon.log::sending ldap request::YES +carol::cat /var/log/daemon.log::sending ldap request::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES +moon::cat /var/log/daemon.log::written crl file::YES +carol::cat /var/log/daemon.log::written crl file::YES +moon::ipsec listcrls:: ok::YES +carol::ipsec listcrls:: ok::YES diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables new file mode 100755 index 000000000..571459bae --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables @@ -0,0 +1,73 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +opts="start stop reload" + +depend() { + before net + need logger +} + +start() { + ebegin "Starting firewall" + + # default policy is DROP + /sbin/iptables -P INPUT DROP + /sbin/iptables -P OUTPUT DROP + /sbin/iptables -P FORWARD DROP + + # allow esp + iptables -A INPUT -i eth0 -p 50 -j ACCEPT + iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT + + # allow IKE + iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT + iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + + # allow ldap crl fetch from winnetou + iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT + iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + + # allow ssh + iptables -A INPUT -p tcp --dport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + + eend $? +} + +stop() { + ebegin "Stopping firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + + if [ $a == nat ]; then + /sbin/iptables -t nat -P PREROUTING ACCEPT + /sbin/iptables -t nat -P POSTROUTING ACCEPT + /sbin/iptables -t nat -P OUTPUT ACCEPT + elif [ $a == mangle ]; then + /sbin/iptables -t mangle -P PREROUTING ACCEPT + /sbin/iptables -t mangle -P INPUT ACCEPT + /sbin/iptables -t mangle -P FORWARD ACCEPT + /sbin/iptables -t mangle -P OUTPUT ACCEPT + /sbin/iptables -t mangle -P POSTROUTING ACCEPT + elif [ $a == filter ]; then + /sbin/iptables -t filter -P INPUT ACCEPT + /sbin/iptables -t filter -P FORWARD ACCEPT + /sbin/iptables -t filter -P OUTPUT ACCEPT + fi + done + eend $? +} + +reload() { + ebegin "Flushing firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + done; + eend $? + start +} + diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..8b37ec6b8 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf @@ -0,0 +1,31 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList" + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=2 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl Binary files differnew file mode 100644 index 000000000..75e8b0959 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables new file mode 100755 index 000000000..8de514a2e --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables @@ -0,0 +1,76 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +opts="start stop reload" + +depend() { + before net + need logger +} + +start() { + ebegin "Starting firewall" + + # enable IP forwarding + echo 1 > /proc/sys/net/ipv4/ip_forward + + # default policy is DROP + /sbin/iptables -P INPUT DROP + /sbin/iptables -P OUTPUT DROP + /sbin/iptables -P FORWARD DROP + + # allow esp + iptables -A INPUT -i eth0 -p 50 -j ACCEPT + iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT + + # allow IKE + iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT + iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + + # allow ldap crl fetch from winnetou + iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT + iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT + + # allow ssh + iptables -A INPUT -p tcp --dport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + + eend $? +} + +stop() { + ebegin "Stopping firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + + if [ $a == nat ]; then + /sbin/iptables -t nat -P PREROUTING ACCEPT + /sbin/iptables -t nat -P POSTROUTING ACCEPT + /sbin/iptables -t nat -P OUTPUT ACCEPT + elif [ $a == mangle ]; then + /sbin/iptables -t mangle -P PREROUTING ACCEPT + /sbin/iptables -t mangle -P INPUT ACCEPT + /sbin/iptables -t mangle -P FORWARD ACCEPT + /sbin/iptables -t mangle -P OUTPUT ACCEPT + /sbin/iptables -t mangle -P POSTROUTING ACCEPT + elif [ $a == filter ]; then + /sbin/iptables -t filter -P INPUT ACCEPT + /sbin/iptables -t filter -P FORWARD ACCEPT + /sbin/iptables -t filter -P OUTPUT ACCEPT + fi + done + eend $? +} + +reload() { + ebegin "Flushing firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + done; + eend $? + start +} + diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..3b1fbabb8 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + crluri="ldap://ldap1.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList" + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=2 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl Binary files differnew file mode 100644 index 000000000..75e8b0959 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl diff --git a/testing/tests/ikev2/crl-ldap/posttest.dat b/testing/tests/ikev2/crl-ldap/posttest.dat new file mode 100644 index 000000000..bddd87424 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/posttest.dat @@ -0,0 +1,7 @@ +moon::ipsec stop +carol::ipsec stop +winnetou::/etc/init.d/slapd stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +moon::rm /etc/ipsec.d/crls/* +carol::rm /etc/ipsec.d/crls/* diff --git a/testing/tests/ikev2/crl-ldap/pretest.dat b/testing/tests/ikev2/crl-ldap/pretest.dat new file mode 100644 index 000000000..64fa8116b --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/pretest.dat @@ -0,0 +1,8 @@ +winnetou::/etc/init.d/slapd start +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home +carol::sleep 3 diff --git a/testing/tests/ikev2/crl-ldap/test.conf b/testing/tests/ikev2/crl-ldap/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-ldap/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-revoked/description.txt b/testing/tests/ikev2/crl-revoked/description.txt new file mode 100644 index 000000000..b39c59c97 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/description.txt @@ -0,0 +1,4 @@ +By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The remote host <b>carol</b> +initiates the connection and presents a certificate that has been revoked by the +current CRL causing the IKE negotiation to fail. diff --git a/testing/tests/ikev2/crl-revoked/evaltest.dat b/testing/tests/ikev2/crl-revoked/evaltest.dat new file mode 100644 index 000000000..3d6cf72bb --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::certificate was revoked::YES +moon::cat /var/log/daemon.log::end entity certificate is not trusted::YES +carol::cat /var/log/daemon.log::AUTHENTICATION_FAILED::YES +moon::ipsec listcrls:: ok::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..29b3c2a65 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolRevokedCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem new file mode 100644 index 000000000..5b742fc9e --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEIjCCAwqgAwIBAgIBBzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjU0OFoXDTA5MDkwOTExMjU0OFowWjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAM5413q1B2EF3spcYD1u0ce9AtIHdxmU3+1E0hqV +mLqpIQtyp4SLbrRunxpoVUuEpHWXgLb3C/ljjlKCMWWmhw4wja1rBTjMNJLPj6Bo +5Qn4Oeuqm7/kLHPGbveQGtcSsJCk6iLqFTbq0wsji5Ogq7kmjWgQv0nM2jpofHLv +VOAtWVSj+x2b3OHdl/WpgTgTw1HHjYo7/NOkARdTcZ2/wxxM3z1Abp9iylc45GLN +IL/OzHkT8b5pdokdMvVijz8IslkkewJYXrVQaCNMZg/ydlXOOAEKz0YqnvXQaYs5 +K+s8XvQ2RFCr5oO0fRT2VbiI9TgHnbcnfUi25iHl6txsXg0CAwEAAaOCAQYwggEC +MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBTbA2TH3ca8tgCGkYy9 +OV/MqUTHAzBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT +EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz +d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u +b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQC9acuCUPEBOrWB +56vS8N9bksQwv/XcYIFYqV73kFBAzOPLX2a9igFGvBPdCxFu/t8JCswzE6to4LFM +2+6Z2QJf442CLPcJKxITahrjJXSxGbzMlmaDvZ5wFCJAlyin+yuInpTwl8rMZe/Q +O5JeJjzGDgWJtnGdkLUk/l2r6sZ/Cmk5rZpuO0hcUHVztMLQYPzqTpuMvC5p4JzL +LWGWhKRhJs53NmxXXodck/ZgaqiTWuQFYlbamJRvzVBfX7c1SWHRJvxSSOPKGIg3 +wphkO2naj/SQD+BNuWTRmZ9YCiLOQ64ybLpJzRZISETdqtLBPKsIqosUZwkxlR1N +9IcgYi5x +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem new file mode 100644 index 000000000..8aefcc5a6 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAznjXerUHYQXeylxgPW7Rx70C0gd3GZTf7UTSGpWYuqkhC3Kn +hItutG6fGmhVS4SkdZeAtvcL+WOOUoIxZaaHDjCNrWsFOMw0ks+PoGjlCfg566qb +v+Qsc8Zu95Aa1xKwkKTqIuoVNurTCyOLk6CruSaNaBC/SczaOmh8cu9U4C1ZVKP7 +HZvc4d2X9amBOBPDUceNijv806QBF1Nxnb/DHEzfPUBun2LKVzjkYs0gv87MeRPx +vml2iR0y9WKPPwiyWSR7AlhetVBoI0xmD/J2Vc44AQrPRiqe9dBpizkr6zxe9DZE +UKvmg7R9FPZVuIj1OAedtyd9SLbmIeXq3GxeDQIDAQABAoIBAAUdyXko8z3cP2EU +WO4syNYCQQejV7gykDn48pvmCRrXBhKajLwkGGIwO5ET9MkiSFEBqBbgmFNdvDEf +OMokDkSzv08Ez+RQax0YN57p+oL8u7KzT5i5tsBHsog/8epSdD2hWIv08QGjYAdu +og7OdHLqGabyg0r44I+B91OBysCjU51rDdkhz59AmURdEIJV5xhuGojFM68jaNm2 +MUxDfDuCsRIydjAP0VTUTAUxD4/S5I+jt/GK9aRsEeRH9Q3011iTGMR9viAUBhq/ +khkWNltg9lkOqO7LpnNku4sSv3v4CWge7/T+4RR2vZgv1oSs4ox2UKYoqIqiYIfx +uUcnqQECgYEA+LPiRMoXvlssQWlaFc2k4xga0efs+mWeLglDdc3R3fBEibP/AU07 +a576AgvUJtkI50/WNGKT73O+VtxcXn/N646m/8OtqNXuVKKjsxxNOZEKdO8aOdbt +7lM5WepNiQeaKAFudUxpUiZQx8LCKSsNDiJZKWBu6xAG2O5X32VMZvUCgYEA1Ie+ +rNa490PSC1ym7WbmdAjvGmSOn2GOBfO7BECsPZstccU7D5pZl/89fTfn1TDKP49Y +ScVOuFz7f/u6UJpb/WzI71RXEQOdojLWmF2HDx5osRi3hXEJa20fbPq6DQXCJ8pf +IF37AEqAY4UNSNic0Cw+rGHdWPQhDNXhFWpdu7kCgYEAmv4oNmyoDXbuhrlsbggi +CXE9TbG3a3mm8dPOGf2yHBmf7R2i/6GtNW33Kw1KIwfBV77WpQEGZwWACsv8ONx3 +baUSiHTfpkfk5xQQ5w/tRMISfTuB4agD0jJFnLa7qXl2ZhY2S53aSVsdntDOhi+R +TEy1umah2Za8Xbd0RgHwcn0CgYEAl9Hgg9dfikMIaNVm6W/4cCtxoojy2Sf3LIlP +r1oDsH6JmBwsdJjuJ4ZNhoXJNqID2COuDgTEly7U+jf4gFvEGuT7JPw6tgy/Ln7i +jTVCpaozX08oykpVUEhDirYQ8fyLFaGbEqQQCcUusej59G/IlW0F2F6QoFrEwUaH +46R4EQECgYBEZ7edMkj3dmJH1wxQjp5GJNbrJkS8IKvzza0mDTJdz33CgEX9Oyva +o2iEkDVpvj2SEy28ewt22IRptWKH/3bQfxSCcRV6JFNt3+LongMshRYqq1leqrKa +9fnQVtfTIbIVXwjTZap6BL8R66OeFtexsSFRfDF/8P4n2oF4zmn4qA== +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..8e31be4cb --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolRevokedKey.pem diff --git a/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a1a9587dd --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/crl-revoked/posttest.dat b/testing/tests/ikev2/crl-revoked/posttest.dat new file mode 100644 index 000000000..d742e8410 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/crl-revoked/pretest.dat b/testing/tests/ikev2/crl-revoked/pretest.dat new file mode 100644 index 000000000..8984dcbcf --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home diff --git a/testing/tests/ikev2/crl-revoked/test.conf b/testing/tests/ikev2/crl-revoked/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-revoked/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-strict/description.txt b/testing/tests/ikev2/crl-strict/description.txt new file mode 100644 index 000000000..b2b70906f --- /dev/null +++ b/testing/tests/ikev2/crl-strict/description.txt @@ -0,0 +1,2 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict CRL policy</b> is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. diff --git a/testing/tests/ikev2/crl-strict/evaltest.dat b/testing/tests/ikev2/crl-strict/evaltest.dat new file mode 100644 index 000000000..ac70750c5 --- /dev/null +++ b/testing/tests/ikev2/crl-strict/evaltest.dat @@ -0,0 +1,4 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +moon::ipsec listcrls:: ok::YES +carol::ipsec listcrls:: ok::YES diff --git a/testing/tests/crl-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-strict/hosts/carol/etc/ipsec.conf index 6d0aee86a..52e5c291d 100755 --- a/testing/tests/crl-strict/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/crl-strict/hosts/carol/etc/ipsec.conf @@ -1,17 +1,16 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup - plutodebug=control - crlcheckinterval=180 + crlcheckinterval=180 strictcrlpolicy=yes + plutostart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 + keyexchange=ikev2 left=PH_IP_CAROL leftnexthop=%direct leftcert=carolCert.pem diff --git a/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a9f6a4bb4 --- /dev/null +++ b/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf @@ -0,0 +1,34 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn net-net + leftsubnet=10.1.0.0/16 + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=add + +conn host-host + right=PH_IP_SUN + rightid=@sun.strongswan.org + auto=add + +conn rw + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/crl-strict/posttest.dat b/testing/tests/ikev2/crl-strict/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/crl-strict/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/crl-strict/pretest.dat b/testing/tests/ikev2/crl-strict/pretest.dat new file mode 100644 index 000000000..8984dcbcf --- /dev/null +++ b/testing/tests/ikev2/crl-strict/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home diff --git a/testing/tests/ikev2/crl-strict/test.conf b/testing/tests/ikev2/crl-strict/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-strict/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/crl-to-cache/description.txt b/testing/tests/ikev2/crl-to-cache/description.txt new file mode 100644 index 000000000..9f542e73d --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/description.txt @@ -0,0 +1,6 @@ +By setting <b>cachecrls=yes</b> in ipsec.conf, a copy of the CRL fetched +via http from the web server <b>winnetou</b> is saved locally in the +directory <b>/etc/ipsec.d/crls</b> on both the roadwarrior <b>carol</b> +and the gateway <b>moon</b> when the IPsec connection is set up. The +<b>subjectKeyIdentifier</b> of the issuing CA plus the suffix <b>.crl</b> +is used as a unique filename for the cached CRL. diff --git a/testing/tests/ikev2/crl-to-cache/evaltest.dat b/testing/tests/ikev2/crl-to-cache/evaltest.dat new file mode 100644 index 000000000..14edd946f --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/evaltest.dat @@ -0,0 +1,4 @@ +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES +moon::cat /var/log/daemon.log::written crl file.*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES +carol::cat /var/log/daemon.log::written crl file.*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES diff --git a/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..cea581bc2 --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..fe2179885 --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + cachecrls=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/crl-to-cache/posttest.dat b/testing/tests/ikev2/crl-to-cache/posttest.dat new file mode 100644 index 000000000..be17847c1 --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::rm /etc/ipsec.d/crls/* +carol::rm /etc/ipsec.d/crls/* diff --git a/testing/tests/ocsp-strict/pretest.dat b/testing/tests/ikev2/crl-to-cache/pretest.dat index d5516fd3b..d92333d86 100644 --- a/testing/tests/ocsp-strict/pretest.dat +++ b/testing/tests/ikev2/crl-to-cache/pretest.dat @@ -1,4 +1,3 @@ -winnetou::/etc/openssl/start-ocsp moon::ipsec start carol::ipsec start carol::sleep 2 diff --git a/testing/tests/ikev2/crl-to-cache/test.conf b/testing/tests/ikev2/crl-to-cache/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/crl-to-cache/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/default-keys/description.txt b/testing/tests/ikev2/default-keys/description.txt new file mode 100644 index 000000000..639e909da --- /dev/null +++ b/testing/tests/ikev2/default-keys/description.txt @@ -0,0 +1,8 @@ +Because of the missing <b>/etc/ipsec.secrets</b> file, roadwarrior <b>carol</b> +and gateway <b>moon</b> each automatically generate a PKCS#1 RSA private key +and a self-signed X.509 certificate. Because the UML testing environment does +not offer enough entropy, the non-blocking /dev/urandom device is used in place +of /dev/random for generating the random primes. +<p> +The self-signed certificates are then distributed to the peers via scp +and are used to set up a road warrior connection initiated by <b>carol</b> diff --git a/testing/tests/ikev2/default-keys/evaltest.dat b/testing/tests/ikev2/default-keys/evaltest.dat new file mode 100644 index 000000000..2c1e11c97 --- /dev/null +++ b/testing/tests/ikev2/default-keys/evaltest.dat @@ -0,0 +1,7 @@ +carol::cat /var/log/auth.log::scepclient::YES +moon::cat /var/log/auth.log::scepclient::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +moon::ipsec statusall::carol.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..a4668d9ae --- /dev/null +++ b/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=selfCert.der + leftsendcert=never + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightcert=peerCert.der + rightsendcert=never + auto=add diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables new file mode 100755 index 000000000..13ad3063f --- /dev/null +++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables @@ -0,0 +1,78 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +opts="start stop reload" + +depend() { + before net + need logger +} + +start() { + ebegin "Starting firewall" + + # enable IP forwarding + echo 1 > /proc/sys/net/ipv4/ip_forward + + # default policy is DROP + /sbin/iptables -P INPUT DROP + /sbin/iptables -P OUTPUT DROP + /sbin/iptables -P FORWARD DROP + + # allow esp + iptables -A INPUT -i eth0 -p 50 -j ACCEPT + iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT + + # allow IKE + iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT + iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT + + # allow crl fetch from winnetou + iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT + iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + + # allow ssh + iptables -A INPUT -p tcp --dport 22 -j ACCEPT + iptables -A INPUT -p tcp --sport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT + + eend $? +} + +stop() { + ebegin "Stopping firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + + if [ $a == nat ]; then + /sbin/iptables -t nat -P PREROUTING ACCEPT + /sbin/iptables -t nat -P POSTROUTING ACCEPT + /sbin/iptables -t nat -P OUTPUT ACCEPT + elif [ $a == mangle ]; then + /sbin/iptables -t mangle -P PREROUTING ACCEPT + /sbin/iptables -t mangle -P INPUT ACCEPT + /sbin/iptables -t mangle -P FORWARD ACCEPT + /sbin/iptables -t mangle -P OUTPUT ACCEPT + /sbin/iptables -t mangle -P POSTROUTING ACCEPT + elif [ $a == filter ]; then + /sbin/iptables -t filter -P INPUT ACCEPT + /sbin/iptables -t filter -P FORWARD ACCEPT + /sbin/iptables -t filter -P OUTPUT ACCEPT + fi + done + eend $? +} + +reload() { + ebegin "Flushing firewall" + for a in `cat /proc/net/ip_tables_names`; do + /sbin/iptables -F -t $a + /sbin/iptables -X -t $a + done; + eend $? + start +} + diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..b6a0e4990 --- /dev/null +++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn carol + left=PH_IP_MOON + leftnexthop=%direct + leftcert=selfCert.der + leftsendcert=never + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + rightcert=peerCert.der + rightsendcert=never + auto=add diff --git a/testing/tests/ikev2/default-keys/posttest.dat b/testing/tests/ikev2/default-keys/posttest.dat new file mode 100644 index 000000000..8cada5e7e --- /dev/null +++ b/testing/tests/ikev2/default-keys/posttest.dat @@ -0,0 +1,8 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +carol::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/certs/* +moon::rm /etc/ipsec.d/private/* +moon::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/default-keys/pretest.dat b/testing/tests/ikev2/default-keys/pretest.dat new file mode 100644 index 000000000..fe68be4b5 --- /dev/null +++ b/testing/tests/ikev2/default-keys/pretest.dat @@ -0,0 +1,18 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +carol::rm /etc/ipsec.secrets +carol::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/cacerts/* +carol::ipsec start +moon::rm /etc/ipsec.secrets +moon::rm /etc/ipsec.d/private/* +moon::rm /etc/ipsec.d/certs/* +moon::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +moon::sleep 3 +moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der +moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der +moon::ipsec reload +carol::ipsec reload +carol::ipsec up home diff --git a/testing/tests/ikev2/default-keys/test.conf b/testing/tests/ikev2/default-keys/test.conf new file mode 100644 index 000000000..0baa48d90 --- /dev/null +++ b/testing/tests/ikev2/default-keys/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol" + +# Corresponding block diagram +# +DIAGRAM="a-m-c.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/double-nat-net/description.txt b/testing/tests/ikev2/double-nat-net/description.txt new file mode 100644 index 000000000..ff09155f6 --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/description.txt @@ -0,0 +1,7 @@ +The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a +tunnel to the subnet hiding behind the NAT router <b>sun</b>. All IKE and ESP traffic +directed to the router <b>sun</b> is forwarded to the VPN gateway <b>bob</b> +using destination NAT. UDP encapsulation is used to traverse the NAT routers. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that +let pass the tunneled traffic. In order to test the double NAT-ed IPsec +tunnel <b>alice</b> pings the inner IP address of the router <b>sun</b>. diff --git a/testing/tests/ikev2/double-nat-net/evaltest.dat b/testing/tests/ikev2/double-nat-net/evaltest.dat new file mode 100644 index 000000000..aa69dabfa --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/evaltest.dat @@ -0,0 +1,5 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +bob::ipsec statusall::nat-t.*INSTALLED::YES +alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..c8aa460cf --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=bob@strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf new file mode 100755 index 000000000..f0c5b6f15 --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftsubnet=10.2.0.0/16 + leftcert=bobCert.pem + leftid=bob@strongswan.org + leftfirewall=yes + right=%any + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/double-nat-net/posttest.dat b/testing/tests/ikev2/double-nat-net/posttest.dat new file mode 100644 index 000000000..484297418 --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/posttest.dat @@ -0,0 +1,9 @@ +bob::ipsec stop +alice::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +bob::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +sun::iptables -t nat -F +moon::conntrack -F +sun::conntrack -F +sun::ip route del 10.1.0.0/16 via PH_IP_BOB diff --git a/testing/tests/ikev2/double-nat-net/pretest.dat b/testing/tests/ikev2/double-nat-net/pretest.dat new file mode 100644 index 000000000..41b69aed6 --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/pretest.dat @@ -0,0 +1,15 @@ +alice::/etc/init.d/iptables start 2> /dev/null +bob::/etc/init.d/iptables start 2> /dev/null +bob::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 +sun::iptables -t nat -A PREROUTING -i eth0 -s PH_IP_MOON -p udp -j DNAT --to-destination PH_IP_BOB +sun::ip route add 10.1.0.0/16 via PH_IP_BOB +alice::ipsec start +bob::ipsec start +alice::sleep 2 +alice::ipsec up nat-t +alice::sleep 1 diff --git a/testing/tests/ikev2/double-nat-net/test.conf b/testing/tests/ikev2/double-nat-net/test.conf new file mode 100644 index 000000000..1ca2ffe5a --- /dev/null +++ b/testing/tests/ikev2/double-nat-net/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/double-nat/description.txt b/testing/tests/ikev2/double-nat/description.txt new file mode 100644 index 000000000..ce7de0e56 --- /dev/null +++ b/testing/tests/ikev2/double-nat/description.txt @@ -0,0 +1,5 @@ +The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a tunnel to +the peer <b>bob</b> hiding behind the NAT router <b>sun</b>. UDP encapsulation is used to +traverse the NAT routers. <b>leftfirewall=yes</b> automatically inserts iptables-based +firewall rules that let pass the tunneled traffic. In order to test the double NAT-ed IPsec +tunnel <b>alice</b> pings <b>bob</b>. diff --git a/testing/tests/ikev2/double-nat/evaltest.dat b/testing/tests/ikev2/double-nat/evaltest.dat new file mode 100644 index 000000000..77deea2a7 --- /dev/null +++ b/testing/tests/ikev2/double-nat/evaltest.dat @@ -0,0 +1,5 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +bob::ipsec statusall::nat-t.*INSTALLED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..26830f390 --- /dev/null +++ b/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=bob@strongswan.org + rightsubnet=PH_IP_BOB/32 + auto=add diff --git a/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf new file mode 100755 index 000000000..b4a24cb1f --- /dev/null +++ b/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=bobCert.pem + leftid=bob@strongswan.org + leftfirewall=yes + right=%any + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/double-nat/posttest.dat b/testing/tests/ikev2/double-nat/posttest.dat new file mode 100644 index 000000000..5d39e406d --- /dev/null +++ b/testing/tests/ikev2/double-nat/posttest.dat @@ -0,0 +1,8 @@ +bob::ipsec stop +alice::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +bob::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +sun::iptables -t nat -F +moon::conntrack -F +sun::conntrack -F diff --git a/testing/tests/ikev2/double-nat/pretest.dat b/testing/tests/ikev2/double-nat/pretest.dat new file mode 100644 index 000000000..10ba6d735 --- /dev/null +++ b/testing/tests/ikev2/double-nat/pretest.dat @@ -0,0 +1,13 @@ +alice::/etc/init.d/iptables start 2> /dev/null +bob::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100 +sun::iptables -t nat -A PREROUTING -i eth0 -s PH_IP_MOON -p udp -j DNAT --to-destination PH_IP_BOB +alice::ipsec start +bob::ipsec start +alice::sleep 2 +alice::ipsec up nat-t +alice::sleep 1 diff --git a/testing/tests/ikev2/double-nat/test.conf b/testing/tests/ikev2/double-nat/test.conf new file mode 100644 index 000000000..1ca2ffe5a --- /dev/null +++ b/testing/tests/ikev2/double-nat/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/dpd-clear/description.txt b/testing/tests/ikev2/dpd-clear/description.txt new file mode 100644 index 000000000..7f62dc576 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/description.txt @@ -0,0 +1,5 @@ +The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway <b>moon</b> +which in turn activates <b>Dead Peer Detection</b> (DPD) with a polling interval of 10 s. +When the network connectivity between <b>carol</b> and <b>moon</b> is forcefully disrupted, +<b>moon</b> clears the connection after 4 unsuccessful retransmits. + diff --git a/testing/tests/ikev2/dpd-clear/evaltest.dat b/testing/tests/ikev2/dpd-clear/evaltest.dat new file mode 100644 index 000000000..86c0227bd --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/evaltest.dat @@ -0,0 +1,6 @@ +carol::ipsec statusall::home.*INSTALLED::YES +carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +moon::sleep 180::no output expected::NO +moon::cat /var/log/daemon.log::sending DPD request::YES +moon::cat /var/log/daemon.log::retransmit.*of request::YES +moon::cat /var/log/daemon.log::giving up after 5 retransmits::YES diff --git a/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..e5d9ad476 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..97b5411bd --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + leftnexthop=%direct + keyexchange=ikev2 + dpdaction=clear + dpddelay=10 + +conn rw + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + rightid=carol@strongswan.org + auto=add diff --git a/testing/tests/ikev2/dpd-clear/posttest.dat b/testing/tests/ikev2/dpd-clear/posttest.dat new file mode 100644 index 000000000..931db4272 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/posttest.dat @@ -0,0 +1,3 @@ +carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/dpd-clear/pretest.dat b/testing/tests/ikev2/dpd-clear/pretest.dat new file mode 100644 index 000000000..14ed95322 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/dpd-clear/test.conf b/testing/tests/ikev2/dpd-clear/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/dpd-clear/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dpd-hold/description.txt b/testing/tests/ikev2/dpd-hold/description.txt new file mode 100644 index 000000000..405e67cb9 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/description.txt @@ -0,0 +1,7 @@ +The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway +<b>moon</b>. Both end points activate <b>Dead Peer Detection</b> (DPD) with a +polling interval of 10 s. When the network connectivity between <b>carol</b> +and <b>moon</b> is forcefully disrupted for a duration of 100 s, <b>moon</b> +clears the connection after 4 unsuccessful retransmits whereas <b>carol</b> +also takes down the connection but installs a route which triggers when +<b>carol</b> sends a ping to client <b>alice</b> behind gateway <b>moon</b>. diff --git a/testing/tests/ikev2/dpd-hold/evaltest.dat b/testing/tests/ikev2/dpd-hold/evaltest.dat new file mode 100644 index 000000000..2cf063762 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/evaltest.dat @@ -0,0 +1,14 @@ +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::rw.*INSTALLED::YES +moon::iptables -A INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO +carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +carol::sleep 180::no output expected::NO +carol::cat /var/log/daemon.log::sending DPD request::YES +carol::cat /var/log/daemon.log::retransmit.*of request::YES +carol::cat /var/log/daemon.log::giving up after 5 retransmits::YES +carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +moon::iptables -D INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO +carol::ping -c 1 PH_IP_ALICE::trigger route::NO +carol::sleep 2::no output expected::NO +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::rw.*INSTALLED::YES diff --git a/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..dff90e563 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + dpdaction=hold + dpddelay=10 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..97b5411bd --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + leftnexthop=%direct + keyexchange=ikev2 + dpdaction=clear + dpddelay=10 + +conn rw + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + rightid=carol@strongswan.org + auto=add diff --git a/testing/tests/ikev2/dpd-hold/posttest.dat b/testing/tests/ikev2/dpd-hold/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/dpd-hold/pretest.dat b/testing/tests/ikev2/dpd-hold/pretest.dat new file mode 100644 index 000000000..14ed95322 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/dpd-hold/test.conf b/testing/tests/ikev2/dpd-hold/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/dpd-hold/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/dpd-restart/description.txt b/testing/tests/ikev2/dpd-restart/description.txt new file mode 100644 index 000000000..410d3d636 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/description.txt @@ -0,0 +1,7 @@ +The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway +<b>moon</b>. Both end points activate <b>Dead Peer Detection</b> (DPD) with a +polling interval of 10 s. When the network connectivity between <b>carol</b> +and <b>moon</b> is forcefully disrupted for a duration of 100 s, <b>moon</b> +clears the connection after 4 unsuccessful retransmits whereas <b>carol</b> +also takes down the connection but immediately tries to reconnect which succeeds +as soon as the connection becomes available again. diff --git a/testing/tests/ikev2/dpd-restart/evaltest.dat b/testing/tests/ikev2/dpd-restart/evaltest.dat new file mode 100644 index 000000000..28edd4823 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/evaltest.dat @@ -0,0 +1,13 @@ +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::rw.*INSTALLED::YES +moon::iptables -A INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO +carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +carol::sleep 180::no output expected::NO +carol::cat /var/log/daemon.log::sending DPD request::YES +carol::cat /var/log/daemon.log::retransmit.*of request::YES +carol::cat /var/log/daemon.log::giving up after 5 retransmits::YES +carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO +moon::iptables -D INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO +carol::sleep 10::no output expected::NO +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::rw.*INSTALLED::YES diff --git a/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..7c5b88a2c --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + dpdaction=restart + dpddelay=10 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..97b5411bd --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + leftnexthop=%direct + keyexchange=ikev2 + dpdaction=clear + dpddelay=10 + +conn rw + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + rightid=carol@strongswan.org + auto=add diff --git a/testing/tests/ikev2/dpd-restart/posttest.dat b/testing/tests/ikev2/dpd-restart/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/dpd-restart/pretest.dat b/testing/tests/ikev2/dpd-restart/pretest.dat new file mode 100644 index 000000000..14ed95322 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/dpd-restart/test.conf b/testing/tests/ikev2/dpd-restart/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/dpd-restart/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/host2host-cert/description.txt b/testing/tests/ikev2/host2host-cert/description.txt new file mode 100644 index 000000000..6be21bf8f --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/description.txt @@ -0,0 +1,4 @@ +A connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up. +The authentication is based on X.509 certificates. <b>leftfirewall=yes</b> automatically +inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test the host-to-host tunnel <b>moon</b> pings <b>sun</b>. diff --git a/testing/tests/ikev2/host2host-cert/evaltest.dat b/testing/tests/ikev2/host2host-cert/evaltest.dat new file mode 100644 index 000000000..8d5d8167a --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::host-host.*ESTABLISHED::YES +sun::ipsec statusall::host-host.*ESTABLISHED::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..2d41690cc --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + auto=add diff --git a/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..7ffbf64ac --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_SUN + leftnexthop=%direct + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/host2host-cert/posttest.dat b/testing/tests/ikev2/host2host-cert/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/host2host-cert/pretest.dat b/testing/tests/ikev2/host2host-cert/pretest.dat new file mode 100644 index 000000000..1fa70177c --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up host-host diff --git a/testing/tests/ikev2/host2host-cert/test.conf b/testing/tests/ikev2/host2host-cert/test.conf new file mode 100644 index 000000000..305a67316 --- /dev/null +++ b/testing/tests/ikev2/host2host-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/host2host-swapped/description.txt b/testing/tests/ikev2/host2host-swapped/description.txt new file mode 100644 index 000000000..34cfe43cc --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/description.txt @@ -0,0 +1,3 @@ +Same scenario as test <a href="../host2host-cert/"><b>host2host-cert</b></a> but with +swapped end definitions: <b>right</b> denotes the <b>local</b> side whereas +<b>left</b> stands for the <b>remote</b> peer. diff --git a/testing/tests/ikev2/host2host-swapped/evaltest.dat b/testing/tests/ikev2/host2host-swapped/evaltest.dat new file mode 100644 index 000000000..8d5d8167a --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::host-host.*ESTABLISHED::YES +sun::ipsec statusall::host-host.*ESTABLISHED::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..0c3dd7abe --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + right=PH_IP_MOON + rightnexthop=%direct + rightcert=moonCert.pem + rightid=@moon.strongswan.org + rightfirewall=yes + left=PH_IP_SUN + leftid=@sun.strongswan.org + auto=add diff --git a/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..bd510cc73 --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + right=PH_IP_SUN + rightnexthop=%direct + rightcert=sunCert.pem + rightid=@sun.strongswan.org + rightfirewall=yes + left=PH_IP_MOON + leftid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/host2host-swapped/posttest.dat b/testing/tests/ikev2/host2host-swapped/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/host2host-swapped/pretest.dat b/testing/tests/ikev2/host2host-swapped/pretest.dat new file mode 100644 index 000000000..1fa70177c --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up host-host diff --git a/testing/tests/ikev2/host2host-swapped/test.conf b/testing/tests/ikev2/host2host-swapped/test.conf new file mode 100644 index 000000000..305a67316 --- /dev/null +++ b/testing/tests/ikev2/host2host-swapped/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/host2host-transport/description.txt b/testing/tests/ikev2/host2host-transport/description.txt new file mode 100644 index 000000000..fe3482c96 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/description.txt @@ -0,0 +1,4 @@ +An IPsec <b>transport-mode</b> connection between the hosts <b>moon</b> and <b>sun</b> is +successfully set up. <b>leftfirewall=yes</b> automatically inserts iptables-based firewall +rules that let pass the decrypted IP packets. In order to test the host-to-host connection +<b>moon</b> pings <b>sun</b>. diff --git a/testing/tests/ikev2/host2host-transport/evaltest.dat b/testing/tests/ikev2/host2host-transport/evaltest.dat new file mode 100644 index 000000000..a46e4e4e4 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec status::host-host.*INSTALLED.*TRANSPORT::YES +sun::ipsec status::host-host.*INSTALLED.*TRANSPORT::YES +moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..f957e5fb3 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + type=transport + auto=add diff --git a/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..52b605024 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn host-host + left=PH_IP_SUN + leftnexthop=%direct + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + type=transport + auto=add diff --git a/testing/tests/ikev2/host2host-transport/posttest.dat b/testing/tests/ikev2/host2host-transport/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/host2host-transport/pretest.dat b/testing/tests/ikev2/host2host-transport/pretest.dat new file mode 100644 index 000000000..e2d98f2eb --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 2 +moon::ipsec up host-host diff --git a/testing/tests/ikev2/host2host-transport/test.conf b/testing/tests/ikev2/host2host-transport/test.conf new file mode 100644 index 000000000..cf2e704fd --- /dev/null +++ b/testing/tests/ikev2/host2host-transport/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/nat-double-snat/description.txt b/testing/tests/ikev2/nat-double-snat/description.txt new file mode 100644 index 000000000..e0708898b --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/description.txt @@ -0,0 +1,6 @@ +The roadwarrior <b>alice</b> sets up a connection to host <b>bob</b> using IKEv2. The hosts +sit behind NAT router <b>moon</b> (SNAT) and <b>sun</b> (SNAT) respectively. +UDP encapsulation is used to traverse the NAT router. +The authentication is based on locally loaded <b>X.509 certificates</b>. +In order to test the tunnel the NAT-ed host <b>alice</b> pings the host +<b>bob</b>. diff --git a/testing/tests/ikev2/nat-double-snat/evaltest.dat b/testing/tests/ikev2/nat-double-snat/evaltest.dat new file mode 100644 index 000000000..7a3dede42 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/evaltest.dat @@ -0,0 +1,5 @@ +bob::ipsec statusall::rw-alice.*ESTABLISHED::YES +alice::ipsec statusall::home.*ESTABLISHED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdumpcount::IP moon.strongswan.org.* > bob.strongswan.org.ipsec-nat-t: UDP::2 +moon::tcpdumpcount::IP bob.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::2 diff --git a/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf new file mode 100644 index 000000000..30a067bc9 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf @@ -0,0 +1,16 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn home + left=PH_IP_ALICE + leftcert=aliceCert.pem + leftid=alice@strongswan.org + right=PH_IP_BOB + rightcert=bobCert.pem + rightid=bob@strongswan.org + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem new file mode 100644 index 000000000..199d3eee2 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHjCCAwagAwIBAgIBBjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjUzNFoXDTA5MDkwOTExMjUzNFowWDELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMRswGQYDVQQDFBJib2JAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDAJaejS3/lJfQHgw0nzvotgSQS8ey/6tvbx7s5RsWY +27x9K5xd44aPrvP2Qpyq34IXRY6uPlIqeUTQN7EKpLrWCxMOT36x5N0Co9J5UWRB +fJC141D+8+1RwJ9/baEIecpCvb0GfDOX0GXN5ltcJk82hZjE4y1yHC1FN7V3zdRg +xmloupPuon+X3bTmyMQ93NKkg48CQGtqtfwQ0MqPiOWu8MBhdztfOyu6aW3EgviF +ithLc02SeNzlpqB3M8GDfX+mr3OVDhhhC2OI+VRlZzz7KxJ13DUR2KkvLZR8Ak4E +5lRjkUnTYd/f3OQYxfjC8idUmj5ojR6Fb0x1tsV/glzXAgMBAAGjggEEMIIBADAJ +BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQUaLN5EPOkOkVU3J1Ud0sl ++27OOHswbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ +BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz +dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHQYDVR0RBBYwFIESYm9iQHN0cm9uZ3N3YW4u +b3JnMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcv +c3Ryb25nc3dhbi5jcmwwDQYJKoZIhvcNAQEEBQADggEBAIyQLLxdeO8clplzRW9z +TRR3J0zSedvi2XlIZ/XCsv0ZVfoBLLWcDp3QrxNiVZXvXXtzjPsDs+DAveZF9LGq +0tIw1uT3JorbgNNrmWvxBvJoQTtSw4LQBuV7vF27jrposx3Hi5qtUXUDS6wVnDUI +5iORqsrddnoDuMN+Jt7oRcvKfYSNwTV+m0ZAHdB5a/ARWO5UILOrxEA/N72NcDYN +NdAd+bLaB38SbkSbh1xj/AGnrHxdJBF4h4mx4btc9gtBSh+dwBHOsn4TheqJ6bbw +7FlXBowQDCJIswKNhWfnIepQlM1KEzmq5YX43uZO2b7amRaIKqy2vNE7+UNFYBpE +Mto= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf new file mode 100644 index 000000000..eaec3d642 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn %default + left=PH_IP_BOB + leftcert=bobCert.pem + leftid=bob@strongswan.org + leftsubnet=10.2.0.10/32 + keyexchange=ikev2 + +conn rw-alice + right=%any + rightcert=aliceCert.pem + rightid=alice@strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem new file mode 100644 index 000000000..e99ae8ec7 --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer +GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4 +FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W +6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH +v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc +KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG +A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa +60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG +A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0 +cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo +2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ +AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5 +D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S +CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi +6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re +JGhV +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-double-snat/posttest.dat b/testing/tests/ikev2/nat-double-snat/posttest.dat new file mode 100644 index 000000000..8ad7df96c --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/posttest.dat @@ -0,0 +1,8 @@ +alice::ipsec stop +bob::ipsec stop +alice::rm /etc/ipsec.d/certs/* +bob::rm /etc/ipsec.d/certs/* +moon::route del -net 10.2.0.0/16 +sun::route del -net 10.1.0.0/16 +moon::iptables -t nat -F +sun::iptables -t nat -F diff --git a/testing/tests/ikev2/nat-double-snat/pretest.dat b/testing/tests/ikev2/nat-double-snat/pretest.dat new file mode 100644 index 000000000..da1d43c4e --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/pretest.dat @@ -0,0 +1,11 @@ +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +sun::route add -net 10.1.0.0/16 gw PH_IP_MOON +sun::iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.0/24 -p udp -j SNAT --to-source PH_IP_SUN1:4024-4100 +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::route add -net 10.2.0.0/16 gw PH_IP_SUN +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +bob::ipsec start +alice::ipsec start +alice::sleep 1 +alice::ipsec up home +alice::sleep 1 diff --git a/testing/tests/ikev2/nat-double-snat/test.conf b/testing/tests/ikev2/nat-double-snat/test.conf new file mode 100644 index 000000000..1ca2ffe5a --- /dev/null +++ b/testing/tests/ikev2/nat-double-snat/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice bob" diff --git a/testing/tests/ikev2/nat-one-rw/description.txt b/testing/tests/ikev2/nat-one-rw/description.txt new file mode 100644 index 000000000..c3b9bb820 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/description.txt @@ -0,0 +1,5 @@ +The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a tunnel to +gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnel, the NAT-ed host <b>alice</b> pings the +client <b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-one-rw/evaltest.dat b/testing/tests/ikev2/nat-one-rw/evaltest.dat new file mode 100644 index 000000000..7395e5571 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/evaltest.dat @@ -0,0 +1,5 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec statusall::nat-t.*INSTALLED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..8db43213f --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..a2c168601 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf @@ -0,0 +1,35 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + +conn net-net + leftsubnet=10.2.0.0/16 + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + +conn host-host + right=PH_IP_MOON + rightid=@moon.strongswan.org + auto=add + +conn nat-t + leftsubnet=10.2.0.0/16 + right=%any + rightsubnet=10.1.0.10/32 + auto=add diff --git a/testing/tests/ikev2/nat-one-rw/posttest.dat b/testing/tests/ikev2/nat-one-rw/posttest.dat new file mode 100644 index 000000000..cd0d4df25 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/posttest.dat @@ -0,0 +1,6 @@ +alice::ipsec stop +sun::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/ikev2/nat-one-rw/pretest.dat b/testing/tests/ikev2/nat-one-rw/pretest.dat new file mode 100644 index 000000000..ebd0c19e2 --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/pretest.dat @@ -0,0 +1,11 @@ +alice::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +alice::ipsec start +sun::ipsec start +alice::sleep 4 +alice::ipsec up nat-t +alice::sleep 1 + diff --git a/testing/tests/ikev2/nat-one-rw/test.conf b/testing/tests/ikev2/nat-one-rw/test.conf new file mode 100644 index 000000000..d84149aaf --- /dev/null +++ b/testing/tests/ikev2/nat-one-rw/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/nat-pf/description.txt b/testing/tests/ikev2/nat-pf/description.txt new file mode 100644 index 000000000..bb38af458 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/description.txt @@ -0,0 +1,4 @@ +The roadwarrior <b>carol</b> sets up a connection to host <b>alice</b> sitting behind the NAT router <b>moon</b> +using IKEv2. Port Forwarding is used to publish host <b>alice</b>. UDP encapsulation is used to traverse the NAT router. +The authentication is based on locally loaded <b>X.509 certificates</b>. +In order to test the tunnel the roadwarrior <b>carol</b> pings the host <b>alice</b>. diff --git a/testing/tests/ikev2/nat-pf/evaltest.dat b/testing/tests/ikev2/nat-pf/evaltest.dat new file mode 100644 index 000000000..4d2950521 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/evaltest.dat @@ -0,0 +1,5 @@ +alice::ipsec statusall::rw-carol.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdumpcount::IP carol.strongswan.org.* > moon.strongswan.org.ipsec-nat-t: UDP::2 +moon::tcpdumpcount::IP moon.strongswan.org.ipsec-nat-t > carol.strongswan.org.*: UDP::2 diff --git a/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf new file mode 100644 index 000000000..836379494 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf @@ -0,0 +1,19 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn %default + left=PH_IP_ALICE + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftsubnet=10.1.0.10/32 + keyexchange=ikev2 + +conn rw-carol + right=%any + rightcert=carolCert.pem + rightid=carol@strongswan.org + auto=add diff --git a/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem new file mode 100644 index 000000000..8492fbd45 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX +T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl +vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii +S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW +LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM +YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC +MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD +j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT +EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz +d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u +b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI +U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM +2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE +HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd +hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG +C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK +omBYfxqp +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..52345af7c --- /dev/null +++ b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf @@ -0,0 +1,17 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn home + left=PH_IP_CAROL + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightcert=aliceCert.pem + rightid=alice@strongswan.org + rightsubnet=10.1.0.0/24 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem new file mode 100644 index 000000000..e99ae8ec7 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer +GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4 +FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W +6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH +v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc +KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG +A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa +60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG +A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0 +cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo +2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ +AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5 +D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S +CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi +6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re +JGhV +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-pf/posttest.dat b/testing/tests/ikev2/nat-pf/posttest.dat new file mode 100644 index 000000000..bed4ae1b7 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/posttest.dat @@ -0,0 +1,5 @@ +carol::ipsec stop +alice::ipsec stop +carol::rm /etc/ipsec.d/certs/* +alice::rm /etc/ipsec.d/certs/* +moon::iptables -t nat -F diff --git a/testing/tests/ikev2/nat-pf/pretest.dat b/testing/tests/ikev2/nat-pf/pretest.dat new file mode 100644 index 000000000..fdb3de711 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/pretest.dat @@ -0,0 +1,7 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -m multiport -t nat -A PREROUTING -i eth0 -p udp --dports 500,4500 -j DNAT --to 10.1.0.10 +alice::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/nat-pf/test.conf b/testing/tests/ikev2/nat-pf/test.conf new file mode 100644 index 000000000..21bece8e6 --- /dev/null +++ b/testing/tests/ikev2/nat-pf/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice carol" diff --git a/testing/tests/ikev2/nat-portswitch/description.txt b/testing/tests/ikev2/nat-portswitch/description.txt new file mode 100644 index 000000000..93b779ee1 --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/description.txt @@ -0,0 +1,6 @@ +The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a connection +to gateway <b>sun</b> using IKEv2. UDP encapsulation is used to traverse the NAT router. +The authentication is based on locally loaded <b>X.509 certificates</b>. +After the IPsec Setup NAT router moon "crashes" (i.e. flushes its conntrack +table) and with the next dpd sent from <b>alice</b> a dynamical address update +should occur in gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-portswitch/evaltest.dat b/testing/tests/ikev2/nat-portswitch/evaltest.dat new file mode 100644 index 000000000..75b01a551 --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/evaltest.dat @@ -0,0 +1,10 @@ +sun::ipsec statusall::rw-alice.*ESTABLISHED::YES +alice::ipsec statusall::home.*ESTABLISHED::YES +moon::cmd::iptables -t nat -F::YES +moon::cmd::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:3024-3100::YES +moon::cmd::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:4000-4100::YES +moon::cmd::conntrack -F::YES +alice::cmd::sleep 75::YES +bob::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP, length: 132::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP, length: 132::YES diff --git a/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf new file mode 100644 index 000000000..cd9de533a --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf @@ -0,0 +1,17 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn home + left=PH_IP_ALICE + leftcert=aliceCert.pem + leftid=alice@strongswan.org + right=PH_IP_SUN + rightcert=sunCert.pem + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem new file mode 100644 index 000000000..e7825e3db --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIECzCCAvOgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMTU1M1oXDTA5MDkwOTExMTU1M1owRTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN1bi5z +dHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOQ8 +foB9h5BZ92gA5JkQTJNuoF6FAzoq91Gh7To27/g74p01+SUnsSaBfPmNfGp4avdS +Ewy2dWMA/7uj0Dbe8MEKssNztp0JQubp2s7n8mrrQLGsqB6YAS09l75XDjS3yqTC +AtH1kD4zAl/j/AyeQBuLR4CyJEmC/rqD3/a+pr42CaljuFBgBRpCTUpU4mlslZSe +zv9wu61PwTFxb8VDlBHUd/lwkXThKgU3uEhWRxLahpSldEGmiTTmx30k/XbOMF2n +HObEHt5EY9uWRGGbj81ZRWiNk0dNtbpneUHv/NvdWLc591M8cEGEQdWW2XTVbL2G +N67q8hdzGgIvb7QJPMcCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQD +AgOoMB0GA1UdDgQWBBQ9xLkyCBbyQmRet0vvV1Fg6z5q2DBtBgNVHSMEZjBkgBRd +p91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoT +EExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIB +ADAdBgNVHREEFjAUghJzdW4uc3Ryb25nc3dhbi5vcmcwOQYDVR0fBDIwMDAuoCyg +KoYoaHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2FuLmNybDANBgkq +hkiG9w0BAQQFAAOCAQEAGQQroiAa0SwwhJprGd7OM+rfBJAGbsa3DPzFCfHX1R7i +ZyDs9aph1DK+IgUa377Ev1U7oB0EldpmOoJJugCjtNLfpW3t1RXBERL/QfpO2+VP +Wt3SfZ0Oq48jiqB1MVLMZRPCICZEQjT4sJ3HYs5ZuucuvoxeMx3rQ4HxUtHtMD3S +5JNMwFFiOXAjyIyrTlb7YuRJTT5hE+Rms8GUQ5Xnt7zKZ7yfoSLFzy0/cLFPdQvE +JA7w8crODCZpDgEKVHVyUWuyt1O46N3ydUfDcnKJoQ9HWHm3xCbDex5MHTnvm1lk +Stx71CGM7TE6VPy028UlrSw0JqEwCVwstei2cMzwgA== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf new file mode 100644 index 000000000..a7722142f --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn %default + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + keyexchange=ikev2 + +conn rw-alice + right=%any + rightcert=aliceCert.pem + rightid=alice@strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem new file mode 100644 index 000000000..e99ae8ec7 --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer +GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4 +FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W +6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH +v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc +KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG +A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa +60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG +A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0 +cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo +2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ +AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5 +D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S +CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi +6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re +JGhV +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-portswitch/posttest.dat b/testing/tests/ikev2/nat-portswitch/posttest.dat new file mode 100644 index 000000000..3b9f53e9b --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/posttest.dat @@ -0,0 +1,6 @@ +sun::ipsec stop +alice::ipsec stop +sun::rm /etc/ipsec.d/certs/* +alice::rm /etc/ipsec.d/certs/* +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/ikev2/nat-portswitch/pretest.dat b/testing/tests/ikev2/nat-portswitch/pretest.dat new file mode 100644 index 000000000..17cc4b070 --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/pretest.dat @@ -0,0 +1,9 @@ +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +sun::ipsec start +alice::ipsec start +alice::sleep 1 +alice::ipsec up home +alice::sleep 1 diff --git a/testing/tests/ikev2/nat-portswitch/test.conf b/testing/tests/ikev2/nat-portswitch/test.conf new file mode 100644 index 000000000..d84149aaf --- /dev/null +++ b/testing/tests/ikev2/nat-portswitch/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice sun" diff --git a/testing/tests/ikev2/nat-rw-mixed/description.txt b/testing/tests/ikev2/nat-rw-mixed/description.txt new file mode 100644 index 000000000..511a1a874 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> +set up a connection to gateway <b>sun</b>. <b>alice</b> uses the IKEv2 key exchange protocol +whereas <b>venus</b> negotiates the connection via the IKEv1 protocol. +UDP encapsulation is used to traverse the NAT router. +In order to test the tunnel the NAT-ed hosts <b>alice</b> and <b>venus</b> ping the client +<b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-rw-mixed/evaltest.dat b/testing/tests/ikev2/nat-rw-mixed/evaltest.dat new file mode 100644 index 000000000..685c1b43f --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/evaltest.dat @@ -0,0 +1,9 @@ +sun::ipsec statusall::rw-alice.*ESTABLISHED::YES +sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES +sun::ipsec status::nat-t.*@venus.strongswan.org::YES +alice::ipsec statusall::home.*ESTABLISHED::YES +sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf new file mode 100644 index 000000000..cd9de533a --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf @@ -0,0 +1,17 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutostart=no + +conn home + left=PH_IP_ALICE + leftcert=aliceCert.pem + leftid=alice@strongswan.org + right=PH_IP_SUN + rightcert=sunCert.pem + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem new file mode 100644 index 000000000..e7825e3db --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIECzCCAvOgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMTU1M1oXDTA5MDkwOTExMTU1M1owRTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN1bi5z +dHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOQ8 +foB9h5BZ92gA5JkQTJNuoF6FAzoq91Gh7To27/g74p01+SUnsSaBfPmNfGp4avdS +Ewy2dWMA/7uj0Dbe8MEKssNztp0JQubp2s7n8mrrQLGsqB6YAS09l75XDjS3yqTC +AtH1kD4zAl/j/AyeQBuLR4CyJEmC/rqD3/a+pr42CaljuFBgBRpCTUpU4mlslZSe +zv9wu61PwTFxb8VDlBHUd/lwkXThKgU3uEhWRxLahpSldEGmiTTmx30k/XbOMF2n +HObEHt5EY9uWRGGbj81ZRWiNk0dNtbpneUHv/NvdWLc591M8cEGEQdWW2XTVbL2G +N67q8hdzGgIvb7QJPMcCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQD +AgOoMB0GA1UdDgQWBBQ9xLkyCBbyQmRet0vvV1Fg6z5q2DBtBgNVHSMEZjBkgBRd +p91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoT +EExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIB +ADAdBgNVHREEFjAUghJzdW4uc3Ryb25nc3dhbi5vcmcwOQYDVR0fBDIwMDAuoCyg +KoYoaHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2FuLmNybDANBgkq +hkiG9w0BAQQFAAOCAQEAGQQroiAa0SwwhJprGd7OM+rfBJAGbsa3DPzFCfHX1R7i +ZyDs9aph1DK+IgUa377Ev1U7oB0EldpmOoJJugCjtNLfpW3t1RXBERL/QfpO2+VP +Wt3SfZ0Oq48jiqB1MVLMZRPCICZEQjT4sJ3HYs5ZuucuvoxeMx3rQ4HxUtHtMD3S +5JNMwFFiOXAjyIyrTlb7YuRJTT5hE+Rms8GUQ5Xnt7zKZ7yfoSLFzy0/cLFPdQvE +JA7w8crODCZpDgEKVHVyUWuyt1O46N3ydUfDcnKJoQ9HWHm3xCbDex5MHTnvm1lk +Stx71CGM7TE6VPy028UlrSw0JqEwCVwstei2cMzwgA== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf new file mode 100644 index 000000000..b85bd607b --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf @@ -0,0 +1,31 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +version 2.0 # conforms to second version of ipsec.conf specification + +config setup + plutodebug=control + crlcheckinterval=180 + nat_traversal=yes + +conn %default + ikelifetime=60m + keylife=20m + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + +conn rw-alice + right=%any + rightcert=aliceCert.pem + rightid=alice@strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add + +conn nat-t + leftsubnet=10.2.0.0/16 + right=%any + rightsubnetwithin=10.1.0.0/16 + keyexchange=ikev1 + auto=add diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem new file mode 100644 index 000000000..e99ae8ec7 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer +GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4 +FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W +6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH +v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc +KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG +A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa +60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG +A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0 +cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo +2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ +AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5 +D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S +CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi +6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re +JGhV +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem new file mode 100644 index 000000000..25a6941b0 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIEDzCCAvegAwIBAgIBBDANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMTgyNloXDTA5MDkwOTExMTgyNlowRzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHTAbBgNVBAMTFHZlbnVz +LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +mlQ2s9J7bw73onkw0ZwwcM2JDJuU3KmmuzETlmLdtg7m8yFCdhoDg6cxrsIvPAWy +Gs++1e+1qzy7LTnNHckaHHFwJQf0JoIGE1bbUrJidX8B1T3sDdvZFbyfmQTWSEyJ +thrdqdPS92VJW/9XQOPeEhudIHr+NtWQfCm3OQFKDXGCEkHOjpVNHn3BPUiL99ON +FiLZX3gZy6vTERpEE8ga66fHtpM3RJfIxYoUQUdRw8iIa8iOvRGtJa/MfOWX6L/H +wquRv3SuCl4iMSph7e/VE+z5xx3OyKSAki914DgRFnQITKjyGxw1lORlDQlZy2w/ +nu0BAbXS1pb/2AiF8jDpbQIDAQABo4IBBjCCAQIwCQYDVR0TBAIwADALBgNVHQ8E +BAMCA6gwHQYDVR0OBBYEFEqPlXBYJh1knX0Q61HMcn9LOZ6sMG0GA1UdIwRmMGSA +FF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcGA1UE +ChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290IENB +ggEAMB8GA1UdEQQYMBaCFHZlbnVzLnN0cm9uZ3N3YW4ub3JnMDkGA1UdHwQyMDAw +LqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dhbi5jcmww +DQYJKoZIhvcNAQEEBQADggEBAEx3kXh2Z5CMH+tX6cJPyi6gSeOgXy7NBiNsEdXN +rwGp4DwN6uiSog4EYZJA203oqE3eaoYdBXKiOGvjW4vyigvpDr8H+MeW2HsNuMKX +PFpY4NucV0fJlzFhtkp31zTLHNESCgTqNIwGj+CbN0rxhHGE6502krnu+C12nJ7B +fdMzml1RmVp4JlZC5yfiTy0F2s/aH+8xQ2x509UoD+boNM9GR+IlWS2dDypISGid +hbM4rpiMLBj2riWD8HiuljkKQ6LemBXeZQXuIPlusl7cH/synNkHk8iiALM8xfGh +wTEmdo5Tp5sDI3cj3LVvhcsTxjiOA81her1F0itlxpEA/gA= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/nat-rw-mixed/posttest.dat b/testing/tests/ikev2/nat-rw-mixed/posttest.dat new file mode 100644 index 000000000..0a8ce2bbc --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/posttest.dat @@ -0,0 +1,6 @@ +sun::ipsec stop +alice::ipsec stop +venus::ipsec stop +sun::rm /etc/ipsec.d/certs/* +alice::rm /etc/ipsec.d/certs/* +moon::iptables -t nat -F diff --git a/testing/tests/ikev2/nat-rw-mixed/pretest.dat b/testing/tests/ikev2/nat-rw-mixed/pretest.dat new file mode 100644 index 000000000..d2c5c7df2 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/pretest.dat @@ -0,0 +1,11 @@ +sun::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +sun::ipsec start +alice::ipsec start +venus::ipsec start +alice::sleep 1 +venus::ipsec up nat-t +alice::ipsec up home +alice::sleep 1 diff --git a/testing/tests/ikev2/nat-rw-mixed/test.conf b/testing/tests/ikev2/nat-rw-mixed/test.conf new file mode 100644 index 000000000..84317fd70 --- /dev/null +++ b/testing/tests/ikev2/nat-rw-mixed/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-two-rw-psk/description.txt b/testing/tests/ikev2/nat-two-rw-psk/description.txt new file mode 100644 index 000000000..c74897d9a --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up +tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +Both roadwarriors share the same Pre-Shared Key (PSK) with the gateway <b>sun</b>. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b> +ping the client <b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat b/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat new file mode 100644 index 000000000..2cab168f0 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat @@ -0,0 +1,9 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +venus::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec status::nat-t.*\[PH_IP_ALICE\]::YES +sun::ipsec status::nat-t.*\[PH_IP_VENUS\]::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..e0ccbb812 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf @@ -0,0 +1,19 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn nat-t + left=%defaultroute + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets new file mode 100644 index 000000000..d61e3eb48 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +PH_IP_ALICE : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..c76e7ce92 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn nat-t + left=PH_IP_SUN + leftsubnet=10.2.0.0/16 + leftfirewall=yes + leftnexthop=%direct + right=%any + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets new file mode 100644 index 000000000..5f2955503 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +PH_IP_ALICE : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL + +PH_IP_VENUS : PSK 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf new file mode 100755 index 000000000..e0ccbb812 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf @@ -0,0 +1,19 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn nat-t + left=%defaultroute + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets new file mode 100644 index 000000000..9cd66b1df --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +PH_IP_VENUS : PSK 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br diff --git a/testing/tests/ikev2/nat-two-rw-psk/posttest.dat b/testing/tests/ikev2/nat-two-rw-psk/posttest.dat new file mode 100644 index 000000000..52572ece8 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/posttest.dat @@ -0,0 +1,8 @@ +sun::ipsec stop +alice::ipsec stop +venus::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/ikev2/nat-two-rw-psk/pretest.dat b/testing/tests/ikev2/nat-two-rw-psk/pretest.dat new file mode 100644 index 000000000..5e23259bb --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/pretest.dat @@ -0,0 +1,17 @@ +alice::/etc/init.d/iptables start 2> /dev/null +venus::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +alice::rm /etc/ipsec.d/cacerts/* +venus::rm /etc/ipsec.d/cacerts/* +sun::rm /etc/ipsec.d/cacerts/* +alice::ipsec start +venus::ipsec start +sun::ipsec start +alice::sleep 2 +alice::ipsec up nat-t +venus::sleep 2 +venus::ipsec up nat-t +venus::sleep 2 diff --git a/testing/tests/ikev2/nat-two-rw-psk/test.conf b/testing/tests/ikev2/nat-two-rw-psk/test.conf new file mode 100644 index 000000000..84317fd70 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw-psk/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/nat-two-rw/description.txt b/testing/tests/ikev2/nat-two-rw/description.txt new file mode 100644 index 000000000..dcf4b94bd --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/description.txt @@ -0,0 +1,5 @@ +The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up +tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router. +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass +the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b> +ping the client <b>bob</b> behind the gateway <b>sun</b>. diff --git a/testing/tests/ikev2/nat-two-rw/evaltest.dat b/testing/tests/ikev2/nat-two-rw/evaltest.dat new file mode 100644 index 000000000..28d5b5289 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/evaltest.dat @@ -0,0 +1,9 @@ +alice::ipsec statusall::nat-t.*INSTALLED::YES +venus::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec statusall::nat-t.*INSTALLED::YES +sun::ipsec status::alice@strongswan.org::YES +sun::ipsec status::@venus.strongswan.org::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES +moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES diff --git a/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf new file mode 100755 index 000000000..3da2fcf86 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=aliceCert.pem + leftid=alice@strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..d8b426318 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf @@ -0,0 +1,35 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + +conn net-net + leftsubnet=10.2.0.0/16 + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add + +conn host-host + right=PH_IP_MOON + rightid=@moon.strongswan.org + auto=add + +conn nat-t + leftsubnet=10.2.0.0/16 + right=%any + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf new file mode 100755 index 000000000..3a70b3434 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn nat-t + left=%defaultroute + leftcert=venusCert.pem + leftid=@venus.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/nat-two-rw/posttest.dat b/testing/tests/ikev2/nat-two-rw/posttest.dat new file mode 100644 index 000000000..52572ece8 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/posttest.dat @@ -0,0 +1,8 @@ +sun::ipsec stop +alice::ipsec stop +venus::ipsec stop +alice::/etc/init.d/iptables stop 2> /dev/null +venus::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null +moon::iptables -t nat -F +moon::conntrack -F diff --git a/testing/tests/ikev2/nat-two-rw/pretest.dat b/testing/tests/ikev2/nat-two-rw/pretest.dat new file mode 100644 index 000000000..e365ff5c5 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/pretest.dat @@ -0,0 +1,14 @@ +alice::/etc/init.d/iptables start 2> /dev/null +venus::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100 +moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100 +alice::ipsec start +venus::ipsec start +sun::ipsec start +alice::sleep 2 +alice::ipsec up nat-t +venus::sleep 2 +venus::ipsec up nat-t +venus::sleep 2 diff --git a/testing/tests/ikev2/nat-two-rw/test.conf b/testing/tests/ikev2/nat-two-rw/test.conf new file mode 100644 index 000000000..84317fd70 --- /dev/null +++ b/testing/tests/ikev2/nat-two-rw/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="alice venus sun" diff --git a/testing/tests/ikev2/net2net-cert/description.txt b/testing/tests/ikev2/net2net-cert/description.txt new file mode 100644 index 000000000..7eea9192f --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/description.txt @@ -0,0 +1,6 @@ +A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up. +The authentication is based on <b>X.509 certificates</b>. Upon the successful +establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically +inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b> +pings client <b>bob</b> located behind gateway <b>sun</b>. diff --git a/testing/tests/ikev2/net2net-cert/evaltest.dat b/testing/tests/ikev2/net2net-cert/evaltest.dat new file mode 100644 index 000000000..e67c39a08 --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::net-net.*ESTABLISHED::YES +sun::ipsec statusall::net-net.*ESTABLISHED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..e86ed4f72 --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=PH_IP_SUN + rightid=@sun.strongswan.org + rightsubnet=10.2.0.0/16 + auto=add diff --git a/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..ea55d2edb --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/net2net-cert/posttest.dat b/testing/tests/ikev2/net2net-cert/posttest.dat new file mode 100644 index 000000000..a4c96e10f --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/posttest.dat @@ -0,0 +1,5 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null + diff --git a/testing/tests/ikev2/net2net-cert/pretest.dat b/testing/tests/ikev2/net2net-cert/pretest.dat new file mode 100644 index 000000000..2d7a78acb --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up net-net diff --git a/testing/tests/ikev2/net2net-cert/test.conf b/testing/tests/ikev2/net2net-cert/test.conf new file mode 100644 index 000000000..d9a61590f --- /dev/null +++ b/testing/tests/ikev2/net2net-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-psk/description.txt b/testing/tests/ikev2/net2net-psk/description.txt new file mode 100644 index 000000000..02cddbb83 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/description.txt @@ -0,0 +1,6 @@ +A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up. +The authentication is based on <b>Preshared Keys</b> (PSK). Upon the successful +establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically +inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b> +pings client <b>bob</b> located behind gateway <b>sun</b>. diff --git a/testing/tests/ikev2/net2net-psk/evaltest.dat b/testing/tests/ikev2/net2net-psk/evaltest.dat new file mode 100644 index 000000000..e67c39a08 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::net-net.*ESTABLISHED::YES +sun::ipsec statusall::net-net.*ESTABLISHED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..da51fa46a --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + keyexchange=ikev2 + +conn net-net + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftid=@moon.strongswan.org + leftnexthop=%direct + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=add diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..cbdddfb18 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,12 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL + +@moon.strongswan.org %any : PSK 0x45a30759df97dc26a15b88ff + +@sun.strongswan.org : PSK "This is a strong password" + +: PSK 'My "home" is my "castle"!' + +192.168.0.1 : PSK "Andi's home" + diff --git a/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..bea0eeb08 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + authby=secret + keyexchange=ikev2 + +conn net-net + left=PH_IP_SUN + leftsubnet=10.2.0.0/16 + leftid=@sun.strongswan.org + leftfirewall=yes + leftnexthop=%direct + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets new file mode 100644 index 000000000..be95c4d99 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets @@ -0,0 +1,7 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL + + + + diff --git a/testing/tests/ikev2/net2net-psk/posttest.dat b/testing/tests/ikev2/net2net-psk/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/net2net-psk/pretest.dat b/testing/tests/ikev2/net2net-psk/pretest.dat new file mode 100644 index 000000000..976a196db --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/pretest.dat @@ -0,0 +1,8 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::rm /etc/ipsec.d/cacerts/* +sun::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +sun::ipsec start +moon::sleep 1 +moon::ipsec up net-net diff --git a/testing/tests/ikev2/net2net-psk/test.conf b/testing/tests/ikev2/net2net-psk/test.conf new file mode 100644 index 000000000..f74d0f7d6 --- /dev/null +++ b/testing/tests/ikev2/net2net-psk/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-route/description.txt b/testing/tests/ikev2/net2net-route/description.txt new file mode 100644 index 000000000..323f09555 --- /dev/null +++ b/testing/tests/ikev2/net2net-route/description.txt @@ -0,0 +1,9 @@ +A tunnel that will connect the subnets behind the gateways <b>moon</b> +and <b>sun</b>, respectively, is preconfigured by installing a %trap eroute +on gateway <b>moon</b> by means of the setting <b>auto=route</b> in ipsec.conf. +A subsequent ping issued by client <b>alice</b> behind gateway <b>moon</b> to +<b>bob</b> located behind gateway <b>sun</b> triggers the %trap eroute and +leads to the automatic establishment of the subnet-to-subnet tunnel. +<p> +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules +that let pass the tunneled traffic. diff --git a/testing/tests/ikev2/net2net-route/evaltest.dat b/testing/tests/ikev2/net2net-route/evaltest.dat new file mode 100644 index 000000000..d5350467e --- /dev/null +++ b/testing/tests/ikev2/net2net-route/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::creating acquire job for CHILD_SA::YES +moon::ipsec statusall::net-net.*INSTALLED::YES +sun::ipsec statusall::net-net.*INSTALLED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..8b8548815 --- /dev/null +++ b/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + leftnexthop=%direct + keyexchange=ikev2 + +conn net-net + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=route diff --git a/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..ea55d2edb --- /dev/null +++ b/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/net2net-route/posttest.dat b/testing/tests/ikev2/net2net-route/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/net2net-route/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/net2net-route/pretest.dat b/testing/tests/ikev2/net2net-route/pretest.dat new file mode 100644 index 000000000..2eef7de19 --- /dev/null +++ b/testing/tests/ikev2/net2net-route/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +sun::ipsec start +moon::sleep 2 +alice::ping -c 10 PH_IP_BOB diff --git a/testing/tests/ikev2/net2net-route/test.conf b/testing/tests/ikev2/net2net-route/test.conf new file mode 100644 index 000000000..d9a61590f --- /dev/null +++ b/testing/tests/ikev2/net2net-route/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/net2net-start/description.txt b/testing/tests/ikev2/net2net-start/description.txt new file mode 100644 index 000000000..f5320685e --- /dev/null +++ b/testing/tests/ikev2/net2net-start/description.txt @@ -0,0 +1,8 @@ +A tunnel connecting the subnets behind the gateways <b>moon</b> and <b>sun</b>, +respectively, is automatically established by means of the setting +<b>auto=start</b> in ipsec.conf. The connection is tested by client <b>alice</b> +behind gateway <b>moon</b> pinging the client <b>bob</b> located behind +gateway <b>sun</b>. +<p> +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules +that let pass the tunneled traffic. diff --git a/testing/tests/ikev2/net2net-start/evaltest.dat b/testing/tests/ikev2/net2net-start/evaltest.dat new file mode 100644 index 000000000..244dec5bf --- /dev/null +++ b/testing/tests/ikev2/net2net-start/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec statusall::net-net.*INSTALLED::YES +sun::ipsec statusall::net-net.*INSTALLED::YES +alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES +sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES +sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..091871e49 --- /dev/null +++ b/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP_SUN + rightsubnet=10.2.0.0/16 + rightid=@sun.strongswan.org + auto=start diff --git a/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..b2e41894c --- /dev/null +++ b/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + left=PH_IP_SUN + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftsubnet=10.2.0.0/16 + leftnexthop=%direct + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/net2net-start/posttest.dat b/testing/tests/ikev2/net2net-start/posttest.dat new file mode 100644 index 000000000..5a9150bc8 --- /dev/null +++ b/testing/tests/ikev2/net2net-start/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +sun::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/net2net-start/pretest.dat b/testing/tests/ikev2/net2net-start/pretest.dat new file mode 100644 index 000000000..6e41d5245 --- /dev/null +++ b/testing/tests/ikev2/net2net-start/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +sun::/etc/init.d/iptables start 2> /dev/null +sun::ipsec start +sun::sleep 2 +moon::ipsec start +alice::sleep 3 diff --git a/testing/tests/ikev2/net2net-start/test.conf b/testing/tests/ikev2/net2net-start/test.conf new file mode 100644 index 000000000..d9a61590f --- /dev/null +++ b/testing/tests/ikev2/net2net-start/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon winnetou sun bob" + +# Corresponding block diagram +# +DIAGRAM="a-m-w-s-b.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ikev2/ocsp-local-cert/description.txt b/testing/tests/ikev2/ocsp-local-cert/description.txt new file mode 100644 index 000000000..61f7d9957 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/description.txt @@ -0,0 +1,9 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which possesses a <b>self-signed</b> +OCSP signer certificate that must be imported locally by the peers into +<b>/etc/ipsec.d/ocspcerts/</b>. A strongswan <b>ca</b> section in ipsec.conf +defines an <b>OCSP URI</b> pointing to <b>winnetou</b>. +<p> +<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since +the status of both certificates is <b>good</b>. diff --git a/testing/tests/ikev2/ocsp-local-cert/evaltest.dat b/testing/tests/ikev2/ocsp-local-cert/evaltest.dat new file mode 100644 index 000000000..6b849b811 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/evaltest.dat @@ -0,0 +1,8 @@ +moon::cat /var/log/daemon.log::received valid http response::YES +carol::cat /var/log/daemon.log::received valid http response::YES +moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..0209111ba --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem new file mode 100644 index 000000000..77f5bde52 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEbjCCA1agAwIBAgIJALN2wqyLTIzfMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQ +IFNlbGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2Fu +Lm9yZzAeFw0wNzAzMTQxMjM0MDNaFw0xMjAzMTIxMjM0MDNaMGsxCzAJBgNVBAYT +AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQIFNl +bGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2FuLm9y +ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMgSOFeDdWxYKGPUSUhM +BFAELGmHKfg2R25aWlE8ju//I0ByaoIsm8BPapSiiiwTdho/JPP44/nvHcDQu828 +P3uY5XbSPZpiiBgFoo8BC2/Y/rxY/skjEzqoHEXjg/vO1bA0tqjVn5a0jpkai7pD +mUyBrmn1ArOjhR/HAupCHsIb7sAL+IEXByMcZQK6bvNL9PMTYI1T72+t/9cZAAEJ +DfEhyJZMxQKgmT1SNzLwyszy1M1HF95D59gBok4PaRWWsLdwzplfTKh61CeGCYqb +UP3qpMKrJ8Y7uv+e1vVzuYbJg5DR+bF1IGIc9QRyJlTkhZco+zTCQYxpvsNO18yr +4qcCAwEAAaOCARMwggEPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgECMB0GA1UdDgQW +BBQHqEiJbwUSQJDtrfhopkda0nXrLTCBnQYDVR0jBIGVMIGSgBQHqEiJbwUSQJDt +rfhopkda0nXrLaFvpG0wazELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0 +cm9uZ1N3YW4xIzAhBgNVBAsTGk9DU1AgU2VsZi1TaWduZWQgQXV0aG9yaXR5MRww +GgYDVQQDExNvY3NwLnN0cm9uZ3N3YW4ub3JnggkAs3bCrItMjN8wHgYDVR0RBBcw +FYITb2NzcC5zdHJvbmdzd2FuLm9yZzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN +BgkqhkiG9w0BAQUFAAOCAQEAi//I0DOlUXNHxzLuuxyr6k5gO55zMCmHUcVfjVFZ +9e+UpLLFZY+qbxOfzVLpKyDch6dKDIA/H+SzX1GZ+uW4FFQ1wYlHcK1Sio9hOgqI +zeWdY5uHF6iERVYgOU/xp0+0LS5l4ezCvOKVkYJEFWe2eyn9rd4PGLW4/lTQiK1V +14YzPyAhB7n8Sln5LBxAeY7U7Y8jEMLXZ+VF21mjH2sxZzWV/qWZdNWVUNaLZTYL +lTqyzqsk40v5BTrjSvAWHN+c1WzydMvatFDzghlPnvR8dufRN2bnlj10J8sizn+v +1iDtM6uYi8+Yn26yMGjCP+RYW+bwKQ927Gr43UkqqGsbCg== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..21b48ef0c --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem new file mode 100644 index 000000000..77f5bde52 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEbjCCA1agAwIBAgIJALN2wqyLTIzfMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQ +IFNlbGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2Fu +Lm9yZzAeFw0wNzAzMTQxMjM0MDNaFw0xMjAzMTIxMjM0MDNaMGsxCzAJBgNVBAYT +AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQIFNl +bGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2FuLm9y +ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMgSOFeDdWxYKGPUSUhM +BFAELGmHKfg2R25aWlE8ju//I0ByaoIsm8BPapSiiiwTdho/JPP44/nvHcDQu828 +P3uY5XbSPZpiiBgFoo8BC2/Y/rxY/skjEzqoHEXjg/vO1bA0tqjVn5a0jpkai7pD +mUyBrmn1ArOjhR/HAupCHsIb7sAL+IEXByMcZQK6bvNL9PMTYI1T72+t/9cZAAEJ +DfEhyJZMxQKgmT1SNzLwyszy1M1HF95D59gBok4PaRWWsLdwzplfTKh61CeGCYqb +UP3qpMKrJ8Y7uv+e1vVzuYbJg5DR+bF1IGIc9QRyJlTkhZco+zTCQYxpvsNO18yr +4qcCAwEAAaOCARMwggEPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgECMB0GA1UdDgQW +BBQHqEiJbwUSQJDtrfhopkda0nXrLTCBnQYDVR0jBIGVMIGSgBQHqEiJbwUSQJDt +rfhopkda0nXrLaFvpG0wazELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0 +cm9uZ1N3YW4xIzAhBgNVBAsTGk9DU1AgU2VsZi1TaWduZWQgQXV0aG9yaXR5MRww +GgYDVQQDExNvY3NwLnN0cm9uZ3N3YW4ub3JnggkAs3bCrItMjN8wHgYDVR0RBBcw +FYITb2NzcC5zdHJvbmdzd2FuLm9yZzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN +BgkqhkiG9w0BAQUFAAOCAQEAi//I0DOlUXNHxzLuuxyr6k5gO55zMCmHUcVfjVFZ +9e+UpLLFZY+qbxOfzVLpKyDch6dKDIA/H+SzX1GZ+uW4FFQ1wYlHcK1Sio9hOgqI +zeWdY5uHF6iERVYgOU/xp0+0LS5l4ezCvOKVkYJEFWe2eyn9rd4PGLW4/lTQiK1V +14YzPyAhB7n8Sln5LBxAeY7U7Y8jEMLXZ+VF21mjH2sxZzWV/qWZdNWVUNaLZTYL +lTqyzqsk40v5BTrjSvAWHN+c1WzydMvatFDzghlPnvR8dufRN2bnlj10J8sizn+v +1iDtM6uYi8+Yn26yMGjCP+RYW+bwKQ927Gr43UkqqGsbCg== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..dda793f44 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ + -resp_no_certs -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/tests/ikev2/ocsp-local-cert/posttest.dat b/testing/tests/ikev2/ocsp-local-cert/posttest.dat new file mode 100644 index 000000000..0c05c16a1 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::rm /etc/ipsec.d/ocspcerts/* +carol::rm /etc/ipsec.d/ocspcerts/* diff --git a/testing/tests/ikev2/ocsp-local-cert/pretest.dat b/testing/tests/ikev2/ocsp-local-cert/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-local-cert/test.conf b/testing/tests/ikev2/ocsp-local-cert/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-local-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-multi-level/description.txt b/testing/tests/ikev2/ocsp-multi-level/description.txt new file mode 100644 index 000000000..cd0ecf162 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/description.txt @@ -0,0 +1,10 @@ +The VPN gateway <b>moon</b> controls the access to the hosts <b>alice</b> and +<b>venus</b> by means of two different Intermediate CAs. Access to +<b>alice</b> is granted to users presenting a certificate issued by the Research CA +whereas <b>venus</b> can only be reached with a certificate issued by the +Sales CA. The roadwarriors <b>carol</b> and <b>dave</b> have certificates from +the Research CA and Sales CA, respectively. Therefore <b>carol</b> can access +<b>alice</b> and <b>dave</b> can reach <b>venus</b>. +<p> +By setting <b>strictcrlpolicy=yes</b>, the certificate status from the strongSwan, Research and +Sales OCSP servers must be fetched first, before the connection setups can be successfully completed. diff --git a/testing/tests/ikev2/ocsp-multi-level/evaltest.dat b/testing/tests/ikev2/ocsp-multi-level/evaltest.dat new file mode 100644 index 000000000..911c209a5 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec listocspcerts::altNames.*ocsp.*strongswan.org::YES +carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +dave::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +dave::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::ESTABLISHED.*carol::YES +moon::ipsec status::ESTABLISHED.*dave::YES +carol::ipsec status::alice.*ESTABLISHED::YES +dave::ipsec status::venus.*ESTABLISHED::YES diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..89a4f2ce9 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf @@ -0,0 +1,31 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem new file mode 100644 index 000000000..2990d6a12 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIELDCCAxSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjERMA8GA1UECxMIUmVzZWFyY2gxFDAS +BgNVBAMTC1Jlc2VhcmNoIENBMB4XDTA1MDMyMzA3MDQyM1oXDTEwMDMyMjA3MDQy +M1owWjELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAP +BgNVBAsTCFJlc2VhcmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCC +ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM+oTiV7lCh1ID41edDUgUjR +dZwEMPBAM1xDqoxJxIJpug8UIuuUL0TvQnZ4Z5fa/9QNNCkQ7FDh8ZcR+TT8x0mO +dYYA73mMQic0n4O57F+s/lESKvIoN+vIDR3rGJBv9rYztS4ODE+DJl9XK9TtId5u +57jfXu/k3IYl5GeQ3f+ic2l2Ola70t70Op6cFDZIhOCjs2xWw2yqGdPWODaN/Enw +5fOLv/om+7HHB4KgPGv4p4ohWIUCo2XK597Ii+jB2MdOUlG83/1aX7+M+IeYVwjI +hzWjwRQfMz0AQha0HYN4cvrZ7stUluMxewsCROCBzcGQYTZxYU4FjR8nhH4ApYMC +AwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBSL +qNn96rsWg0kOJY/cyXD2JpnPIjBtBgNVHSMEZjBkgBTndfCg8q0gzc1gI8zHyA8p +891UIKFJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3 +YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIBDDAfBgNVHREEGDAWgRRj +YXJvbEBzdHJvbmdzd2FuLm9yZzA3BgNVHR8EMDAuMCygKqAohiZodHRwOi8vY3Js +LnN0cm9uZ3N3YW4ub3JnL3Jlc2VhcmNoLmNybDANBgkqhkiG9w0BAQUFAAOCAQEA +FNPepmta0ac9TWe7Gl31fKkuf6ZiQftMwx/uq6PoX9PBVGeooktJMo+EiROQhL3N +Zomtl2nLfxYruXPHa7YaMWyv4+3NkV9p7jseC1K/2lCXipY4Vp8u14hqlRLCTejp +7uC/0+628e+qXlCm8wafDb9/JXzQar7rADhoLp7gJKI2PKMAzLUP2xZVzY5zx57G ++OCR/ZXonVeAPy9/0g9N8uQzJEXOVZYMjsoRra9rdlvnY1DgDoAK7QvJMC4VzENm +wKmz2rPrBlKaEcivubg7dwPMGNmb3f7F7w0HHuRbQd5Y0nDfEWBKCp0bVx1GLc7/ +MWjwPJs52qVJ3Ph++EF6bw== +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem new file mode 100644 index 000000000..b91f9bf81 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAz6hOJXuUKHUgPjV50NSBSNF1nAQw8EAzXEOqjEnEgmm6DxQi +65QvRO9Cdnhnl9r/1A00KRDsUOHxlxH5NPzHSY51hgDveYxCJzSfg7nsX6z+URIq +8ig368gNHesYkG/2tjO1Lg4MT4MmX1cr1O0h3m7nuN9e7+TchiXkZ5Dd/6JzaXY6 +VrvS3vQ6npwUNkiE4KOzbFbDbKoZ09Y4No38SfDl84u/+ib7sccHgqA8a/iniiFY +hQKjZcrn3siL6MHYx05SUbzf/Vpfv4z4h5hXCMiHNaPBFB8zPQBCFrQdg3hy+tnu +y1SW4zF7CwJE4IHNwZBhNnFhTgWNHyeEfgClgwIDAQABAoIBAHXoftbRoIKIXtJz +0sM8plwOctUvnAoOqhsNYN1fVXEnTzoYmOtirKRbpkVWgJu9Ad4J0UAwF76lTGQX +FIV9sjqV5S09grxlY3qXaquE+i4pMA4gXro5E+eRI8GFJ+F7cX5rRcjsuRi8wyEH +gh/YtY5zMqfKTUGxlXWmNlaH70WilianuMPNXwaKgyBGcfZdheyUggM0rYEJrG1Z +PZqNo0JKfeI4htpENDp0k1xJ9lCjIqdNw0ZjBi+pL6hF5PYaPjlVC2yn5CzRaT1D +nUeKUK+SVES4sPrEQtaOlk86uZC4pIz5IlEoSvaw/Yo3Gk1sQKIQMMh1crhHd0El +U831KwECgYEA7fQY+aFk3fHabwgf9gjuPKgwetVQ8jNDWUiSqffHUC0AQfKZQQsF +mXJeSRZomPCWG3DRz1EcqXr9f82bN295I0CI6foXZgKUmjed7Bohc0HvUqNOi2qm +MdbdWBOaH4RBzi1fAENJZnprmq65jQ/tkfCwqIz4KaLt+8xiWmU2h6ECgYEA32gB +UbCzs1LoJC03uGHqZFRWK/YNKOKBUw58XCnzPTA+34UupI88lPj8LD269tDtruRy +G7wt4HjayPKtK430nKAl01IXq6ULBTByu3KrCOm/gTAycVMj4ZimTn7Qu9jyv4Lz +Ka3rBQxB+yQWfn27dc7U+EBsA7PT53NR6Zl8CqMCgYALJYod93+AHho7ZUgKAHUY +hlBvEJsQHXKkNhAYwjCmAtWmQTUIpPmILKFaDyCrOWnusyRA7+3FyqshV4JT4Hbu +PdGsFDkQYEKRztUpADhc69PILTo6sa5DW2tW+uQXYdyrSdjPbFd943Iy9sheYUah +tYKxApmFacp4JyTcUy1wwQKBgA44xLy6jvX/dR+4cS+frBgu9j1eMIBFyw3Kgkgr +s3xVserww4NeSvEA2KzIUTqdGkRj7o+tbw43I1ZffH6lTskZuM63DyKyIv11lBgy +uIicuMA0nUFxlXsrCIs+r3MF4I4oe+pPVALCQQEHzxbGUkSxogUbtMSXkgnN4Y0J +ZEgZAoGAfo0nv/IeKi0KkKiPTQSGVWGAQyCpGE0UQ2RYYToT84kjXs+LrVGFH2lu +LJvyYnSnM7eKqCFKh+kLQ3bezum56y5XTyAEipTmu7Lhp0CiVjSdnu+0QykmhKsx +Z17Ut2ryGKOXySnlMNual4eCLq98o0iOcYPq08V6x33dhK7Z3kU= +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..fac55d63b --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey.pem diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..45b6efcc8 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf @@ -0,0 +1,31 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem new file mode 100644 index 000000000..b76032480 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIEHDCCAwSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBLMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEOMAwGA1UECxMFU2FsZXMxETAPBgNV +BAMTCFNhbGVzIENBMB4XDTA1MDMyMzA3MTAxN1oXDTEwMDMyMjA3MTAxN1owVjEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsT +BVNhbGVzMRwwGgYDVQQDFBNkYXZlQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyqAR0itGIuSt/RR8IHjFTLH/lywprmHUw0GS +zZwo/q4AE4v6OeWRG3JUUg44K40yBwr7zvcsLztRTfbNqlt7o+Hjpo3kz0AMwDo+ +1V42Qkh61VJW1P0NQvkgjiQn+ElSMg1u3uiYCIMAhYMYo2ZMKxHXxRqjU79AVuJN +P3p8wUpfwReImAy3/n685YbSzWcbPqCfjRH/YrnYS8Ga7m/QzdNfrtxhAWAGow1+ ++eTSMvLXSkQeujU6OCJNOPUNB3nnJ1IoZrQm8wNP8Y5B5HzvOSyFEvNuHFc63gSP +aSRhuz0gubuMpr1d9Rgjny8JgsfCEbOktlKwnbFeSB8AAgVMjwIDAQABo4H/MIH8 +MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBSCy57rUdNRbytUkRGY +GjmjvXfIszBtBgNVHSMEZjBkgBRfmxNG+SByyADViLWnTC6X6guTKKFJpEcwRTEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT +EnN0cm9uZ1N3YW4gUm9vdCBDQYIBDTAeBgNVHREEFzAVgRNkYXZlQHN0cm9uZ3N3 +YW4ub3JnMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwuc3Ryb25nc3dhbi5v +cmcvc2FsZXMuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQB+BknSxFKaDhbRVobOAU2P +p9cirkVCitoZrvK2QIS/7WRoqy85RQ+zorJb3jyTxQl4Pu9Qrap9Zn0H8GQXGlQw +ZJqdDqRaIa4nCc57qP5DsuQKIQRxc1QMCiWyIRAESn+r8IbxLbjvEd7ZXNsieip6 +Q15uUZldjTveHVi89i9oFWS1nWo4SV+tJaEqPBvsTZZKBPAEu6+7lRzbJ4ukzRsA +DjuvmaPNUTyf21fD66I4sgrwgxoPhZ7r6qsqISJ5f0EzTXgYNi1yk/TXoAaot3c/ +Gu5+iyO/espV6kPADSOzPSFwsGHYG4kXi1VY0Z7x6UnjQSdEelOBplJ5XYDzEn4+ +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem new file mode 100644 index 000000000..022436de4 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAyqAR0itGIuSt/RR8IHjFTLH/lywprmHUw0GSzZwo/q4AE4v6 +OeWRG3JUUg44K40yBwr7zvcsLztRTfbNqlt7o+Hjpo3kz0AMwDo+1V42Qkh61VJW +1P0NQvkgjiQn+ElSMg1u3uiYCIMAhYMYo2ZMKxHXxRqjU79AVuJNP3p8wUpfwReI +mAy3/n685YbSzWcbPqCfjRH/YrnYS8Ga7m/QzdNfrtxhAWAGow1++eTSMvLXSkQe +ujU6OCJNOPUNB3nnJ1IoZrQm8wNP8Y5B5HzvOSyFEvNuHFc63gSPaSRhuz0gubuM +pr1d9Rgjny8JgsfCEbOktlKwnbFeSB8AAgVMjwIDAQABAoIBAHKaRFoVpa6Ynpu0 +mVwYUqdFSaVsEgsSRC9HiEuIllsteNeVZSqX4BGhAXYDmttvGauIF9IAVNpF939c +JwjCg1S2r3aFbLOXq16R0vYFOjUVH3xF/NysX3LQywv6AS1Z8wZiOKIU9eBij8nz +0tygQFZf2iUeIuB8HFzH1B8iHSuI7qn6hh1Y9Zgx4kWYL9I+WYefbR906xveHVGq +8VrgHtBAn1WeWg7FoN1VURW0s1bxkiWtpF9x9OMmwK4qR8HSCilss59V1eJrAAR0 +3FGdWwbbGg9hW0adnyDCtoaYW3r0WcXwqklyas4C+dClOpUInn8kZisoghQYT92u +U2QeDzECgYEA5Rv7+rP9HX1pNd9NQwOyIHztv4jfx60gybioogtCeRZUwPQ3GtXJ +Q0ouBxCVLdyCImIKcvd2q2b9HZE8tvOHBA/YxofH4miEN5GWA4aL+LcGrxIbxPWs +MEkxgQwsyK7lWH47fG7eW86LMx0VikFXS1EeeZZS3f3Avaww1uRtXecCgYEA4mhS +sAClZamGVWQ7VXCHuS4xHn/gPA4TCyoR5l9g9pwregGKxsROQVIFQCDMd9eTtS6B +oqoUTHdg0TlujHVUojdwHtgDaqDMTk+RXD9qy2Wob9HQVBlIwgijoLb+OjwdoAj7 +1OQx8FmMjAlMmlyJ50e1FnbNJFEJ1EMgV5QxtxkCgYEArdUeyehYy1BFTJ/CIm+i +bm37gdDbYchlUUivgkuiwvcDlWd2jADbdRfKdofJeIOPpYDXxsUmIATDVfTFqVZ7 +AcT4SCHrskh00SjANqqWdz5/bsQBl96DKBvQ2MYhEJ9K2mrkvZPtWKENEtolZsIO +9tF0mvJIq7CF1iPY5qNoq88CgYEAoZhELErJwl3U+22my7ydopZNiK9MpJCHFxjX +3c2Fr36XqWUgX+4MzKJ2DOdcCM1dJ5wh+q/Z/RnXiH2tYaL83SskY19aUOij6eDw +px68YqAUMHtYbi39uD/iSftSSM5PdsHyvGiDHEFOB0U735Dc/K45mecBVEJi+ZVP +qDKlqUECgYA1DcGOWM3P3XdB7zKy47LcankMtFZozEOLTUdGJRlmWrLdcRlZPKjt +/ALripehesp1++VtmttWQJX7uI3gveD07/tSKeMHmIoKappjRTrcaA7Pa5+z/xS/ +UhRmZUFOJwNLzy3jdv5f2c/5SIz6o4Ae3I+Zb+IapHL+lBv146/I5g== +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..98a0e9b81 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf @@ -0,0 +1,44 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +ca research + cacert=researchCert.pem + ocspuri=http://ocsp.strongswan.org:8881 + auto=add + +ca sales + cacert=salesCert.pem + ocspuri=http://ocsp.strongswan.org:8882 + auto=add + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn alice + leftsubnet=PH_IP_ALICE/32 + right=%any + rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA" + auto=add + +conn venus + leftsubnet=PH_IP_VENUS/32 + right=%any + rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA" + auto=add diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem new file mode 100644 index 000000000..154cff654 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIIDwTCCAqmgAwIBAgIBDzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA1MDYyMTE5NTgwNloXDTEwMDYyMDE5NTgwNlowUTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMRQwEgYDVQQDEwtSZXNlYXJjaCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBALY5sjqm4AdbWKc/T7JahWpy9xtdPbHngBN6lbnpYaHfrxnGsvmD +FCFZHCd7egRqQ/AuJHHcEv3DUdfJWWAypVnUvdlcp58hBjpxfTPXP9IDBxzQaQyU +zsExIGWOVUY2e7xJ5BKBnXVkok3htY4Hr1GdqNh+3LEmbegJBngTRSRx4PKJ54FO +/b78LUzB+rMxrzxw/lnI8jEmAtKlugQ7c9auMeFCz+NmlSfnSoWhHN5qm+0iNKy0 +C+25IuE8Nq+i3jtBiI8BwBqHY3u2IuflUh9Nc9d/R6vGsRPMHs30X1Ha/m0Ug494 ++wwqwfEBZRjzxMmMF/1SG4I1E3TDOJ3srjkCAwEAAaOBrzCBrDAPBgNVHRMBAf8E +BTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQU53XwoPKtIM3NYCPMx8gPKfPd +VCAwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNV +BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJv +bmdTd2FuIFJvb3QgQ0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAHArS2trQnBoMVcg +Br3HV78wYsa1MNAQCBAPhKMMd6EziO4FTwgNgecbKXpObX6ErFDgjtVTcLOMTvNX +fvZoNuPpdcitlgcWjfxZafNbj6j9ClE/rMbGDO64NLhdXuPVkbmic6yXRwGZpTuq +3CKgTguLvhzIEM47yfonXKaaJcKVPI7nYRZdlJmD4VflYrSUpzB361dCaPpl0AYa +0zz1+jfBBvlyic/tf+cCngV3f+GlJ4ntZ3gvRjyysHRmYpWBD7xcA8mJzgUiMyi1 +IKeNzydp+tnLfxwetfA/8ptc346me7RktAaASqO9vpS/N78eXyJRthZTKEf/OqVW +Tfcyi+M= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem new file mode 100644 index 000000000..e50477872 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDuzCCAqOgAwIBAgIBDTANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA1MDMyMzA2MjkxNloXDTE0MDMyMTA2MjkxNlowSzELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz +MREwDwYDVQQDEwhTYWxlcyBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +ggEBAMJOTSaZjDe5UR+hJbodcE40WBxWm+r0FiD+FLc2c0hH/QcWm1Xfqnc9qaPP +GoxO2BfwXgFEHfOdQzHGuthhsvdMPkmWP1Z3uDrwscqrmLyq4JI87exSen1ggmCV +Eib55T4fNxrTIGJaoe6Jn9v9ZwG2B+Ur3nFA/wdckSdqJxc6XL9DKcRk3TxZtv9S +uDftE9G787O6PJSyfyUYhldz1EZe5PTsUoAbBJ0DDXJx3562kDtfQdwezat0LAyO +sVabYq/0G/fBZwLLer4qGF2+3CsvP7jNXnhRYeSv2+4i2mAjgbBRI1A3iqoU3Nq1 +vPAqzrekOI/RV9Hre9L1r8X1dIECAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/ +MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUX5sTRvkgcsgA1Yi1p0wul+oLkygwbQYD +VR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNI +MRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2Fu +IFJvb3QgQ0GCAQAwDQYJKoZIhvcNAQEFBQADggEBAJ7j3X20Q8ICJ2e+iUCpVUIV +8RudUeHt9qjSXalohuxxhegL5vu7I9Gx0H56RE4glOjLMCb1xqVZ55Odxx14pHaZ +9iMnQFpgzi96exYAmBKYCHl4IFix2hrTqTWSJhEO+o+PXnQTgcfG43GQepk0qAQr +iZZy8OWiUhHSJQLJtTMm4rnYjgPn+sLwx7hCPDZpHTZocETDars7wTiVkodCbeEU +uKahAbq4b6MvvC3+7quvwoEpAEStT7+Yml+QuK/jKmhjX0hcQcw4ZWi+m32RjUAv +xDJGEvBqV2hyrzRqwh4lVNJEBba5X+QB3N6a0So6BENaJrUM3v8EDaS2KLUWyu0= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-multi-level/posttest.dat b/testing/tests/ikev2/ocsp-multi-level/posttest.dat new file mode 100644 index 000000000..1646d5ed2 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/posttest.dat @@ -0,0 +1,5 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::rm /etc/ipsec.d/cacerts/* + diff --git a/testing/tests/ikev2/ocsp-multi-level/pretest.dat b/testing/tests/ikev2/ocsp-multi-level/pretest.dat new file mode 100644 index 000000000..f15265e32 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/pretest.dat @@ -0,0 +1,7 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 2 +carol::ipsec up alice +dave::ipsec up venus diff --git a/testing/tests/ikev2/ocsp-multi-level/test.conf b/testing/tests/ikev2/ocsp-multi-level/test.conf new file mode 100644 index 000000000..08e5cc145 --- /dev/null +++ b/testing/tests/ikev2/ocsp-multi-level/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/ocsp-revoked/description.txt b/testing/tests/ikev2/ocsp-revoked/description.txt new file mode 100644 index 000000000..73d072549 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/description.txt @@ -0,0 +1,9 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which possesses an OCSP signer certificate +issued by the strongSwan CA. This certificate contains an <b>OCSPSigning</b> +extended key usage flag. A strongswan <b>ca</b> section in ipsec.conf defines an +<b>OCSP URI</b> pointing to <b>winnetou</b>. +<p> +<b>carol</b> tries to initiate an IPsec connection to <b>moon</b> but fails +because <b>carol</b>'s certificate has been <b>revoked</b>. diff --git a/testing/tests/ikev2/ocsp-revoked/evaltest.dat b/testing/tests/ikev2/ocsp-revoked/evaltest.dat new file mode 100644 index 000000000..eacb70c40 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/evaltest.dat @@ -0,0 +1,7 @@ +moon::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES +moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO + diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..be15f6ec5 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert-revoked.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem new file mode 100644 index 000000000..5b742fc9e --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEIjCCAwqgAwIBAgIBBzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA0MDkxMDExMjU0OFoXDTA5MDkwOTExMjU0OFowWjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh +cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAM5413q1B2EF3spcYD1u0ce9AtIHdxmU3+1E0hqV +mLqpIQtyp4SLbrRunxpoVUuEpHWXgLb3C/ljjlKCMWWmhw4wja1rBTjMNJLPj6Bo +5Qn4Oeuqm7/kLHPGbveQGtcSsJCk6iLqFTbq0wsji5Ogq7kmjWgQv0nM2jpofHLv +VOAtWVSj+x2b3OHdl/WpgTgTw1HHjYo7/NOkARdTcZ2/wxxM3z1Abp9iylc45GLN +IL/OzHkT8b5pdokdMvVijz8IslkkewJYXrVQaCNMZg/ydlXOOAEKz0YqnvXQaYs5 +K+s8XvQ2RFCr5oO0fRT2VbiI9TgHnbcnfUi25iHl6txsXg0CAwEAAaOCAQYwggEC +MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBTbA2TH3ca8tgCGkYy9 +OV/MqUTHAzBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL +MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT +EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz +d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u +b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQC9acuCUPEBOrWB +56vS8N9bksQwv/XcYIFYqV73kFBAzOPLX2a9igFGvBPdCxFu/t8JCswzE6to4LFM +2+6Z2QJf442CLPcJKxITahrjJXSxGbzMlmaDvZ5wFCJAlyin+yuInpTwl8rMZe/Q +O5JeJjzGDgWJtnGdkLUk/l2r6sZ/Cmk5rZpuO0hcUHVztMLQYPzqTpuMvC5p4JzL +LWGWhKRhJs53NmxXXodck/ZgaqiTWuQFYlbamJRvzVBfX7c1SWHRJvxSSOPKGIg3 +wphkO2naj/SQD+BNuWTRmZ9YCiLOQ64ybLpJzRZISETdqtLBPKsIqosUZwkxlR1N +9IcgYi5x +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem new file mode 100644 index 000000000..8aefcc5a6 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAznjXerUHYQXeylxgPW7Rx70C0gd3GZTf7UTSGpWYuqkhC3Kn +hItutG6fGmhVS4SkdZeAtvcL+WOOUoIxZaaHDjCNrWsFOMw0ks+PoGjlCfg566qb +v+Qsc8Zu95Aa1xKwkKTqIuoVNurTCyOLk6CruSaNaBC/SczaOmh8cu9U4C1ZVKP7 +HZvc4d2X9amBOBPDUceNijv806QBF1Nxnb/DHEzfPUBun2LKVzjkYs0gv87MeRPx +vml2iR0y9WKPPwiyWSR7AlhetVBoI0xmD/J2Vc44AQrPRiqe9dBpizkr6zxe9DZE +UKvmg7R9FPZVuIj1OAedtyd9SLbmIeXq3GxeDQIDAQABAoIBAAUdyXko8z3cP2EU +WO4syNYCQQejV7gykDn48pvmCRrXBhKajLwkGGIwO5ET9MkiSFEBqBbgmFNdvDEf +OMokDkSzv08Ez+RQax0YN57p+oL8u7KzT5i5tsBHsog/8epSdD2hWIv08QGjYAdu +og7OdHLqGabyg0r44I+B91OBysCjU51rDdkhz59AmURdEIJV5xhuGojFM68jaNm2 +MUxDfDuCsRIydjAP0VTUTAUxD4/S5I+jt/GK9aRsEeRH9Q3011iTGMR9viAUBhq/ +khkWNltg9lkOqO7LpnNku4sSv3v4CWge7/T+4RR2vZgv1oSs4ox2UKYoqIqiYIfx +uUcnqQECgYEA+LPiRMoXvlssQWlaFc2k4xga0efs+mWeLglDdc3R3fBEibP/AU07 +a576AgvUJtkI50/WNGKT73O+VtxcXn/N646m/8OtqNXuVKKjsxxNOZEKdO8aOdbt +7lM5WepNiQeaKAFudUxpUiZQx8LCKSsNDiJZKWBu6xAG2O5X32VMZvUCgYEA1Ie+ +rNa490PSC1ym7WbmdAjvGmSOn2GOBfO7BECsPZstccU7D5pZl/89fTfn1TDKP49Y +ScVOuFz7f/u6UJpb/WzI71RXEQOdojLWmF2HDx5osRi3hXEJa20fbPq6DQXCJ8pf +IF37AEqAY4UNSNic0Cw+rGHdWPQhDNXhFWpdu7kCgYEAmv4oNmyoDXbuhrlsbggi +CXE9TbG3a3mm8dPOGf2yHBmf7R2i/6GtNW33Kw1KIwfBV77WpQEGZwWACsv8ONx3 +baUSiHTfpkfk5xQQ5w/tRMISfTuB4agD0jJFnLa7qXl2ZhY2S53aSVsdntDOhi+R +TEy1umah2Za8Xbd0RgHwcn0CgYEAl9Hgg9dfikMIaNVm6W/4cCtxoojy2Sf3LIlP +r1oDsH6JmBwsdJjuJ4ZNhoXJNqID2COuDgTEly7U+jf4gFvEGuT7JPw6tgy/Ln7i +jTVCpaozX08oykpVUEhDirYQ8fyLFaGbEqQQCcUusej59G/IlW0F2F6QoFrEwUaH +46R4EQECgYBEZ7edMkj3dmJH1wxQjp5GJNbrJkS8IKvzza0mDTJdz33CgEX9Oyva +o2iEkDVpvj2SEy28ewt22IRptWKH/3bQfxSCcRV6JFNt3+LongMshRYqq1leqrKa +9fnQVtfTIbIVXwjTZap6BL8R66OeFtexsSFRfDF/8P4n2oF4zmn4qA== +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..22f06e662 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey-revoked.pem diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..21b48ef0c --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-revoked/posttest.dat b/testing/tests/ikev2/ocsp-revoked/posttest.dat new file mode 100644 index 000000000..d742e8410 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/certs/* diff --git a/testing/tests/ikev2/ocsp-revoked/pretest.dat b/testing/tests/ikev2/ocsp-revoked/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-revoked/test.conf b/testing/tests/ikev2/ocsp-revoked/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-revoked/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-root-cert/description.txt b/testing/tests/ikev2/ocsp-root-cert/description.txt new file mode 100644 index 000000000..9574aa5b1 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/description.txt @@ -0,0 +1,8 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which uses the <b>strongSwan CA</b>'s +private key to sign OCSP responses. A <b>strongswan ca</b> section in ipsec.conf +defines an <b>OCSP URI</b> pointing to <b>winnetou</b>. +<p> +<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since +the status of both certificates is <b>good</b>. diff --git a/testing/tests/ikev2/ocsp-root-cert/evaltest.dat b/testing/tests/ikev2/ocsp-root-cert/evaltest.dat new file mode 100644 index 000000000..a3a1df194 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::received valid http response::YES +carol::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..0209111ba --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..21b48ef0c --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..e998b6ad0 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey strongswanKey.pem -rsigner strongswanCert.pem \ + -resp_no_certs -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/tests/ikev2/ocsp-root-cert/posttest.dat b/testing/tests/ikev2/ocsp-root-cert/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/ocsp-root-cert/pretest.dat b/testing/tests/ikev2/ocsp-root-cert/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-root-cert/test.conf b/testing/tests/ikev2/ocsp-root-cert/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-root-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-signer-cert/description.txt b/testing/tests/ikev2/ocsp-signer-cert/description.txt new file mode 100644 index 000000000..492a9882b --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/description.txt @@ -0,0 +1,10 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which possesses an OCSP signer certificate +issued by the strongSwan CA. This certificate contains an <b>OCSPSigning</b> +extended key usage flag. <b>carol</b>'s certificate includes an <b>OCSP URI</b> +in an authority information access extension pointing to <b>winnetou</b>. +Therefore no special ca section information is needed in ipsec.conf. +<p> +<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since +the status of both certificates is <b>good</b>. diff --git a/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat b/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat new file mode 100644 index 000000000..4a8ffd412 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat @@ -0,0 +1,13 @@ +moon::ipsec listcainfos::ocspuris.*http://ocsp.strongswan.org::YES +carol::ipsec listcainfos::ocspuris.*http://ocsp.strongswan.org::YES +moon::cat /var/log/daemon.log::received valid http response::YES +carol::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES +carol::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES +moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES + diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..f49fa9204 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert-ocsp.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem new file mode 100644 index 000000000..aeca7e1db --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEWzCCA0OgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA3MDIyNTA3NTg1N1oXDTEyMDIyNDA3NTg1N1owVjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDTALBgNVBAsTBE9DU1Ax +HTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5 +vVZX3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8 +G7M2uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J +5rRlvXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+Kdt +kkCRQYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0If +pPr/QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABo4IBQzCCAT8wCQYD +VR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDRTWKccFIi95BslK3U92mIQ +2rWGMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYD +VQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ry +b25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3YW4u +b3JnMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL29jc3Auc3Ry +b25nc3dhbi5vcmc6ODg4MDA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0 +cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAc +1bBYLYcc+js3UsHVk7W17Nr/qoNFzQZJ5Er3RjhNAgzAX1wOTrNgKXztwZde1Alj +o05ZLXUFkB4coQwl7xo7I3EMJPUmSdHoyYyG7c7AgfcL/wwnzz4rWQl74WIZjySc +ON0Ny9vrzbVboktYof/9Yp/+HgeKopfsaIiuNCAwmAWxiYqvDmlxxn16oOXeJFV8 +pFzZMirQ5l7QRD9iuabOdcnBp8ASH+5AbD4KjFQjo5RBVg92LwOkJo3Pf1twI57s +pObrcM4JbHVohDornYQYfr9ymkMxJbqqkEgD8oIip0NFSbziam4ZkwgUlRIMUMU1 +/xsH+BXYZtKJbYjlnyc8 +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem new file mode 100644 index 000000000..603f071d0 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5vVZX +3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8G7M2 +uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J5rRl +vXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+KdtkkCR +QYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0IfpPr/ +QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABAoIBAFTGd5+gmpv96TGm +LW8Gp/poRX+BcDw2bUgLf6aMwd9jVV+4RVw5bTbXOSy2ls19x71dRSlyijDoUgZT +nSXPhwu1PIBM1JoRcZeJRjXiOUWFkCoTxBuykeyPiFcvNxWN5y2h6M822iHie9FI +UYomTYzvIT0LnIu00yJJpGAhwhW9BcL+Mo9lfWmhv4I1hXC9RTqZZ4rjPojDeFvL +maZNCk3kX2pxIJ1kG41/PJjg3JD2uEVrvV7SRuOknM+7f3SDtY60/Wnqx8dfBtjJ +hEdIxG+XXEOafdqwEPmmM++6V76uD8Rs1eFrrI4rfK6/H2PjppJCYtQeryug0q+0 +UN2u00kCgYEA5qJOcDSzb7CQAi58yYicYc3ShEbaL75V7G5rlnFg4/G1axU19hXQ +wEPDf87So9hnVroCMewjyDiNgI/OyYK2cv1TABUGAEFAHPzj99jtBT0/R0kX+Jd2 +kPwCU4/T2cHrezwNobrJf010JAvwc52b+U3lWtHxBWeq5KALUVT+BhcCgYEA3wdx +OwVxTf+OBOBcxPPGUcfsKbf9uVTcXFLNRSBbjzRIOR/bIVgUQaBXem2fJJTm1mWN +Yl/U14G5orv9693GKgE5IDAMMrDF7mOsX808o3pcXM04MTAyGmQEDDEO8tgmWzWo +nrYzxe9uBR1tej9IsiEPlD9ZLtWix9C2uV7EcSUCgYBKOrDuMjgSWYxv91BYeOyE +Gf+IbVlqBmOXPg7Ik+MwWioetevxMSJHz0eLyiBHda4E3sc4FB2MIo+AckiG2Ngp ++FiPbTTKPjYJXmds7NeUWRsVsXPSocUactG43VC9BEnrFu/4Pqr9mwsnUuRoAbEi +syx/Z5SgPbZl8RDTc3xyrwKBgBFpB1HQLvQjyvZefV9ymDyyGqF3F3tsQHeEjzmi +OQOI1UqATh7gPVSSK8IG5LF6XjrGWq8fRAI+wjsN6diLy3hj+A2nMoySeCEP7tjb +sKwiVSt5abWNSZv9ysMY4U3bycK9AZjCKHB/LFuB3JX6crZVFl5AQ7oAO2DVzi3S +VAtxAoGALzFZH7o1ZvVJGa23dW7p96G5vgop6Ulp2DLz4Qg6NYIeatZhwX3lls2J +P7ZxmHiECC7zR67xwv5QKjKfg6t/sOKU/bsyp6c3hOWQjcFbWU3AwlO1TeVX9TMG +SmPYcKM+KQ969qKD3aP9MQ+t4FERvlQcBAr0Qun3quN2i3eDkDo= +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..a89065443 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey-ocsp.pem diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a8a9f1e30 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-signer-cert/posttest.dat b/testing/tests/ikev2/ocsp-signer-cert/posttest.dat new file mode 100644 index 000000000..220bc2c1d --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/ocsp-signer-cert/pretest.dat b/testing/tests/ikev2/ocsp-signer-cert/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-signer-cert/test.conf b/testing/tests/ikev2/ocsp-signer-cert/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-signer-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-timeouts-good/description.txt b/testing/tests/ikev2/ocsp-timeouts-good/description.txt new file mode 100644 index 000000000..9ee5db95b --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/description.txt @@ -0,0 +1,10 @@ +This scenario is based on <a href="../ocsp-signer-cert">ikev2/ocsp-signer-cert</a> +and tests the timeouts of the <b>libcurl</b> library used for http-based OCSP fetching +by adding an ocspuri2 in <b>moon</b>'s strongswan ca section that cannot be resolved by +<b>DNS</b> and an ocspuri2 in <b>carol</b>'s strongswan ca section on which no +OCSP server is listening. Thanks to timeouts the connection can nevertheless +be established successfully by contacting a valid OCSP URI contained in +<b>carol</b>'s certificate. +<p> +As an additional test the OCSP response is delayed by 5 seconds in order to check +the correct handling of retransmitted IKE_AUTH messages. diff --git a/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat b/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat new file mode 100644 index 000000000..4c4059810 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat @@ -0,0 +1,9 @@ +moon::cat /var/log/daemon.log::http post request using libcurl failed::YES +carol::cat /var/log/daemon.log::http post request using libcurl failed::YES +moon::cat /var/log/daemon.log::received valid http response::YES +carol::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::certificate is good::YES +carol::cat /var/log/daemon.log::certificate is good::YES +moon::ipsec status::rw.*ESTABLISHED::YES +carol::ipsec status::home.*ESTABLISHED::YES + diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..b53de16e4 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri2=http://bob.strongswan.org:8800 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert-ocsp.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem new file mode 100644 index 000000000..aeca7e1db --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEWzCCA0OgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA3MDIyNTA3NTg1N1oXDTEyMDIyNDA3NTg1N1owVjELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDTALBgNVBAsTBE9DU1Ax +HTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5 +vVZX3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8 +G7M2uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J +5rRlvXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+Kdt +kkCRQYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0If +pPr/QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABo4IBQzCCAT8wCQYD +VR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDRTWKccFIi95BslK3U92mIQ +2rWGMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYD +VQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ry +b25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3YW4u +b3JnMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL29jc3Auc3Ry +b25nc3dhbi5vcmc6ODg4MDA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0 +cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAc +1bBYLYcc+js3UsHVk7W17Nr/qoNFzQZJ5Er3RjhNAgzAX1wOTrNgKXztwZde1Alj +o05ZLXUFkB4coQwl7xo7I3EMJPUmSdHoyYyG7c7AgfcL/wwnzz4rWQl74WIZjySc +ON0Ny9vrzbVboktYof/9Yp/+HgeKopfsaIiuNCAwmAWxiYqvDmlxxn16oOXeJFV8 +pFzZMirQ5l7QRD9iuabOdcnBp8ASH+5AbD4KjFQjo5RBVg92LwOkJo3Pf1twI57s +pObrcM4JbHVohDornYQYfr9ymkMxJbqqkEgD8oIip0NFSbziam4ZkwgUlRIMUMU1 +/xsH+BXYZtKJbYjlnyc8 +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem new file mode 100644 index 000000000..603f071d0 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5vVZX +3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8G7M2 +uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J5rRl +vXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+KdtkkCR +QYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0IfpPr/ +QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABAoIBAFTGd5+gmpv96TGm +LW8Gp/poRX+BcDw2bUgLf6aMwd9jVV+4RVw5bTbXOSy2ls19x71dRSlyijDoUgZT +nSXPhwu1PIBM1JoRcZeJRjXiOUWFkCoTxBuykeyPiFcvNxWN5y2h6M822iHie9FI +UYomTYzvIT0LnIu00yJJpGAhwhW9BcL+Mo9lfWmhv4I1hXC9RTqZZ4rjPojDeFvL +maZNCk3kX2pxIJ1kG41/PJjg3JD2uEVrvV7SRuOknM+7f3SDtY60/Wnqx8dfBtjJ +hEdIxG+XXEOafdqwEPmmM++6V76uD8Rs1eFrrI4rfK6/H2PjppJCYtQeryug0q+0 +UN2u00kCgYEA5qJOcDSzb7CQAi58yYicYc3ShEbaL75V7G5rlnFg4/G1axU19hXQ +wEPDf87So9hnVroCMewjyDiNgI/OyYK2cv1TABUGAEFAHPzj99jtBT0/R0kX+Jd2 +kPwCU4/T2cHrezwNobrJf010JAvwc52b+U3lWtHxBWeq5KALUVT+BhcCgYEA3wdx +OwVxTf+OBOBcxPPGUcfsKbf9uVTcXFLNRSBbjzRIOR/bIVgUQaBXem2fJJTm1mWN +Yl/U14G5orv9693GKgE5IDAMMrDF7mOsX808o3pcXM04MTAyGmQEDDEO8tgmWzWo +nrYzxe9uBR1tej9IsiEPlD9ZLtWix9C2uV7EcSUCgYBKOrDuMjgSWYxv91BYeOyE +Gf+IbVlqBmOXPg7Ik+MwWioetevxMSJHz0eLyiBHda4E3sc4FB2MIo+AckiG2Ngp ++FiPbTTKPjYJXmds7NeUWRsVsXPSocUactG43VC9BEnrFu/4Pqr9mwsnUuRoAbEi +syx/Z5SgPbZl8RDTc3xyrwKBgBFpB1HQLvQjyvZefV9ymDyyGqF3F3tsQHeEjzmi +OQOI1UqATh7gPVSSK8IG5LF6XjrGWq8fRAI+wjsN6diLy3hj+A2nMoySeCEP7tjb +sKwiVSt5abWNSZv9ysMY4U3bycK9AZjCKHB/LFuB3JX6crZVFl5AQ7oAO2DVzi3S +VAtxAoGALzFZH7o1ZvVJGa23dW7p96G5vgop6Ulp2DLz4Qg6NYIeatZhwX3lls2J +P7ZxmHiECC7zR67xwv5QKjKfg6t/sOKU/bsyp6c3hOWQjcFbWU3AwlO1TeVX9TMG +SmPYcKM+KQ969qKD3aP9MQ+t4FERvlQcBAr0Qun3quN2i3eDkDo= +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..a89065443 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey-ocsp.pem diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..f3b19d292 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..92aa920aa --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,14 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +# simulate a delayed response +sleep 5 + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey.pem -rsigner ocspCert.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat b/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat new file mode 100644 index 000000000..220bc2c1d --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +carol::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/private/* diff --git a/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat b/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-timeouts-good/test.conf b/testing/tests/ikev2/ocsp-timeouts-good/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-good/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt new file mode 100644 index 000000000..d17534b1b --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt @@ -0,0 +1,7 @@ +This scenario is based on <a href="../ocsp-signer-cert">ikev2/ocsp-signer-cert</a> +and tests the timeouts of the <b>libcurl</b> library used for http-based OCSP fetching +by adding an ocspuri1 in <b>moon</b>'s strongswan ca section on which no OCSP +server is listening and an ocspuri2 that cannot be resolved by <b>DNS</b>. +Since the certificate status is <b>unknown</b> the connection setup is aborted by +<b>moon</b> with an <b>AUTHORIZATION_FAILED</b> notification sent to <b>carol</b>. + diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat new file mode 100644 index 000000000..c9c09a72f --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat @@ -0,0 +1,6 @@ +moon::cat /var/log/daemon.log::http post request using libcurl failed::YES +moon::cat /var/log/daemon.log::certificate status unknown::YES +carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO + diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..cdc1560ae --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri1=http://bob.strongswan.org:8800 + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + +conn home + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..e759d1d79 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri1=http://bob.strongswan.org:8800 + ocspuri2=http://ocsp2.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat new file mode 100644 index 000000000..cf72480d4 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::iptables -F OUTPUT +carol::iptables -F OUTPUT diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat new file mode 100644 index 000000000..7d9d600ff --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat @@ -0,0 +1,6 @@ +moon::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP +carol::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/description.txt b/testing/tests/ikev2/ocsp-untrusted-cert/description.txt new file mode 100644 index 000000000..f581dd319 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/description.txt @@ -0,0 +1,9 @@ +By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on +both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status +is checked via the OCSP server <b>winnetou</b> which is sending its <b>self-signed</b> +OCSP signer certificate. A strongswan <b>ca</b> section in ipsec.conf +defines an <b>OCSP URI</b> pointing to <b>winnetou</b>. +<p> +<b>carol</b> cannot successfully initiate an IPsec connection to <b>moon</b> since +the self-signed certificate contained in the OCSP response will not be +accepted by <b>moon</b>. diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat new file mode 100644 index 000000000..a0b6d681f --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat @@ -0,0 +1,5 @@ +moon::cat /var/log/daemon.log::received valid http response::YES +moon::cat /var/log/daemon.log::received ocsp signer certificate is not trusted - rejected::YES +moon::cat /var/log/daemon.log::certificate status unknown::YES +moon::ipsec status::rw.*ESTABLISHED::NO +carol::ipsec status::home.*ESTABLISHED::NO diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..3c685a839 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,27 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=yes + plutostart=no + +ca strongswan + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..e2fabe0f5 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=yes + plutostart=no + +ca strongswan-ca + cacert=strongswanCert.pem + ocspuri=http://ocsp.strongswan.org:8880 + auto=add + +conn %default + keyexchange=ikev2 + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi new file mode 100755 index 000000000..20c4b2a22 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi @@ -0,0 +1,11 @@ +#!/bin/bash + +cd /etc/openssl + +echo "Content-type: application/ocsp-response" +echo "" + +/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \ + -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \ + -nmin 5 \ + -reqin /dev/stdin -respout /dev/stdout diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat new file mode 100644 index 000000000..d92333d86 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/protoport-dual/description.txt b/testing/tests/ikev2/protoport-dual/description.txt new file mode 100644 index 000000000..7bed8b959 --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/description.txt @@ -0,0 +1,6 @@ +Using the <b>left|rightprotoport</b> selectors, two IPsec tunnels +between the roadwarrior <b>carol</b> and the gateway <b>moon</b> are +defined. The first IPsec SA is restricted to ICMP packets and the second +covers TCP-based SSH connections. The established tunnels are tested +by <b>carol</b> by first pinging <b>alice</b> behind <b>moon</b> and +then setting up an SSH session to the same client. diff --git a/testing/tests/ikev2/protoport-dual/evaltest.dat b/testing/tests/ikev2/protoport-dual/evaltest.dat new file mode 100644 index 000000000..bd24b911c --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/evaltest.dat @@ -0,0 +1,9 @@ +carol::ipsec statusall::home-icmp.*INSTALLED::YES +carol::ipsec statusall::home-ssh.*INSTALLED::YES +moon::ipsec statusall::rw-icmp.*INSTALLED::YES +moon::ipsec statusall::rw-ssh.*INSTALLED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES +carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/protoport-dual/hosts/carol/etc/ipsec.conf index 598997b45..eda0ddf38 100755 --- a/testing/tests/mode-config/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/protoport-dual/hosts/carol/etc/ipsec.conf @@ -1,21 +1,17 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup - plutodebug=control - crlcheckinterval=180 + crlcheckinterval=180 strictcrlpolicy=no + plutostart=no conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 - -conn home + keyexchange=ikev2 left=PH_IP_CAROL - leftsourceip=%modeconfig leftnexthop=%direct leftcert=carolCert.pem leftid=carol@strongswan.org @@ -24,7 +20,11 @@ conn home rightsubnet=10.1.0.0/16 rightid=@moon.strongswan.org auto=add - - - - + +conn home-icmp + leftprotoport=icmp + rightprotoport=icmp + +conn home-ssh + leftprotoport=tcp + rightprotoport=tcp/ssh diff --git a/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..0bc03380b --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + leftsubnet=10.1.0.0/16 + right=%any + auto=add + +conn rw-icmp + lefthostaccess=yes + leftprotoport=icmp + rightprotoport=icmp + +conn rw-ssh + leftprotoport=tcp/ssh + rightprotoport=tcp diff --git a/testing/tests/ikev2/protoport-dual/posttest.dat b/testing/tests/ikev2/protoport-dual/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/protoport-dual/pretest.dat b/testing/tests/ikev2/protoport-dual/pretest.dat new file mode 100644 index 000000000..d3d0061c3 --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/pretest.dat @@ -0,0 +1,7 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 2 +carol::ipsec up home-icmp +carol::ipsec up home-ssh diff --git a/testing/tests/ikev2/protoport-dual/test.conf b/testing/tests/ikev2/protoport-dual/test.conf new file mode 100644 index 000000000..9cd583b16 --- /dev/null +++ b/testing/tests/ikev2/protoport-dual/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/protoport-route/description.txt b/testing/tests/ikev2/protoport-route/description.txt new file mode 100644 index 000000000..ec7ec69b0 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/description.txt @@ -0,0 +1,8 @@ +Using the <b>left|rightprotoport</b> selectors, two IPsec tunnels +between the roadwarrior <b>carol</b> and the gateway <b>moon</b> are +defined. The first IPsec SA is restricted to ICMP packets and the second +covers TCP-based SSH connections. Using <b>add=route</b> %trap +eroutes for these IPsec SAs are prepared on <b>carol</b>. By sending +a ping to the client <b>alice</b> behind <b>moon</b>, the ICMP eroute +is triggered and the corresponding IPsec tunnel is set up. In the same +way an ssh session to <b>alice</b> over the second IPsec SA is established. diff --git a/testing/tests/ikev2/protoport-route/evaltest.dat b/testing/tests/ikev2/protoport-route/evaltest.dat new file mode 100644 index 000000000..d6ce409f5 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/evaltest.dat @@ -0,0 +1,10 @@ +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES +carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES +carol::ssh PH_IP_ALICE hostname::alice::YES +carol::cat /var/log/daemon.log::creating acquire job for CHILD_SA::YES +carol::ipsec statusall::home-icmp.*INSTALLED::YES +carol::ipsec statusall::home-ssh.*INSTALLED::YES +moon::ipsec statusall::rw-icmp.*INSTALLED::YES +moon::ipsec statusall::rw-ssh.*INSTALLED::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..7f4e37bc2 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=route + +conn home-icmp + leftprotoport=icmp + rightprotoport=icmp + +conn home-ssh + leftprotoport=tcp + rightprotoport=tcp/ssh diff --git a/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..0bc03380b --- /dev/null +++ b/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + leftsubnet=10.1.0.0/16 + right=%any + auto=add + +conn rw-icmp + lefthostaccess=yes + leftprotoport=icmp + rightprotoport=icmp + +conn rw-ssh + leftprotoport=tcp/ssh + rightprotoport=tcp diff --git a/testing/tests/ikev2/protoport-route/posttest.dat b/testing/tests/ikev2/protoport-route/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/protoport-route/pretest.dat b/testing/tests/ikev2/protoport-route/pretest.dat new file mode 100644 index 000000000..0aded0f4d --- /dev/null +++ b/testing/tests/ikev2/protoport-route/pretest.dat @@ -0,0 +1,8 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ssh PH_IP_ALICE hostname +carol::ping -c 1 PH_IP_ALICE > /dev/null +carol::sleep 2 diff --git a/testing/tests/ikev2/protoport-route/test.conf b/testing/tests/ikev2/protoport-route/test.conf new file mode 100644 index 000000000..9cd583b16 --- /dev/null +++ b/testing/tests/ikev2/protoport-route/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/rw-cert/description.txt b/testing/tests/ikev2/rw-cert/description.txt new file mode 100644 index 000000000..15b3822b5 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>. +Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b> +automatically inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping +the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-cert/evaltest.dat b/testing/tests/ikev2/rw-cert/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/rw-cert/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..e5d9ad476 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..3c0014965 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..b8bc990cd --- /dev/null +++ b/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/rw-cert/posttest.dat b/testing/tests/ikev2/rw-cert/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-cert/pretest.dat b/testing/tests/ikev2/rw-cert/pretest.dat new file mode 100644 index 000000000..42e9d7c24 --- /dev/null +++ b/testing/tests/ikev2/rw-cert/pretest.dat @@ -0,0 +1,9 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-cert/test.conf b/testing/tests/ikev2/rw-cert/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-cert/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-fqdn/description.txt b/testing/tests/ikev2/rw-psk-fqdn/description.txt new file mode 100644 index 000000000..d4a7c3878 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b> +and fully qualified domain names. Upon the successful establishment of the IPsec tunnels, +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that +let pass the tunneled traffic. In order to test both tunnel and firewall, both +<b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..9a5087fff --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..47e31ca21 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..7b6e448b3 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..f6c1a22ef --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a6270a67e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + auto=add diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..e6c7420c9 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat new file mode 100644 index 000000000..282b2aec0 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat @@ -0,0 +1,12 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::rm /etc/ipsec.d/cacerts/* +carol::rm /etc/ipsec.d/cacerts/* +dave::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-fqdn/test.conf b/testing/tests/ikev2/rw-psk-fqdn/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-fqdn/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-ipv4/description.txt b/testing/tests/ikev2/rw-psk-ipv4/description.txt new file mode 100644 index 000000000..4eb66c540 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b> +and IPv4 addresses. Upon the successful establishment of the IPsec tunnels, +<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that +let pass the tunneled traffic. In order to test both tunnel and firewall, both +<b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..0e3fe6962 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..18a074472 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..368c3c6fb --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..e989540e9 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..c38a2a59b --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + auto=add diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..ab3fb129b --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat new file mode 100644 index 000000000..282b2aec0 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat @@ -0,0 +1,12 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::rm /etc/ipsec.d/cacerts/* +carol::rm /etc/ipsec.d/cacerts/* +dave::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-ipv4/test.conf b/testing/tests/ikev2/rw-psk-ipv4/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-ipv4/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-no-idr/description.txt b/testing/tests/ikev2/rw-psk-no-idr/description.txt new file mode 100644 index 000000000..51286f123 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b> +and fully qualified domain names. By setting the wildcard <b>rightid=@*.strongswan.org</b> +on <b>carol</b> and <b>dave</b>, no <b>IDr</b> payloads are sent by the roadwarriors. +In order to test the tunnel, +both <b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..b23046668 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@*.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..47e31ca21 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..66734b543 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@*.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..f6c1a22ef --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..a6270a67e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf @@ -0,0 +1,21 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + auto=add diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..e6c7420c9 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat new file mode 100644 index 000000000..282b2aec0 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat @@ -0,0 +1,12 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::rm /etc/ipsec.d/cacerts/* +carol::rm /etc/ipsec.d/cacerts/* +dave::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-no-idr/test.conf b/testing/tests/ikev2/rw-psk-no-idr/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-no-idr/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt b/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt new file mode 100644 index 000000000..f190cae4b --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt @@ -0,0 +1,6 @@ +The roadwarriors <b>carol</b> and <b>dave</b> each set up a connection to gateway <b>moon</b>. +<b>carol</b>'s authentication is based on a Pre-Shared Key (<b>PSK</b>) whereas <b>dave</b>'s +is based on an RSA signature (<b>RSASIG</b>). Gateway <b>moon</b> supports both authentication modes +and selects the correct roadwarrior connection definition based on the gateway ID +requested by the roadwarrior. + diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat new file mode 100644 index 000000000..f7f9dc51d --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat @@ -0,0 +1,15 @@ +moon::cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES +moon::cat /var/log/daemon.log::authentication of 'PH_IP_MOON' (myself) with pre-shared key::YES +moon::ipsec statusall::rw-psk.*INSTALLED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +moon::cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES +moon::cat /var/log/daemon.log::authentication of '@moon.strongswan.org' (myself) with RSA signature::YES +moon::ipsec statusall::rw-rsasig.*INSTALLED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..10eeee9c1 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightsendcert=never + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..47e31ca21 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..ac99ac66c --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + crlcheckinterval=180 + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + keyexchange=ikev2 + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..7419be98a --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + +conn rw-rsasig + authby=rsasig + leftcert=moonCert.pem + leftid=@moon.strongswan.org + auto=add + +conn rw-psk + authby=secret + leftid=PH_IP_MOON + auto=add + diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..508d3a941 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,7 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey.pem + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat new file mode 100644 index 000000000..e48d11e42 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat @@ -0,0 +1,10 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +carol::rm /etc/ipsec.d/cacerts/* +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/rw-psk-rsa-split/description.txt b/testing/tests/ikev2/rw-psk-rsa-split/description.txt new file mode 100644 index 000000000..b601deea8 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/description.txt @@ -0,0 +1,8 @@ +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each +to gateway <b>moon</b>. The roadwarriors' authentication is based on +<ib>Pre-Shared Keys</b> (PSK) whereas the gateway uses an <b>RSA signature</b> +(RSASIG) certified by an X.509 certificate. +Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b> +automatically inserts iptables-based firewall rules that let pass the tunneled traffic. +In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping +the client <b>alice</b> behind the gateway <b>moon</b>. diff --git a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat new file mode 100644 index 000000000..c0fd8b16b --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat @@ -0,0 +1,12 @@ +moon::cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES +moon::cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with pre-shared key successful::YES +moon::cat /var/log/daemon.log::authentication of '@moon.strongswan.org' (myself) with RSA signature::YES +moon::ipsec statusall::rw.*INSTALLED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..6a8253dc4 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..47e31ca21 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..3c9e9a009 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..f6c1a22ef --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..b62ab4156 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + rightsendcert=never + auto=add diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..508d3a941 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,7 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey.pem + +carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx + +dave@strongswan.org : PSK 0sjVzONCF02ncsgiSlmIXeqhGN diff --git a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat new file mode 100644 index 000000000..7cebd7f25 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat @@ -0,0 +1,6 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat new file mode 100644 index 000000000..42e9d7c24 --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat @@ -0,0 +1,9 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home diff --git a/testing/tests/ikev2/rw-psk-rsa-split/test.conf b/testing/tests/ikev2/rw-psk-rsa-split/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/rw-psk-rsa-split/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/strong-keys-certs/description.txt b/testing/tests/ikev2/strong-keys-certs/description.txt new file mode 100644 index 000000000..9d0ca5528 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/description.txt @@ -0,0 +1,7 @@ +This scenario is derived from <a href="../rw-cert"><b>ikev2/rw-cert</b></a>. +The gateway <b>moon</b> uses a 2048 bit RSA private key protected by <b>AES-128</b> +encryption whereas the roadwarriors <b>carol</b> and <b>dave</b> have an +<b>AES-192</b> and <b>AES-256</b> envelope, respectively. +The X.509 certificate of the gateway <b>moon</b> uses a <b>SHA-256</b> hash in +its signature whereas the certificates of the roadwarriors <b>carol</b> +and <b>dave</b> use <b>SHA-384</b> and <b>SHA-512</b>, respectively. diff --git a/testing/tests/ikev2/strong-keys-certs/evaltest.dat b/testing/tests/ikev2/strong-keys-certs/evaltest.dat new file mode 100644 index 000000000..06a0f8cda --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/evaltest.dat @@ -0,0 +1,10 @@ +moon::ipsec statusall::rw.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +dave::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES +moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES + diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..4ddd99280 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert-sha384.pem + leftid=carol@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem new file mode 100644 index 000000000..d4b532323 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEITCCAwmgAwIBAgIBETANBgkqhkiG9w0BAQwFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA2MTAwODEyMTI1MFoXDTExMTAwNzEyMTI1MFowWTELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS0z +ODQxHTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAtCwjB6Yni4jSTbPJ4GX0kM06nr2tDBdU0PH6dZra +IXNaNiBthBNPNDeCYAQDG/ouwuywAJ6L2Lt0GYEhJSwfXMm87fYSG8qRP+C/nlKz +3fCfsuZ8yOAo5NAp2kgvbFVdB5cMeOtid21UqUvDxkncjFRDgpERtrjSthalUFYu +ObIcSMPdlcDho73jzq6zVK5XDJ4l1LHUQLbS4SzyrphCYKekTIoDy3YwRUys6Pdm +4QlFBIXuBwOYHjclvVu0HQVNSM4nWAJd+204KUm/+8neO0kn1Yakv9yoa47o3KGP +3XjtmcgY9SqBbuF+8yDcZQ7+5zUBjc0J+d8txdPoIjLi7wIDAQABo4IBBjCCAQIw +CQYDVR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFIUlEfDm3V0eDmRrpIvj +4FiPpGlpMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQsw +CQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMS +c3Ryb25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3 +YW4ub3JnMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5v +cmcvc3Ryb25nc3dhbi5jcmwwDQYJKoZIhvcNAQEMBQADggEBAL5ZmFmy8lW4Vdwq +hWB6qTtLLa1wwCvTXwbV9V+F8dK39AvHj6CHFqTiFhAbGIq/Ryt9cg2XGy1TDjVj +hQEua7mjp8XH2j2NLY2SiFTMjchbHmMylFk2FrHy2ZnmlRCiH83TAw+EnUWsQKj+ +gL+7Of9SpiaaIblrl+aCiBVktRuXcFSaxjYWTVXOeTCwnxQdF2SNtUKDoCuVPk1J +XCrs86mj575xL/FGjyN4SVbjTEZ4lm1emxrf/RblZOhCKp7mUic8KyP0kf7o6X8E +MXXjq9fDQVrSDG/q62uhZu7CyInnBpWnoUKiMImSxRn/cs0r7RUspC5DtJyhE33Y +DW2BzIc= +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem new file mode 100644 index 000000000..979740525 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-192-CBC,3127472197F76F3E81FF26DCD894FE6F + +ixCdabns1DD2EVjOUQYbxes+mSU6WmfUnRPBthTw1K3X7/jYEVRrApZlPoRxfitg +7aHdqsV70elT48ucP4z410jupq80OI5/3I31zHiqDpmUNXr0ZGs69dC2g01op98Q +IWfbHygALh0PDjhczHWhDBOx+gJDN58qgMfCI2hUDqpcYD9gvEpkkdM/R3Ggwgiq +f+HBD4rQHcpvuKCPIOBVAR/4cXE3D8pcls3FJALwNGf03yIm24hEG2mTz5cDIVTw +m0Bjk5Hbiym4LBreUoVQUF04wDXsuDtz7m1IPkw4GsYpeiomqRyAs7bKUJhbKwaK +/l2MKoQ06Ofx0kc20CG7/qoboiqUgDEOsNd/qdMVOXcqinONW2v2T8+mEi/iLZDJ +B6WXoV15PBkHXfaKeA66oFfF8EqggF4gLoPwekz1jvz5hbeTNYCiuFsMV9ntTxoE +opohFNBvY2ZbJUmmkecgSJcmmByR2cahukh91PjssfZUjMOJjoTpuB3OXF9J6g9U +RKWYxgcyT1n0e0MbYxe4TXHxxUDa5UBkquELQ2gcmJDO5GFuXF40mcvcz3Bse6I7 +GTRvhSL3hmRvbODE3JVI2dISHJ60Fethjxo5JNmCuBqnSkc2KPvsS7ulqANMnnNE +5u2g9RMAtYKfkwscLY8zByouCZTS2pAI+LQd/eTm3/TAZWDJx/Z2UA5peFm2At4n +aerRYP20TeaAI4tcnqsrOpBj0ouphgkGUTGAbBhjR3c2rSoOHxmjQXJOAc59vjgG +zBl2F9M1xtjuTFZxFLMbnx15W1l5rmhZmSTdDY8C5ePBcjn6umxl6QdwvPjbkMIL +MoeyM6w1Eqweg+m25CFOCWrFnglZNM6lcsR3X88oz+gzmHOs/VtAQn7vCA2Ukc5m +RuLro/1juBjMrXd63Mqvxml/0lcSrXH1/ZiTdrdakU5rHNk9554tSL14rBSD86tQ +u7unnobiXTmE0l/fDVuRYzW/Y8GGEr5S2t7SOuNFnU+tXTdavftJD0D7F8v4/bTf +ObDe5qJ/7Y7X/8i6L+va1cm5rXNDI1qrBgwmNv7FbY1G0qBIP80ie7FbcsCpXauE +T5HWTOdJX+xpTVCHXnBriMhlFHXAIKUVdAZqbzgRFWPCOYpzpztgny4l83qP0OLw +vYxvU7RSGFAamRz05t3vHXy3X8n7JulleE8laBFpwx9Xq/bEAkwwmZq1Y6tbksae +4G9aJ6Tdr4SA7BsH+FrtLtwFUkzgmKg+MqDGXamFSx0rvhksl3u67tMpGh0Il8KS +xGfpPXRKaeQwZ18AA1xfPVl01Ajuxhnmmr/ng8WR+DfBpx7uK3lSpUX37Gh06DP5 +Of9oPHpc+Z0Asx/k6XWYGP9G15azUXP5ejebl19QQdZex/wP0MkKNlZ/BH0xJO+a +FLOkg4OhtTppIA0dOhj/v/WCLC+pdl+78pBOQO7dpuJeYrcVvhiQKMhEJdYiYLXY +ZcbN+E0Ta8I9fX1D6qgIEhL0NOczEYT9kYYQZJf2LW9k+dxICPV/0hEjaRNyMrei +C9ZP1k9cEhNMSVRVV2jm2PhOW3nvOFUNkG8OIfFhCri8dXWaGVS/DMb18rpSoB+B +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..4c9a601ca --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA carolKey-aes192.pem "ITP/H4lSHqGpUGmCpgNDklbzTNV+swjA" diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..2b5407387 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn home + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert-sha512.pem + leftid=dave@strongswan.org + leftfirewall=yes + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem new file mode 100644 index 000000000..73088cd1d --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBEjANBgkqhkiG9w0BAQ0FADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA2MTAwODEyMjExMloXDTExMTAwNzEyMjExMlowWDELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS01 +MTIxHDAaBgNVBAMUE2RhdmVAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDL4+PsltDM0QCCS08tkefhll5Q0nb2VEdRZotBIdt6 +XEY1kmDlw0yQOp0XUznnIhcrxXpKeWpLqJdbo56jSxMaUB3Mod1u+aKvVhCgkOT8 +uQa7gIdcNMuXnfnch7yYYS6YxVfzdr/qXBxmVYNbR9sXy48vAD6glZLEVjDITHJO +a6tEVSrAOMyeuA9XTYJiGw5loj63YbUr6Ikp6W9SncPCtfX6G2Amk38MTuITu93W +Pd/bGB06ra6gmMQGAhXuGs14n3QZfQz9PWTp9TPsQNqQZdEjQyNdfeAKtPuz5jnO +cnZuhvVR0q4sxWuy64vkyZ57luTZAXyxdInBeBOp7sC3AgMBAAGjggEFMIIBATAJ +BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU0wvMMeoe59mocM/RiYnD +iw9NUm0wbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ +BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz +dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYETZGF2ZUBzdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBDQUAA4IBAQC/uKe2O9elbSFgpKP5 +7ZjJrCkYu493iH/PDm5G4D76q6WkRvZDqTgGDSIrXrt1xRLIsVJES+HERxfED0DB +yXNe22p1jR8iZdCesZxmEsKYyLh9XmeixKCfnLvStWCVs0+vqwhJlIkyEAveZ4HR +Yq121khdmCDDUugpjEl/nU7CLvCRVgFrlhDm1QLs2rYqxwQrJ2SH4/1W0YRdkY2R +vKZ2ngjLBNjBfXWNXSOpEAG367nVam5lFAepUC0wZTshyCUXt1NzClTnxWABm6M6 +x2Qwg4D6Qt5iXSjR8+DGVh+LaBL/alQi1YYcjkxufdFHnko294c0HsZcTZ3KRghk +ue1F +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem new file mode 100644 index 000000000..e2a1ccb26 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-256-CBC,088DA49D259D5876324277FE7C38F22B + +fChe2r3NjWQnfK3tFIUHtrnYsU+CzbGKmWE1T8ARaLeVC7XtPN99odBYTBOzJj98 +REHk41NWHlVjcY+2ACedniTsQcvuuN3bMHGvyikQeLmg7tc54pQrc85BHfdGrU49 +5Bzhxn29kqY33Dt2aeAMyP3k/b5HyZlCGuQUJx71uPsaEl1so5QE0aIBLaCutIUz +zZcAAa6ahFhw2oOcU2kj8ACGzXrJvBhVU97/yZTdfqrTJauoPXL/WQ+ScfMBhQ0x +vaJbaVy8On1SXTMH2K1ehszjpeFTeRVgndkWuUipwm/xlyzoubs8L4BhJZNzV23r +04ZGYxwSQ0rZBEt+TqopVpc/iMx/vg33P8PHrI45DeoztvjHpD6Fgj5Yh2kGgU5R +cKD1ejgX3FMwTSI5xumUi8mQ+N2pUIK9polS146dpQRoM8F9hsXkYoK/l9Em5jJA +V4vBBbVr6E9G0fVyHboqIzAHgFiC3xnCvVC/Cnyit4zD7D0E86pktR0y4Imtxten +3WUV4rNAVkLR0D5Hoslk9nsqEaOxDBzUVU/zfG8GXItpWQgug5sb6RjcrK0b4Fit +iHsEO5qLZ09cM+1hoddgibUQd0G+iZDPfPc++SCdZVjcvdSOOtcUCJwQGjOdGi9U +I30gjh1Vtql67CnykRmk38duTFFNpL3zLNGfiA+kUeHDr0C4zeD2NsK4v/4nLAO1 +OWSYYFGrhbU5C96q3rgczdh+TurgIhM+ktBUJ/7yYV2eTRlRT35Wk03O7STBLinV +jaXuDBOKb/NAYgA+xtOeBqd1c4cSdOxJEv80G9hhXxxNgf1W1OHDNY6+qXhnLZJU +o1kbF6QNI+R+ip8643GwdLEcz5s49V7x53TDcCGnW2TwzVVHvj+63u5RPcfu8b9e +gz0ey++z6OWvEIt/7NiTzA0dZdmiNLY24uHDHvQ5XmMs4XVM1r5wSFXvs/tDuUpK +/a9zMbr12RDsObVcXXr07FD5Zyh/y2mBEB7xRFXKk5tt++Hvlzbgqxypgq9t5+m8 +PBddV4GarMuZw8bRjMHJ2CVY1VyRGIx+StsHehVMWdfzZTm/Uizq/yPaxqbQE8wY +Vcm6wgYRekAga6I9XsHZ0TBfKtfZqXf0kXX0A+ymQYbfyUm2MqWV5avOKtBRIqcW +B9jCKxah7rjQNlI7vzwZ/whePHU2sL4D23aGGZa373Ql2CmB3AetxYtkRGTSILw9 +aT+ZNgh+BGq6lcdlyks29fFuWRlE+NyJIAwmIVEisZGFijFe5WXBhKWsvEt2JT1v +3qW9lMimOgpkClroPSdb9gQMt1yXDR6z1ty+B41kgy5qSxUiL8z8EUCWPEBPrz5+ ++3KGi1cU5BsfptnkFYCSnVSyRxARh310mruQ2Mb6ipIXX95ejQPSskz5P4u26Olt +UHyS0lgDc8hZTwJUchE5wqj4bAJs12mKbIbapjYv83OAEW8ybGz8R6QVMp3pAad3 +O2WGef6evGrbGKHI6ACMEHaz8fP8GIMjhbJkPxsXYGRsHbUsqYcSmew3EYW51qSA +xMhrzZ6e9ow4PYDuNnUc4bFeV0BIVl6kH7KscT1LBtJVJkXDDoddxFiEhcRjOLDr +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets new file mode 100644 index 000000000..b4b1c6249 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA daveKey-aes256.pem "MeFnDN7VUbj+qU/bkgRIFvbCketIk2wrrs5Ii8297N2v" diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..9c0a14c9b --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf @@ -0,0 +1,23 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert-sha256.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + leftfirewall=yes + right=%any + auto=add diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem new file mode 100644 index 000000000..307f4953e --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEHzCCAwegAwIBAgIBEDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJDSDEZ +MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS +b290IENBMB4XDTA2MTAwODEwNTgxMVoXDTExMTAwNzEwNTgxMVowWDELMAkGA1UE +BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS0y +NTYxHDAaBgNVBAMTE21vb24uc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDzXHm8D8sY1lmX7o1KK0jt/M+UzAI2Ifpx7nAqoviH +XQIPe56BOAm4zHhEIlojEMFd1nncplXvDDGjuV/2F0KK1bFxbNtom88Ix1jrRWtk +FLopYwj3ERC2970OhNO3nuPLrnEAzj6k3XPGMTA3drGnpRf162f7mHAdmYIRXtWm +mfaecs4wGFs8BFGdeDfo6SPhQXZSBwZqjzQxvk1PA7E1qifgR5IGNZkNQRQ9IZD0 +86xzjmZgg5DaJcQKw45elpiVKQN6OkdWTngR3uUBfseWNeRGP5UxCUbDnPijWUbA +6ZAdEfFXLgSpSoXHLNttvGg+SWm0kgKTpHYWYhvpflKNAgMBAAGjggEFMIIBATAJ +BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU0gL3aEo/H8c/Ld/GkBTb +W9Ma+nUwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ +BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz +dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYITbW9vbi5zdHJvbmdzd2Fu +Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn +L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQCItzRn3TNWUzczBd8z +MtdPEsRl5Oi4fV3UecQxhjxAmJDLsEZT5I4uNa1XoLkJm6jVdSL7k+bjzjmpNJ1H +uL49cqia2yTdGP4IU0K8dTGaflg3ccaLLGGXTWU/NtgdI1o6yuZTwb6a9ZL7wWZT +x21BAsvyPTzCpUS1yCK4bFeYOxOYDphUGcwb0JTuRxx2/710b+p64BYiCfVkQJxT +eF1ZtjSW6nJgzMRg5n2zNpdrdXMMCPI6Nl7V6wxbs3Cphmz5qx3lijwi7nZt+jE5 +qK5gphph1MkKIhnA7MF66KEcx5Rknao68yLBBDIA/AISZ3bCIj8R1SGgl/tMYfep +sbRF +-----END CERTIFICATE----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem new file mode 100644 index 000000000..bc9ed38c8 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-128-CBC,381AA672F615E55CD044FB981754FDA6 + +whvkSUJ2sAIH4EOu8vT9LHcKKKG6W9hl/hO++/awU2AVtHn6mYlkkAqDRJiOZbbT +vo0ndy+0B0tCoTyKZbiMRNc6bzHPNgS17cVa2wXrzzMo64xRcElzdN14L8UGA7Cc +Wu3aD0zmzawU9uRZjaQ4qA46FPz/S9/REImZ02QSALIzZJSIIDoUbznBitaHYFve +eLl7e/0vMS/s03FaRNKrVhids3Z3q7lQoF/z5BzBaKNBaDYDLhMeScjNF6QZnDUe +k+++/l54pozl+RvQI6RljPhOzutIC5D627zfordITsBRYEhv6KPShy673H4McaRz +tx2zkflsDyPWDWmRLxA0GfD5jQvbS7aZU1R3iyi/TDXacHXlR92bzVu4AHZClOSn +fypT1h2YnUQOMMw9XlVKklHCWvgpWbVmjiBbnsIh1WjORLgSielrGP/iXVemgzEI +kaTErf7B7sx1pIMyQ8IFdniFryUSuGDvOV4Dt/PZhxh2oKIBIaVYwrl3jQvYlyNv +vpBD6MU2wXU4iP7kt9SN63RjzQoYk7TA7f9JlfXlBrjjwSjPYB1R+MoEfovvEr4j +PHghYnwtwZ4Ok3kR+zxR/M37iJ252IDkOwTuqEXWQMlOlxIeESlh1OYKVLptZwgB +0mFzzx4JapkHP34c4ntsFc3AbUh8uSt67zLJ7JDFhSQ6ltNu1/92nOjXh5tzwGvo +ak5lrUpi2zrgyxSgF7fxOxjXr604f7yxOcoWfXQd354dUXdxrMZigh3ajwsGwXxh +o5Zv+EVXaIpnHnUYmupJwrKQR1ffdVCPlvys99/BlGnvsBzLx+hmut1pjnFwQCPf +aj8Z3NhSdWspQiUzWm+DXpqPKt+4CL5mdxcjyye9ATOPf+30iuY25WvwelT4rgGt +NS0iVMJSHnPVMlcibCwVtCl8hvjzq2TYHGo6cCKDaYJ4+Hy6MjgNrHA011HkJ9iC +P4Ysyq04/OiFPrl0RS+om29By+4/O+w1t0HpuZIFTm6oRg7zWcXtDWkfrhu9WY7e +m7FI8O2f3ezPoMbiRJmdEi0RFsgyqkTdQLOUUF1ad5ZHEAVghsgvaPG5aRLhXQin +gqNvHlDmpekOTDLbEn9cyDf5po45LrUgGOBp6DK+AGb6SymjonNxczlG/eNYHtch +AXBdz5A/n6uP1DXfmGVyI6kZKU+Fotsly5Iov6SLcEicLcfA2oKHK6AIJL+IWGGL +kkShWx0Dv/2UbEkKDjFl36Z0oD5wSW6fyYeslD4IFCjXwkdgWd7l4nreisW9YTl/ +PdnVOBq6yQxfK0WlAxfGzAabmknIXkSE/BlTb5y8q92U3tR3YFLFQ1hPaSPIokIu +Op51DMXOfrbnd1iBrybduktdljoxlcAGmg5Dfz+s9fdkESQfw6oNOP5cHxfctAy9 +k21dKvkI/PqWkgwVv94wX8bWx0LgC0aV3F62qM+Y7/r5N4ZsD76GY7VFIFeSoPKx +Fn9yZOl8JzszvlWNtG7G6DwBL+ZyHS0rM7UEyTwWp8mLasEO96V6dYxD8LqWNbo4 +hY/6xsZOtNDsPdW/Os7MBD+Wf2fL/gzrD7QJyqcy41K8Oxhn2W+Aso3s9DnJ4eSt +-----END RSA PRIVATE KEY----- diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..9d298e183 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey-aes128.pem "gOQHdrSWeFuiZtYPetWuyzHW" diff --git a/testing/tests/ikev2/strong-keys-certs/posttest.dat b/testing/tests/ikev2/strong-keys-certs/posttest.dat new file mode 100644 index 000000000..9ccbaa1c2 --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/posttest.dat @@ -0,0 +1,13 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null +dave::/etc/init.d/iptables stop 2> /dev/null +moon::rm /etc/ipsec.d/private/* +carol::rm /etc/ipsec.d/private/* +dave::rm /etc/ipsec.d/private/* +moon::rm /etc/ipsec.d/certs/* +carol::rm /etc/ipsec.d/certs/* +dave::rm /etc/ipsec.d/certs/* + diff --git a/testing/tests/ikev2/strong-keys-certs/pretest.dat b/testing/tests/ikev2/strong-keys-certs/pretest.dat new file mode 100644 index 000000000..de51ccdfa --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/pretest.dat @@ -0,0 +1,10 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +dave::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +dave::ipsec start +carol::sleep 1 +carol::ipsec up home +dave::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/strong-keys-certs/test.conf b/testing/tests/ikev2/strong-keys-certs/test.conf new file mode 100644 index 000000000..70416826e --- /dev/null +++ b/testing/tests/ikev2/strong-keys-certs/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ikev2/wildcards/description.txt b/testing/tests/ikev2/wildcards/description.txt new file mode 100644 index 000000000..e485f7066 --- /dev/null +++ b/testing/tests/ikev2/wildcards/description.txt @@ -0,0 +1,8 @@ +The VPN gateway <b>moon</b> controls the access to the hosts <b>alice</b> and +<b>venus</b> by means of wildcard parameters that must match the subject +<b>Distinguished Name</b> contained in the peer's X.509 certificate. Access to +<b>alice</b> is granted for DNs containing a OU=Research field whereas <b>venus</b> +can only be reached with a DN containing OU=Accounting. The roadwarriors +<b>carol</b> and <b>dave</b> belong to the departments 'Research' and 'Accounting', +respectively. Therefore <b>carol</b> can access <b>alice</b> and <b>dave</b> +can reach <b>venus</b>. diff --git a/testing/tests/ikev2/wildcards/evaltest.dat b/testing/tests/ikev2/wildcards/evaltest.dat new file mode 100644 index 000000000..2bc83eacd --- /dev/null +++ b/testing/tests/ikev2/wildcards/evaltest.dat @@ -0,0 +1,8 @@ +carol::ipsec status::alice.*PH_IP_CAROL.*PH_IP_ALICE::YES +moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_CAROL::YES +carol::ipsec status::venus.*PH_IP_CAROL.*PH_IP_VENUS::NO +moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_CAROL::NO +dave::ipsec status::venus.*PH_IP_DAVE.*PH_IP_VENUS::YES +moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_DAVE::YES +dave::ipsec status::alice.*PH_IP_DAVE.*PH_IP_ALICE::NO +moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_DAVE::NO diff --git a/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..59d41eb27 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..81e86e823 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..366e1fa9a --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn alice + leftsubnet=PH_IP_ALICE/32 + right=%any + rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*" + auto=add + +conn venus + leftsubnet=PH_IP_VENUS/32 + right=%any + rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*" + auto=add + diff --git a/testing/tests/ikev2/wildcards/posttest.dat b/testing/tests/ikev2/wildcards/posttest.dat new file mode 100644 index 000000000..ed530f6d9 --- /dev/null +++ b/testing/tests/ikev2/wildcards/posttest.dat @@ -0,0 +1,3 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop diff --git a/testing/tests/ikev2/wildcards/pretest.dat b/testing/tests/ikev2/wildcards/pretest.dat new file mode 100644 index 000000000..e3da87520 --- /dev/null +++ b/testing/tests/ikev2/wildcards/pretest.dat @@ -0,0 +1,9 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 1 +carol::ipsec up alice +carol::ipsec up venus +dave::ipsec up venus +dave::ipsec up alice diff --git a/testing/tests/ikev2/wildcards/test.conf b/testing/tests/ikev2/wildcards/test.conf new file mode 100644 index 000000000..08e5cc145 --- /dev/null +++ b/testing/tests/ikev2/wildcards/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" diff --git a/testing/tests/ipv6/host2host-ikev1/description.txt b/testing/tests/ipv6/host2host-ikev1/description.txt new file mode 100644 index 000000000..c59b32acb --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/description.txt @@ -0,0 +1,3 @@ +An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up. +The authentication is based on X.509 certificates. In order to test the host-to-host tunnel +<b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command. diff --git a/testing/tests/ipv6/host2host-ikev1/evaltest.dat b/testing/tests/ipv6/host2host-ikev1/evaltest.dat new file mode 100644 index 000000000..62fc85953 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec status::host-host.*STATE_QUICK_I2.*IPsec SA established::YES +sun::ipsec status::host-host.*STATE_QUICK_R2.*IPsec SA established::YES +moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES +sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES +sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..9499140c5 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutodebug=control + crlcheckinterval=180 + strictcrlpolicy=no + charonstart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + +conn net-net + also=host-host + leftsubnet=fec1::0/16 + rightsubnet=fec2::0/16 + +conn host-host + left=PH_IP6_MOON + leftnexthop=0::0 + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP6_SUN + rightnexthop=0::0 + rightid=@sun.strongswan.org + auto=add + diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/ipsec.conf index 58e2f1e5b..c64904a6e 100755 --- a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/ipsec.conf @@ -1,11 +1,10 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file -version 2.0 # conforms to second version of ipsec.conf specification - config setup plutodebug=control crlcheckinterval=180 strictcrlpolicy=no + charonstart=no conn %default ikelifetime=60m @@ -13,17 +12,18 @@ conn %default rekeymargin=3m keyingtries=1 -conn home - left=PH_IP_CAROL - leftnexthop=%direct - leftcert=myCert.pem - leftid=carol@strongswan.org +conn net-net + also=host-host + leftsubnet=fec2::0/16 + rightsubnet=fec1::0/16 + +conn host-host + left=PH_IP6_SUN + leftnexthop=0::0 + leftcert=sunCert.pem + leftid=@sun.strongswan.org leftfirewall=yes - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 + right=PH_IP6_MOON + rightnexthop=0::0 rightid=@moon.strongswan.org auto=add - - - - diff --git a/testing/tests/ipv6/host2host-ikev1/posttest.dat b/testing/tests/ipv6/host2host-ikev1/posttest.dat new file mode 100644 index 000000000..dff181797 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +sun::ipsec stop diff --git a/testing/tests/ipv6/host2host-ikev1/pretest.dat b/testing/tests/ipv6/host2host-ikev1/pretest.dat new file mode 100644 index 000000000..4707af077 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +sun::ipsec start +moon::sleep 2 +moon::ipsec up host-host diff --git a/testing/tests/ipv6/host2host-ikev1/test.conf b/testing/tests/ipv6/host2host-ikev1/test.conf new file mode 100644 index 000000000..cf2e704fd --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev1/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/ipv6/host2host-ikev2/description.txt b/testing/tests/ipv6/host2host-ikev2/description.txt new file mode 100644 index 000000000..c59b32acb --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/description.txt @@ -0,0 +1,3 @@ +An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up. +The authentication is based on X.509 certificates. In order to test the host-to-host tunnel +<b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command. diff --git a/testing/tests/ipv6/host2host-ikev2/evaltest.dat b/testing/tests/ipv6/host2host-ikev2/evaltest.dat new file mode 100644 index 000000000..8b5ee4f6c --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/evaltest.dat @@ -0,0 +1,5 @@ +moon::ipsec status::host-host.*ESTABLISHED::YES +sun::ipsec status::ESTABLISHED::YES +moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES +sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES +sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..44c85068e --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf @@ -0,0 +1,29 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + also=host-host + leftsubnet=fec1::0/16 + rightsubnet=fec2::0/16 + +conn host-host + left=PH_IP6_MOON + leftnexthop=0::0 + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftfirewall=yes + right=PH_IP6_SUN + rightnexthop=0::0 + rightid=@sun.strongswan.org + auto=add + diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf new file mode 100755 index 000000000..8b3858b30 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf @@ -0,0 +1,28 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn net-net + also=host-host + leftsubnet=fec2::0/16 + rightsubnet=fec1::0/16 + +conn host-host + left=PH_IP6_SUN + leftnexthop=0::0 + leftcert=sunCert.pem + leftid=@sun.strongswan.org + leftfirewall=yes + right=PH_IP6_MOON + rightnexthop=0::0 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ipv6/host2host-ikev2/posttest.dat b/testing/tests/ipv6/host2host-ikev2/posttest.dat new file mode 100644 index 000000000..dff181797 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +sun::ipsec stop diff --git a/testing/tests/ipv6/host2host-ikev2/pretest.dat b/testing/tests/ipv6/host2host-ikev2/pretest.dat new file mode 100644 index 000000000..4707af077 --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +sun::ipsec start +moon::sleep 2 +moon::ipsec up host-host diff --git a/testing/tests/ipv6/host2host-ikev2/test.conf b/testing/tests/ipv6/host2host-ikev2/test.conf new file mode 100644 index 000000000..cf2e704fd --- /dev/null +++ b/testing/tests/ipv6/host2host-ikev2/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon winnetou sun" + +# Corresponding block diagram +# +DIAGRAM="m-w-s.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="sun" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon sun" diff --git a/testing/tests/mode-config-push/posttest.dat b/testing/tests/mode-config-push/posttest.dat deleted file mode 100644 index 932b319a7..000000000 --- a/testing/tests/mode-config-push/posttest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 -dave::ip addr del PH_IP1_DAVE/32 dev eth0 diff --git a/testing/tests/mode-config-swapped/posttest.dat b/testing/tests/mode-config-swapped/posttest.dat deleted file mode 100644 index 932b319a7..000000000 --- a/testing/tests/mode-config-swapped/posttest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 -dave::ip addr del PH_IP1_DAVE/32 dev eth0 diff --git a/testing/tests/mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/mode-config/hosts/dave/etc/ipsec.conf deleted file mode 100755 index da601389c..000000000 --- a/testing/tests/mode-config/hosts/dave/etc/ipsec.conf +++ /dev/null @@ -1,30 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - -conn home - left=PH_IP_DAVE - leftsourceip=%modeconfig - leftnexthop=%direct - leftcert=daveCert.pem - leftid=dave@strongswan.org - leftfirewall=yes - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add - - - - diff --git a/testing/tests/mode-config/posttest.dat b/testing/tests/mode-config/posttest.dat deleted file mode 100644 index 932b319a7..000000000 --- a/testing/tests/mode-config/posttest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -dave::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -dave::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -dave::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 -dave::ip addr del PH_IP1_DAVE/32 dev eth0 diff --git a/testing/tests/net2net-psk/posttest.dat b/testing/tests/net2net-psk/posttest.dat deleted file mode 100644 index 52979508d..000000000 --- a/testing/tests/net2net-psk/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L -moon::ipsec stop -sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-route/posttest.dat b/testing/tests/net2net-route/posttest.dat deleted file mode 100644 index 52979508d..000000000 --- a/testing/tests/net2net-route/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L -moon::ipsec stop -sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-rsa/posttest.dat b/testing/tests/net2net-rsa/posttest.dat deleted file mode 100644 index 52979508d..000000000 --- a/testing/tests/net2net-rsa/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L -moon::ipsec stop -sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/net2net-start/posttest.dat b/testing/tests/net2net-start/posttest.dat deleted file mode 100644 index 52979508d..000000000 --- a/testing/tests/net2net-start/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -sun::iptables -v -n -L -moon::ipsec stop -sun::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -sun::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/protoport-route/posttest.dat b/testing/tests/protoport-route/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/protoport-route/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-cert/posttest.dat b/testing/tests/rw-cert/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/rw-cert/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-fqdn-named/posttest.dat b/testing/tests/rw-psk-fqdn-named/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/rw-psk-fqdn-named/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-fqdn/posttest.dat b/testing/tests/rw-psk-fqdn/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/rw-psk-fqdn/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/rw-psk-ipv4/posttest.dat b/testing/tests/rw-psk-ipv4/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/rw-psk-ipv4/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/starter-also/posttest.dat b/testing/tests/starter-also/posttest.dat deleted file mode 100644 index 26848212b..000000000 --- a/testing/tests/starter-also/posttest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf b/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf deleted file mode 100755 index 598997b45..000000000 --- a/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,30 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - -conn home - left=PH_IP_CAROL - leftsourceip=%modeconfig - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - leftfirewall=yes - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add - - - - diff --git a/testing/tests/virtual-ip-swapped/posttest.dat b/testing/tests/virtual-ip-swapped/posttest.dat deleted file mode 100644 index ac5c7dd82..000000000 --- a/testing/tests/virtual-ip-swapped/posttest.dat +++ /dev/null @@ -1,7 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 diff --git a/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf b/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf deleted file mode 100755 index 2f1170a6b..000000000 --- a/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf +++ /dev/null @@ -1,30 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -version 2.0 # conforms to second version of ipsec.conf specification - -config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - -conn home - left=PH_IP_CAROL - leftsourceip=PH_IP1_CAROL - leftnexthop=%direct - leftcert=carolCert.pem - leftid=carol@strongswan.org - leftfirewall=yes - right=PH_IP_MOON - rightsubnet=10.1.0.0/16 - rightid=@moon.strongswan.org - auto=add - - - - diff --git a/testing/tests/virtual-ip/posttest.dat b/testing/tests/virtual-ip/posttest.dat deleted file mode 100644 index ac5c7dd82..000000000 --- a/testing/tests/virtual-ip/posttest.dat +++ /dev/null @@ -1,7 +0,0 @@ -moon::iptables -v -n -L -carol::iptables -v -n -L -moon::ipsec stop -carol::ipsec stop -moon::/etc/init.d/iptables stop 2> /dev/null -carol::/etc/init.d/iptables stop 2> /dev/null -carol::ip addr del PH_IP1_CAROL/32 dev eth0 |