summaryrefslogtreecommitdiff
path: root/testing/tests/ikev1/wlan
diff options
context:
space:
mode:
Diffstat (limited to 'testing/tests/ikev1/wlan')
-rw-r--r--testing/tests/ikev1/wlan/description.txt15
-rw-r--r--testing/tests/ikev1/wlan/evaltest.dat11
-rwxr-xr-xtesting/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables73
-rwxr-xr-xtesting/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf35
-rwxr-xr-xtesting/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables82
-rwxr-xr-xtesting/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf36
-rwxr-xr-xtesting/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables73
-rwxr-xr-xtesting/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf35
-rw-r--r--testing/tests/ikev1/wlan/posttest.dat8
-rw-r--r--testing/tests/ikev1/wlan/pretest.dat11
-rw-r--r--testing/tests/ikev1/wlan/test.conf21
11 files changed, 0 insertions, 400 deletions
diff --git a/testing/tests/ikev1/wlan/description.txt b/testing/tests/ikev1/wlan/description.txt
deleted file mode 100644
index e018148bd..000000000
--- a/testing/tests/ikev1/wlan/description.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-The WLAN clients <b>alice</b> and <b>venus</b> secure all their wireless traffic
-by setting up an IPsec tunnel to gateway <b>moon</b>. The VPN network mask is
-<b>0.0.0.0/0</b>. Traffic with destination outside the protected 10.1.0.0/10 network
-is NAT-ed by router <b>moon</b>. The IPsec connections are tested by pings from
-<b>alice</b> to <b>venus</b> tunneled via <b>moon</b> and to both the internal
-and external interface of gateway <b>moon</b>. Access to the gateway is
-set up by <b>lefthostaccess=yes</b> in conjunction with <b>leftfirewall=yes</b>.
-At last <b>alice</b> and <b>venus</b> ping the external host <b>sun</b> via the NAT router.
-<p>
-The host system controls the UML instances <b>alice</b> and <b>carol</b> via
-ssh commands sent over the virtual <b>tap1</b> interface. In order to keep up
-the control flow in the presence of the all-encompassing 0.0.0.0/0 tunnel
-to the gateway <b>moon</b> an auxiliary <b>passthrough</b> eroute restricted
-to the ssh port is statically set up by <b>conn system</b>.
-
diff --git a/testing/tests/ikev1/wlan/evaltest.dat b/testing/tests/ikev1/wlan/evaltest.dat
deleted file mode 100644
index 079ac4429..000000000
--- a/testing/tests/ikev1/wlan/evaltest.dat
+++ /dev/null
@@ -1,11 +0,0 @@
-alice::ipsec status::wlan.*STATE_QUICK_I2.*IPsec SA established::YES
-venus::ipsec status::wlan.*STATE_QUICK_I2.*IPsec SA established::YES
-moon::ipsec status::alice.*STATE_QUICK_R2.*IPsec SA established::YES
-moon::ipsec status::venus.*STATE_QUICK_R2.*IPsec SA established::YES
-alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
-moon::tcpdump::ESP::YES
-sun::tcpdump::ICMP::YES
diff --git a/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index 86a76e2db..000000000
--- a/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf
deleted file mode 100755
index e3cf9b15d..000000000
--- a/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf
+++ /dev/null
@@ -1,35 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
- plutodebug=control
- crlcheckinterval=180
- strictcrlpolicy=no
- nat_traversal=no
- charonstart=no
-
-conn %default
- ikelifetime=60m
- keylife=20m
- rekeymargin=3m
- keyingtries=1
- keyexchange=ikev1
-
-conn system
- left=PH_IP_ALICE
- leftprotoport=tcp/ssh
- authby=never
- type=passthrough
- right=10.1.0.254
- rightprotoport=tcp
- auto=route
-
-conn wlan
- left=PH_IP_ALICE
- leftcert=aliceCert.pem
- leftid=alice@strongswan.org
- leftfirewall=yes
- right=PH_IP_MOON1
- rightid=@moon.strongswan.org
- rightsubnet=0.0.0.0/0
- auto=add
-
diff --git a/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index e95ef44c6..000000000
--- a/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth1 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A FORWARD -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A FORWARD -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # enable SNAT
- iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p icmp -j SNAT --to-source PH_IP_MOON
- iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf
deleted file mode 100755
index 61ce28e6b..000000000
--- a/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf
+++ /dev/null
@@ -1,36 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
- plutodebug=control
- crlcheckinterval=180
- strictcrlpolicy=no
- nat_traversal=no
- charonstart=no
-
-conn %default
- ikelifetime=60m
- keylife=20m
- rekeymargin=3m
- keyingtries=1
- keyexchange=ikev1
-
-conn alice
- right=PH_IP_ALICE
- rightid=alice@strongswan.org
- also=wlan
- auto=add
-
-conn venus
- right=PH_IP_VENUS
- rightid=@venus.strongswan.org
- also=wlan
- auto=add
-
-conn wlan
- left=PH_IP_MOON1
- leftsubnet=0.0.0.0/0
- leftcert=moonCert.pem
- leftid=@moon.strongswan.org
- leftfirewall=yes
- lefthostaccess=yes
-
diff --git a/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables
deleted file mode 100755
index 6f95e7576..000000000
--- a/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf
deleted file mode 100755
index fa2dc953e..000000000
--- a/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf
+++ /dev/null
@@ -1,35 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
- plutodebug=control
- crlcheckinterval=180
- strictcrlpolicy=no
- nat_traversal=no
- charonstart=no
-
-conn %default
- ikelifetime=60m
- keylife=20m
- rekeymargin=3m
- keyingtries=1
- keyexchange=ikev1
-
-conn system
- left=PH_IP_VENUS
- leftprotoport=tcp/ssh
- authby=never
- type=passthrough
- right=10.1.0.254
- rightprotoport=tcp
- auto=route
-
-conn wlan
- left=PH_IP_VENUS
- leftcert=venusCert.pem
- leftid=@venus.strongswan.org
- leftfirewall=yes
- right=PH_IP_MOON1
- rightid=@moon.strongswan.org
- rightsubnet=0.0.0.0/0
- auto=add
-
diff --git a/testing/tests/ikev1/wlan/posttest.dat b/testing/tests/ikev1/wlan/posttest.dat
deleted file mode 100644
index 6bd2379d8..000000000
--- a/testing/tests/ikev1/wlan/posttest.dat
+++ /dev/null
@@ -1,8 +0,0 @@
-moon::iptables -t nat -v -n -L POSTROUTING
-moon::ipsec stop
-alice::ipsec stop
-venus::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
-moon::/etc/init.d/iptables stop 2> /dev/null
-moon::conntrack -F
diff --git a/testing/tests/ikev1/wlan/pretest.dat b/testing/tests/ikev1/wlan/pretest.dat
deleted file mode 100644
index de4a6ad31..000000000
--- a/testing/tests/ikev1/wlan/pretest.dat
+++ /dev/null
@@ -1,11 +0,0 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-moon::ipsec start
-alice::ipsec start
-venus::ipsec start
-alice::sleep 2
-alice::ipsec up wlan
-venus::sleep 2
-venus::ipsec up wlan
-venus::sleep 2
diff --git a/testing/tests/ikev1/wlan/test.conf b/testing/tests/ikev1/wlan/test.conf
deleted file mode 100644
index b141c4f1b..000000000
--- a/testing/tests/ikev1/wlan/test.conf
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/bash
-#
-# This configuration file provides information on the
-# UML instances used for this test
-
-# All UML instances that are required for this test
-#
-UMLHOSTS="alice venus moon winnetou sun"
-
-# Corresponding block diagram
-#
-DIAGRAM="a-v-m-w-s-b.png"
-
-# UML instances on which tcpdump is to be started
-#
-TCPDUMPHOSTS="moon:eth1 sun"
-
-# UML instances on which IPsec is started
-# Used for IPsec logging purposes
-#
-IPSECHOSTS="alice venus moon"
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-10 20:21:38 +0000