summaryrefslogtreecommitdiff
path: root/testing/tests/ipv6/transport-ikev1
diff options
context:
space:
mode:
Diffstat (limited to 'testing/tests/ipv6/transport-ikev1')
-rw-r--r--testing/tests/ipv6/transport-ikev1/evaltest.dat8
-rwxr-xr-xtesting/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables14
-rw-r--r--[-rwxr-xr-x]testing/tests/ipv6/transport-ikev1/hosts/moon/etc/ipsec.conf10
-rw-r--r--testing/tests/ipv6/transport-ikev1/hosts/moon/etc/strongswan.conf5
-rwxr-xr-xtesting/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables14
-rw-r--r--[-rwxr-xr-x]testing/tests/ipv6/transport-ikev1/hosts/sun/etc/ipsec.conf10
-rw-r--r--testing/tests/ipv6/transport-ikev1/hosts/sun/etc/strongswan.conf5
-rw-r--r--testing/tests/ipv6/transport-ikev1/pretest.dat1
8 files changed, 50 insertions, 17 deletions
diff --git a/testing/tests/ipv6/transport-ikev1/evaltest.dat b/testing/tests/ipv6/transport-ikev1/evaltest.dat
index 2010557c1..5ae9d2c12 100644
--- a/testing/tests/ipv6/transport-ikev1/evaltest.dat
+++ b/testing/tests/ipv6/transport-ikev1/evaltest.dat
@@ -1,7 +1,9 @@
-moon::ipsec status::host-host.*STATE_QUICK_I2.*IPsec SA established::YES
-sun::ipsec status::host-host.*STATE_QUICK_R2.*IPsec SA established::YES
+moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
+sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::ip xfrm state::mode transport::YES
-sun::ip xfrm state::mode transport::YES
+sun:: ip xfrm state::mode transport::YES
moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES
sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables
index 521d1ce31..343fd49ed 100755
--- a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables
+++ b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables
@@ -45,14 +45,22 @@ start() {
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+ # allow crl and certficate fetch from winnetou
+ ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
+ ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
+
+ # allow last IPv6 UDP fragments
+ ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
+ ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+ # log dropped packets
+ ip6tables -A INPUT -j LOG --log-prefix " IN: "
+ ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
+
eend $?
}
diff --git a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/ipsec.conf b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/ipsec.conf
index 69ba50530..163308353 100755..100644
--- a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/ipsec.conf
@@ -1,10 +1,12 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
- plutodebug=control
- crlcheckinterval=180
- strictcrlpolicy=no
- charonstart=no
+
+ca strongswan
+ cacert=strongswanCert.pem
+ certuribase=http://ip6-winnetou.strongswan.org/certs/
+ crluri=http://ip6-winnetou.strongswan.org/strongswan.crl
+ auto=add
conn %default
ikelifetime=60m
diff --git a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/strongswan.conf b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/strongswan.conf
new file mode 100644
index 000000000..ca23c6971
--- /dev/null
+++ b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/strongswan.conf
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown
+}
diff --git a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables
index 521d1ce31..47db6db82 100755
--- a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables
+++ b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables
@@ -45,14 +45,22 @@ start() {
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+ # allow last IPv6 UDP fragments
+ ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
+ ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
+
+ # allow crl and certificate fetch from winnetou
+ ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
+ ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+ # log dropped packets
+ ip6tables -A INPUT -j LOG --log-prefix " IN: "
+ ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
+
eend $?
}
diff --git a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/ipsec.conf b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/ipsec.conf
index a7c6b18c7..48d48908d 100755..100644
--- a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/ipsec.conf
@@ -1,10 +1,12 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
- plutodebug=control
- crlcheckinterval=180
- strictcrlpolicy=no
- charonstart=no
+
+ca strongswan
+ cacert=strongswanCert.pem
+ certuribase=http://ip6-winnetou.strongswan.org/certs/
+ crluri=http://ip6-winnetou.strongswan.org/strongswan.crl
+ auto=add
conn %default
ikelifetime=60m
diff --git a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/strongswan.conf b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/strongswan.conf
new file mode 100644
index 000000000..ca23c6971
--- /dev/null
+++ b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/strongswan.conf
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown
+}
diff --git a/testing/tests/ipv6/transport-ikev1/pretest.dat b/testing/tests/ipv6/transport-ikev1/pretest.dat
index 3536fd886..7e97e7783 100644
--- a/testing/tests/ipv6/transport-ikev1/pretest.dat
+++ b/testing/tests/ipv6/transport-ikev1/pretest.dat
@@ -4,3 +4,4 @@ moon::ipsec start
sun::ipsec start
moon::sleep 2
moon::ipsec up host-host
+moon::sleep 1
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-14 11:21:41 +0000