diff options
Diffstat (limited to 'testing/tests/pfkey/shunt-policies')
10 files changed, 0 insertions, 170 deletions
diff --git a/testing/tests/pfkey/shunt-policies/description.txt b/testing/tests/pfkey/shunt-policies/description.txt deleted file mode 100644 index ad98eb8d5..000000000 --- a/testing/tests/pfkey/shunt-policies/description.txt +++ /dev/null @@ -1,11 +0,0 @@ -All traffic from the clients <b>alice</b> and <b>venus</b> is tunneled -by default gateway <b>moon</b> to VPN gateway <b>sun</b>. In order to -prevent local traffic within the <b>10.1.0.0/16</b> subnet to enter the -tunnel, a <b>local-net</b> shunt policy with <b>type=pass</b> is set up. -In order for the shunt to work, automatic route insertion must be disabled -by adding <b>install_routes = no</b> to the charon section of <b>strongswan.conf</b>. -<p/> -In order to demonstrate the use of <b>type=drop</b> shunt policies, the -<b>venus-icmp</b> connection prevents ICMP traffic to and from <b>venus</b> -to use the IPsec tunnel by dropping such packets. Since this policy does not -apply to the local net, <b>venus</b> and <b>moon</b> can still ping each other. diff --git a/testing/tests/pfkey/shunt-policies/evaltest.dat b/testing/tests/pfkey/shunt-policies/evaltest.dat deleted file mode 100644 index 6ba3a988f..000000000 --- a/testing/tests/pfkey/shunt-policies/evaltest.dat +++ /dev/null @@ -1,20 +0,0 @@ -moon:: ipsec status 2> /dev/null::local-net.*PASS::YES -moon:: ipsec status 2> /dev/null::venus-icmp.*DROP::YES -moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES -sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES -moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO -venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES -moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES -moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES -moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES -bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO -sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES -sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES -venus::ssh PH_IP_BOB hostname::bob::YES -bob::ssh PH_IP_VENUS hostname::venus::YES diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/ipsec.conf b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/ipsec.conf deleted file mode 100644 index 90a5d61b1..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/ipsec.conf +++ /dev/null @@ -1,40 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -config setup - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - keyexchange=ikev2 - mobike=no - -conn local-net - leftsubnet=10.1.0.0/16 - rightsubnet=10.1.0.0/16 - authby=never - type=pass - auto=route - -conn venus-icmp - leftsubnet=10.1.0.20/32 - rightsubnet=0.0.0.0/0 - leftprotoport=icmp - rightprotoport=icmp - leftauth=any - rightauth=any - type=drop - auto=route - -conn net-net - left=PH_IP_MOON - leftcert=moonCert.pem - leftid=@moon.strongswan.org - leftsubnet=10.1.0.0/16 - leftfirewall=yes - lefthostaccess=yes - right=PH_IP_SUN - rightid=@sun.strongswan.org - rightsubnet=0.0.0.0/0 - auto=add diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules deleted file mode 100644 index af0f25209..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules +++ /dev/null @@ -1,32 +0,0 @@ -*filter - -# default policy is DROP --P INPUT DROP --P OUTPUT DROP --P FORWARD DROP - -# allow esp --A INPUT -i eth0 -p 50 -j ACCEPT --A OUTPUT -o eth0 -p 50 -j ACCEPT - -# allow IKE --A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT --A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - -# allow MobIKE --A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT --A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - -# allow ssh --A INPUT -p tcp --dport 22 -j ACCEPT --A OUTPUT -p tcp --sport 22 -j ACCEPT - -# allow crl fetch from winnetou --A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT --A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - -# allow icmp in local net --A INPUT -i eth1 -p icmp -j ACCEPT --A OUTPUT -o eth1 -p icmp -j ACCEPT - -COMMIT diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/strongswan.conf b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/strongswan.conf deleted file mode 100644 index 4582e1473..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/strongswan.conf +++ /dev/null @@ -1,7 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - -charon { - load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-pfkey kernel-netlink socket-default updown - multiple_authentication = no - install_routes = no -} diff --git a/testing/tests/pfkey/shunt-policies/hosts/sun/etc/ipsec.conf b/testing/tests/pfkey/shunt-policies/hosts/sun/etc/ipsec.conf deleted file mode 100644 index cd8ea23c3..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/sun/etc/ipsec.conf +++ /dev/null @@ -1,22 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -config setup - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - keyexchange=ikev2 - mobike=no - -conn net-net - left=PH_IP_SUN - leftcert=sunCert.pem - leftid=@sun.strongswan.org - leftsubnet=0.0.0.0/0 - leftfirewall=yes - right=PH_IP_MOON - rightid=@moon.strongswan.org - rightsubnet=10.1.0.0/16 - auto=add diff --git a/testing/tests/pfkey/shunt-policies/hosts/sun/etc/strongswan.conf b/testing/tests/pfkey/shunt-policies/hosts/sun/etc/strongswan.conf deleted file mode 100644 index 902d83c69..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/sun/etc/strongswan.conf +++ /dev/null @@ -1,6 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - -charon { - load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-pfkey kernel-netlink socket-default updown - multiple_authentication = no -} diff --git a/testing/tests/pfkey/shunt-policies/posttest.dat b/testing/tests/pfkey/shunt-policies/posttest.dat deleted file mode 100644 index 837738fc6..000000000 --- a/testing/tests/pfkey/shunt-policies/posttest.dat +++ /dev/null @@ -1,5 +0,0 @@ -moon::ipsec stop -sun::ipsec stop -moon::iptables-restore < /etc/iptables.flush -sun::iptables-restore < /etc/iptables.flush - diff --git a/testing/tests/pfkey/shunt-policies/pretest.dat b/testing/tests/pfkey/shunt-policies/pretest.dat deleted file mode 100644 index c724e5df8..000000000 --- a/testing/tests/pfkey/shunt-policies/pretest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables-restore < /etc/iptables.rules -sun::iptables-restore < /etc/iptables.rules -moon::ipsec start -sun::ipsec start -moon::sleep 1 -moon::ipsec up net-net diff --git a/testing/tests/pfkey/shunt-policies/test.conf b/testing/tests/pfkey/shunt-policies/test.conf deleted file mode 100644 index 6b7432ca6..000000000 --- a/testing/tests/pfkey/shunt-policies/test.conf +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -# -# This configuration file provides information on the -# guest instances used for this test - -# All guest instances that are required for this test -# -VIRTHOSTS="alice moon winnetou sun bob" - -# Corresponding block diagram -# -DIAGRAM="a-v-m-w-s-b.png" - -# Guest instances on which tcpdump is to be started -# -TCPDUMPHOSTS="sun" - -# Guest instances on which IPsec is started -# Used for IPsec logging purposes -# -IPSECHOSTS="moon sun" |