From 7b0305f59ddab9ea026b202a8c569912e5bf9a90 Mon Sep 17 00:00:00 2001 From: Rene Mayrhofer Date: Wed, 4 Jul 2007 23:47:20 +0000 Subject: [svn-upgrade] Integrating new upstream version, strongswan (4.1.4) --- testing/tests/ikev1/dynamic-responder/description.txt | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 testing/tests/ikev1/dynamic-responder/description.txt (limited to 'testing/tests/ikev1/dynamic-responder/description.txt') diff --git a/testing/tests/ikev1/dynamic-responder/description.txt b/testing/tests/ikev1/dynamic-responder/description.txt new file mode 100644 index 000000000..76471a973 --- /dev/null +++ b/testing/tests/ikev1/dynamic-responder/description.txt @@ -0,0 +1,13 @@ +The peers carol and moon both have dynamic IP addresses, so that the remote end +is defined symbolically by right=<hostname>. The ipsec starter resolves the +fully-qualified hostname into the current IP address via a DNS lookup (simulated by an +/etc/hosts entry). Since the peer IP addresses are expected to change over time, the option +rightallowany=yes will allow an IKE main mode rekeying to arrive from an arbitrary +IP address under the condition that the peer identity remains unchanged. When this happens +the old tunnel is replaced by an IPsec connection to the new origin. +

+In this scenario moon first initiates a tunnel to carol. After some time +the responder carol suddenly changes her IP address and restarts the connection to +moon without deleting the old tunnel first (simulated by iptables blocking IKE packets +to and from carol and starting the connection from host dave using +carol's identity). -- cgit v1.2.3