From 774a362e87feab25f1be16fbca08269ddc7121a4 Mon Sep 17 00:00:00 2001 From: Rene Mayrhofer Date: Thu, 12 Apr 2007 20:41:31 +0000 Subject: Major new upstream release, just ran svn-upgrade for now (and wrote some debian/changelong entries). --- testing/tests/ikev2/wildcards/description.txt | 8 ++++++ testing/tests/ikev2/wildcards/evaltest.dat | 8 ++++++ .../ikev2/wildcards/hosts/carol/etc/ipsec.conf | 26 +++++++++++++++++++ .../ikev2/wildcards/hosts/dave/etc/ipsec.conf | 26 +++++++++++++++++++ .../ikev2/wildcards/hosts/moon/etc/ipsec.conf | 30 ++++++++++++++++++++++ testing/tests/ikev2/wildcards/posttest.dat | 3 +++ testing/tests/ikev2/wildcards/pretest.dat | 9 +++++++ testing/tests/ikev2/wildcards/test.conf | 21 +++++++++++++++ 8 files changed, 131 insertions(+) create mode 100644 testing/tests/ikev2/wildcards/description.txt create mode 100644 testing/tests/ikev2/wildcards/evaltest.dat create mode 100755 testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf create mode 100755 testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf create mode 100755 testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ikev2/wildcards/posttest.dat create mode 100644 testing/tests/ikev2/wildcards/pretest.dat create mode 100644 testing/tests/ikev2/wildcards/test.conf (limited to 'testing/tests/ikev2/wildcards') diff --git a/testing/tests/ikev2/wildcards/description.txt b/testing/tests/ikev2/wildcards/description.txt new file mode 100644 index 000000000..e485f7066 --- /dev/null +++ b/testing/tests/ikev2/wildcards/description.txt @@ -0,0 +1,8 @@ +The VPN gateway moon controls the access to the hosts alice and +venus by means of wildcard parameters that must match the subject +Distinguished Name contained in the peer's X.509 certificate. Access to +alice is granted for DNs containing a OU=Research field whereas venus +can only be reached with a DN containing OU=Accounting. The roadwarriors +carol and dave belong to the departments 'Research' and 'Accounting', +respectively. Therefore carol can access alice and dave +can reach venus. diff --git a/testing/tests/ikev2/wildcards/evaltest.dat b/testing/tests/ikev2/wildcards/evaltest.dat new file mode 100644 index 000000000..2bc83eacd --- /dev/null +++ b/testing/tests/ikev2/wildcards/evaltest.dat @@ -0,0 +1,8 @@ +carol::ipsec status::alice.*PH_IP_CAROL.*PH_IP_ALICE::YES +moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_CAROL::YES +carol::ipsec status::venus.*PH_IP_CAROL.*PH_IP_VENUS::NO +moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_CAROL::NO +dave::ipsec status::venus.*PH_IP_DAVE.*PH_IP_VENUS::YES +moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_DAVE::YES +dave::ipsec status::alice.*PH_IP_DAVE.*PH_IP_ALICE::NO +moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_DAVE::NO diff --git a/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..59d41eb27 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_CAROL + leftnexthop=%direct + leftcert=carolCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf new file mode 100755 index 000000000..81e86e823 --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_DAVE + leftnexthop=%direct + leftcert=daveCert.pem + right=PH_IP_MOON + rightid=@moon.strongswan.org + +conn alice + rightsubnet=PH_IP_ALICE/32 + auto=add + +conn venus + rightsubnet=PH_IP_VENUS/32 + auto=add diff --git a/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..366e1fa9a --- /dev/null +++ b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf @@ -0,0 +1,30 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + left=PH_IP_MOON + leftnexthop=%direct + leftcert=moonCert.pem + leftid=@moon.strongswan.org + +conn alice + leftsubnet=PH_IP_ALICE/32 + right=%any + rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*" + auto=add + +conn venus + leftsubnet=PH_IP_VENUS/32 + right=%any + rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*" + auto=add + diff --git a/testing/tests/ikev2/wildcards/posttest.dat b/testing/tests/ikev2/wildcards/posttest.dat new file mode 100644 index 000000000..ed530f6d9 --- /dev/null +++ b/testing/tests/ikev2/wildcards/posttest.dat @@ -0,0 +1,3 @@ +moon::ipsec stop +carol::ipsec stop +dave::ipsec stop diff --git a/testing/tests/ikev2/wildcards/pretest.dat b/testing/tests/ikev2/wildcards/pretest.dat new file mode 100644 index 000000000..e3da87520 --- /dev/null +++ b/testing/tests/ikev2/wildcards/pretest.dat @@ -0,0 +1,9 @@ +moon::echo 1 > /proc/sys/net/ipv4/ip_forward +carol::ipsec start +dave::ipsec start +moon::ipsec start +carol::sleep 1 +carol::ipsec up alice +carol::ipsec up venus +dave::ipsec up venus +dave::ipsec up alice diff --git a/testing/tests/ikev2/wildcards/test.conf b/testing/tests/ikev2/wildcards/test.conf new file mode 100644 index 000000000..08e5cc145 --- /dev/null +++ b/testing/tests/ikev2/wildcards/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice venus moon carol winnetou dave" + +# Corresponding block diagram +# +DIAGRAM="a-v-m-c-w-d.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol dave" -- cgit v1.2.3