From c1343b3278cdf99533b7902744d15969f9d6fdc1 Mon Sep 17 00:00:00 2001 From: Yves-Alexis Perez Date: Wed, 2 Jan 2013 14:18:20 +0100 Subject: Imported Upstream version 5.0.1 --- .../ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables | 14 +++++++++++--- testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/ipsec.conf | 11 ++++++----- .../ipv6/net2net-ikev1/hosts/moon/etc/strongswan.conf | 5 +++++ .../tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables | 14 +++++++++++--- testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/ipsec.conf | 10 ++++++---- .../tests/ipv6/net2net-ikev1/hosts/sun/etc/strongswan.conf | 5 +++++ 6 files changed, 44 insertions(+), 15 deletions(-) mode change 100755 => 100644 testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/strongswan.conf mode change 100755 => 100644 testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/ipsec.conf create mode 100644 testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/strongswan.conf (limited to 'testing/tests/ipv6/net2net-ikev1/hosts') diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables index 521d1ce31..47db6db82 100755 --- a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables +++ b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables @@ -45,14 +45,22 @@ start() { ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + # allow last IPv6 UDP fragments + ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT + ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT + + # allow crl and certificate fetch from winnetou + ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT + ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT # allow ssh iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + # log dropped packets + ip6tables -A INPUT -j LOG --log-prefix " IN: " + ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " + eend $? } diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/ipsec.conf b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/ipsec.conf old mode 100755 new mode 100644 index bb96a71e0..d07486483 --- a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/ipsec.conf +++ b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/ipsec.conf @@ -1,10 +1,12 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - charonstart=no + +ca strongswan + cacert=strongswanCert.pem + certuribase=http://ip6-winnetou.strongswan.org/certs/ + crluri=http://ip6-winnetou.strongswan.org/strongswan.crl + auto=add conn %default ikelifetime=60m @@ -26,4 +28,3 @@ conn host-host right=PH_IP6_SUN rightid=@sun.strongswan.org auto=add - diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/strongswan.conf b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..ca23c6971 --- /dev/null +++ b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown +} diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables index 521d1ce31..47db6db82 100755 --- a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables +++ b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables @@ -45,14 +45,22 @@ start() { ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT + # allow last IPv6 UDP fragments + ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT + ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT + + # allow crl and certificate fetch from winnetou + ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT + ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT # allow ssh iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT + # log dropped packets + ip6tables -A INPUT -j LOG --log-prefix " IN: " + ip6tables -A OUTPUT -j LOG --log-prefix " OUT: " + eend $? } diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/ipsec.conf b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/ipsec.conf old mode 100755 new mode 100644 index 016adc095..bbaa09bb7 --- a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/ipsec.conf +++ b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/ipsec.conf @@ -1,10 +1,12 @@ # /etc/ipsec.conf - strongSwan IPsec configuration file config setup - plutodebug=control - crlcheckinterval=180 - strictcrlpolicy=no - charonstart=no + +ca strongswan + cacert=strongswanCert.pem + certuribase=http://ip6-winnetou.strongswan.org/certs/ + crluri=http://ip6-winnetou.strongswan.org/strongswan.crl + auto=add conn %default ikelifetime=60m diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/strongswan.conf b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/strongswan.conf new file mode 100644 index 000000000..ca23c6971 --- /dev/null +++ b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default updown +} -- cgit v1.2.3