From 81c63b0eed39432878f78727f60a1e7499645199 Mon Sep 17 00:00:00 2001 From: Yves-Alexis Perez Date: Fri, 11 Jul 2014 07:23:31 +0200 Subject: Imported Upstream version 5.2.0 --- testing/tests/pfkey/shunt-policies/description.txt | 11 ------ testing/tests/pfkey/shunt-policies/evaltest.dat | 20 ----------- .../pfkey/shunt-policies/hosts/moon/etc/ipsec.conf | 40 ---------------------- .../shunt-policies/hosts/moon/etc/iptables.rules | 32 ----------------- .../shunt-policies/hosts/moon/etc/strongswan.conf | 7 ---- .../pfkey/shunt-policies/hosts/sun/etc/ipsec.conf | 22 ------------ .../shunt-policies/hosts/sun/etc/strongswan.conf | 6 ---- testing/tests/pfkey/shunt-policies/posttest.dat | 5 --- testing/tests/pfkey/shunt-policies/pretest.dat | 6 ---- testing/tests/pfkey/shunt-policies/test.conf | 21 ------------ 10 files changed, 170 deletions(-) delete mode 100644 testing/tests/pfkey/shunt-policies/description.txt delete mode 100644 testing/tests/pfkey/shunt-policies/evaltest.dat delete mode 100644 testing/tests/pfkey/shunt-policies/hosts/moon/etc/ipsec.conf delete mode 100644 testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules delete mode 100644 testing/tests/pfkey/shunt-policies/hosts/moon/etc/strongswan.conf delete mode 100644 testing/tests/pfkey/shunt-policies/hosts/sun/etc/ipsec.conf delete mode 100644 testing/tests/pfkey/shunt-policies/hosts/sun/etc/strongswan.conf delete mode 100644 testing/tests/pfkey/shunt-policies/posttest.dat delete mode 100644 testing/tests/pfkey/shunt-policies/pretest.dat delete mode 100644 testing/tests/pfkey/shunt-policies/test.conf (limited to 'testing/tests/pfkey/shunt-policies') diff --git a/testing/tests/pfkey/shunt-policies/description.txt b/testing/tests/pfkey/shunt-policies/description.txt deleted file mode 100644 index ad98eb8d5..000000000 --- a/testing/tests/pfkey/shunt-policies/description.txt +++ /dev/null @@ -1,11 +0,0 @@ -All traffic from the clients alice and venus is tunneled -by default gateway moon to VPN gateway sun. In order to -prevent local traffic within the 10.1.0.0/16 subnet to enter the -tunnel, a local-net shunt policy with type=pass is set up. -In order for the shunt to work, automatic route insertion must be disabled -by adding install_routes = no to the charon section of strongswan.conf. -

-In order to demonstrate the use of type=drop shunt policies, the -venus-icmp connection prevents ICMP traffic to and from venus -to use the IPsec tunnel by dropping such packets. Since this policy does not -apply to the local net, venus and moon can still ping each other. diff --git a/testing/tests/pfkey/shunt-policies/evaltest.dat b/testing/tests/pfkey/shunt-policies/evaltest.dat deleted file mode 100644 index 6ba3a988f..000000000 --- a/testing/tests/pfkey/shunt-policies/evaltest.dat +++ /dev/null @@ -1,20 +0,0 @@ -moon:: ipsec status 2> /dev/null::local-net.*PASS::YES -moon:: ipsec status 2> /dev/null::venus-icmp.*DROP::YES -moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES -sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES -moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES -alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES -alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES -venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO -venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES -moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES -moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES -moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES -bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES -bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES -bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO -sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES -sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES -venus::ssh PH_IP_BOB hostname::bob::YES -bob::ssh PH_IP_VENUS hostname::venus::YES diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/ipsec.conf b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/ipsec.conf deleted file mode 100644 index 90a5d61b1..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/ipsec.conf +++ /dev/null @@ -1,40 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -config setup - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - keyexchange=ikev2 - mobike=no - -conn local-net - leftsubnet=10.1.0.0/16 - rightsubnet=10.1.0.0/16 - authby=never - type=pass - auto=route - -conn venus-icmp - leftsubnet=10.1.0.20/32 - rightsubnet=0.0.0.0/0 - leftprotoport=icmp - rightprotoport=icmp - leftauth=any - rightauth=any - type=drop - auto=route - -conn net-net - left=PH_IP_MOON - leftcert=moonCert.pem - leftid=@moon.strongswan.org - leftsubnet=10.1.0.0/16 - leftfirewall=yes - lefthostaccess=yes - right=PH_IP_SUN - rightid=@sun.strongswan.org - rightsubnet=0.0.0.0/0 - auto=add diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules deleted file mode 100644 index af0f25209..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules +++ /dev/null @@ -1,32 +0,0 @@ -*filter - -# default policy is DROP --P INPUT DROP --P OUTPUT DROP --P FORWARD DROP - -# allow esp --A INPUT -i eth0 -p 50 -j ACCEPT --A OUTPUT -o eth0 -p 50 -j ACCEPT - -# allow IKE --A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT --A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - -# allow MobIKE --A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT --A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - -# allow ssh --A INPUT -p tcp --dport 22 -j ACCEPT --A OUTPUT -p tcp --sport 22 -j ACCEPT - -# allow crl fetch from winnetou --A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT --A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - -# allow icmp in local net --A INPUT -i eth1 -p icmp -j ACCEPT --A OUTPUT -o eth1 -p icmp -j ACCEPT - -COMMIT diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/strongswan.conf b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/strongswan.conf deleted file mode 100644 index 4582e1473..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/strongswan.conf +++ /dev/null @@ -1,7 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - -charon { - load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-pfkey kernel-netlink socket-default updown - multiple_authentication = no - install_routes = no -} diff --git a/testing/tests/pfkey/shunt-policies/hosts/sun/etc/ipsec.conf b/testing/tests/pfkey/shunt-policies/hosts/sun/etc/ipsec.conf deleted file mode 100644 index cd8ea23c3..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/sun/etc/ipsec.conf +++ /dev/null @@ -1,22 +0,0 @@ -# /etc/ipsec.conf - strongSwan IPsec configuration file - -config setup - -conn %default - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - keyexchange=ikev2 - mobike=no - -conn net-net - left=PH_IP_SUN - leftcert=sunCert.pem - leftid=@sun.strongswan.org - leftsubnet=0.0.0.0/0 - leftfirewall=yes - right=PH_IP_MOON - rightid=@moon.strongswan.org - rightsubnet=10.1.0.0/16 - auto=add diff --git a/testing/tests/pfkey/shunt-policies/hosts/sun/etc/strongswan.conf b/testing/tests/pfkey/shunt-policies/hosts/sun/etc/strongswan.conf deleted file mode 100644 index 902d83c69..000000000 --- a/testing/tests/pfkey/shunt-policies/hosts/sun/etc/strongswan.conf +++ /dev/null @@ -1,6 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - -charon { - load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-pfkey kernel-netlink socket-default updown - multiple_authentication = no -} diff --git a/testing/tests/pfkey/shunt-policies/posttest.dat b/testing/tests/pfkey/shunt-policies/posttest.dat deleted file mode 100644 index 837738fc6..000000000 --- a/testing/tests/pfkey/shunt-policies/posttest.dat +++ /dev/null @@ -1,5 +0,0 @@ -moon::ipsec stop -sun::ipsec stop -moon::iptables-restore < /etc/iptables.flush -sun::iptables-restore < /etc/iptables.flush - diff --git a/testing/tests/pfkey/shunt-policies/pretest.dat b/testing/tests/pfkey/shunt-policies/pretest.dat deleted file mode 100644 index c724e5df8..000000000 --- a/testing/tests/pfkey/shunt-policies/pretest.dat +++ /dev/null @@ -1,6 +0,0 @@ -moon::iptables-restore < /etc/iptables.rules -sun::iptables-restore < /etc/iptables.rules -moon::ipsec start -sun::ipsec start -moon::sleep 1 -moon::ipsec up net-net diff --git a/testing/tests/pfkey/shunt-policies/test.conf b/testing/tests/pfkey/shunt-policies/test.conf deleted file mode 100644 index 6b7432ca6..000000000 --- a/testing/tests/pfkey/shunt-policies/test.conf +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -# -# This configuration file provides information on the -# guest instances used for this test - -# All guest instances that are required for this test -# -VIRTHOSTS="alice moon winnetou sun bob" - -# Corresponding block diagram -# -DIAGRAM="a-v-m-w-s-b.png" - -# Guest instances on which tcpdump is to be started -# -TCPDUMPHOSTS="sun" - -# Guest instances on which IPsec is started -# Used for IPsec logging purposes -# -IPSECHOSTS="moon sun" -- cgit v1.2.3