From 19364e11c66714324bd3d5d0dc9212db397085cb Mon Sep 17 00:00:00 2001 From: Rene Mayrhofer Date: Sat, 28 Feb 2009 22:02:31 +0000 Subject: [svn-upgrade] Integrating new upstream version, strongswan (4.2.12) --- .../ikev1/attr-cert/hosts/moon/etc/strongswan.conf | 3 +++ testing/tests/ikev1/attr-cert/pretest.dat | 4 ++-- testing/tests/ikev2/config-payload/evaltest.dat | 2 ++ .../config-payload/hosts/moon/etc/strongswan.conf | 2 ++ testing/tests/ikev2/esp-alg-null/description.txt | 3 +++ testing/tests/ikev2/esp-alg-null/evaltest.dat | 7 ++++++ .../ikev2/esp-alg-null/hosts/carol/etc/ipsec.conf | 25 +++++++++++++++++++++ .../esp-alg-null/hosts/carol/etc/strongswan.conf | 5 +++++ .../ikev2/esp-alg-null/hosts/moon/etc/ipsec.conf | 24 ++++++++++++++++++++ .../esp-alg-null/hosts/moon/etc/strongswan.conf | 5 +++++ testing/tests/ikev2/esp-alg-null/posttest.dat | 4 ++++ testing/tests/ikev2/esp-alg-null/pretest.dat | 6 +++++ testing/tests/ikev2/esp-alg-null/test.conf | 21 +++++++++++++++++ testing/tests/ikev2/ip-pool-db/evaltest.dat | 6 ++--- .../ip-pool-db/hosts/moon/etc/strongswan.conf | 4 ++++ testing/tests/ikev2/ip-pool-db/posttest.dat | 2 +- testing/tests/ikev2/ip-pool-db/pretest.dat | 2 +- testing/tests/ikev2/ip-pool-wish/description.txt | 6 ++--- testing/tests/ikev2/ip-pool-wish/evaltest.dat | 2 +- .../ikev2/ip-pool-wish/hosts/carol/etc/ipsec.conf | 2 +- .../ikev2/ip-pool-wish/hosts/dave/etc/ipsec.conf | 2 +- testing/tests/ikev2/ip-pool-wish/pretest.dat | 6 ++--- testing/tests/ikev2/ip-pool/evaltest.dat | 3 +++ testing/tests/ikev2/ip-two-pools-db/evaltest.dat | 12 +++++----- .../ip-two-pools-db/hosts/moon/etc/strongswan.conf | 4 ++++ testing/tests/ikev2/ip-two-pools-db/posttest.dat | 4 ++-- testing/tests/ikev2/ip-two-pools-db/pretest.dat | 4 ++-- testing/tests/ikev2/ip-two-pools/evaltest.dat | 4 ++++ .../ikev2/mobike/hosts/alice/etc/init.d/iptables | 4 ++++ .../tests/ikev2/mobike/hosts/alice/etc/ipsec.conf | 1 - .../ikev2/rw-eap-mschapv2-rsa/description.txt | 8 +++++++ .../tests/ikev2/rw-eap-mschapv2-rsa/evaltest.dat | 11 +++++++++ .../rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.conf | 22 ++++++++++++++++++ .../hosts/carol/etc/ipsec.secrets | 3 +++ .../hosts/carol/etc/strongswan.conf | 5 +++++ .../rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.conf | 26 ++++++++++++++++++++++ .../hosts/moon/etc/ipsec.secrets | 5 +++++ .../hosts/moon/etc/strongswan.conf | 5 +++++ .../tests/ikev2/rw-eap-mschapv2-rsa/posttest.dat | 4 ++++ .../tests/ikev2/rw-eap-mschapv2-rsa/pretest.dat | 7 ++++++ testing/tests/ikev2/rw-eap-mschapv2-rsa/test.conf | 21 +++++++++++++++++ testing/tests/pfkey/esp-alg-null/description.txt | 3 +++ testing/tests/pfkey/esp-alg-null/evaltest.dat | 7 ++++++ .../pfkey/esp-alg-null/hosts/carol/etc/ipsec.conf | 25 +++++++++++++++++++++ .../esp-alg-null/hosts/carol/etc/strongswan.conf | 5 +++++ .../pfkey/esp-alg-null/hosts/moon/etc/ipsec.conf | 24 ++++++++++++++++++++ .../esp-alg-null/hosts/moon/etc/strongswan.conf | 5 +++++ testing/tests/pfkey/esp-alg-null/posttest.dat | 4 ++++ testing/tests/pfkey/esp-alg-null/pretest.dat | 6 +++++ testing/tests/pfkey/esp-alg-null/test.conf | 21 +++++++++++++++++ testing/tests/sql/ip-pool-db-expired/evaltest.dat | 6 ++--- .../hosts/moon/etc/strongswan.conf | 4 ++++ testing/tests/sql/ip-pool-db-expired/pretest.dat | 2 +- testing/tests/sql/ip-pool-db-restart/evaltest.dat | 6 ++--- .../hosts/moon/etc/strongswan.conf | 4 ++++ testing/tests/sql/ip-pool-db-restart/pretest.dat | 2 +- testing/tests/sql/ip-pool-db/evaltest.dat | 6 ++--- .../sql/ip-pool-db/hosts/moon/etc/strongswan.conf | 4 ++++ 58 files changed, 392 insertions(+), 38 deletions(-) create mode 100644 testing/tests/ikev1/attr-cert/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/ikev2/esp-alg-null/description.txt create mode 100644 testing/tests/ikev2/esp-alg-null/evaltest.dat create mode 100755 testing/tests/ikev2/esp-alg-null/hosts/carol/etc/ipsec.conf create mode 100644 testing/tests/ikev2/esp-alg-null/hosts/carol/etc/strongswan.conf create mode 100755 testing/tests/ikev2/esp-alg-null/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ikev2/esp-alg-null/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/ikev2/esp-alg-null/posttest.dat create mode 100644 testing/tests/ikev2/esp-alg-null/pretest.dat create mode 100644 testing/tests/ikev2/esp-alg-null/test.conf create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/description.txt create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/evaltest.dat create mode 100755 testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.conf create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/strongswan.conf create mode 100755 testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.secrets create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/posttest.dat create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/pretest.dat create mode 100644 testing/tests/ikev2/rw-eap-mschapv2-rsa/test.conf create mode 100644 testing/tests/pfkey/esp-alg-null/description.txt create mode 100644 testing/tests/pfkey/esp-alg-null/evaltest.dat create mode 100755 testing/tests/pfkey/esp-alg-null/hosts/carol/etc/ipsec.conf create mode 100644 testing/tests/pfkey/esp-alg-null/hosts/carol/etc/strongswan.conf create mode 100755 testing/tests/pfkey/esp-alg-null/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/pfkey/esp-alg-null/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/pfkey/esp-alg-null/posttest.dat create mode 100644 testing/tests/pfkey/esp-alg-null/pretest.dat create mode 100644 testing/tests/pfkey/esp-alg-null/test.conf (limited to 'testing/tests') diff --git a/testing/tests/ikev1/attr-cert/hosts/moon/etc/strongswan.conf b/testing/tests/ikev1/attr-cert/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..5a360543c --- /dev/null +++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/strongswan.conf @@ -0,0 +1,3 @@ +openac { + load = sha1 sha2 md5 gmp random x509 pubkey +} diff --git a/testing/tests/ikev1/attr-cert/pretest.dat b/testing/tests/ikev1/attr-cert/pretest.dat index b3fecaf3c..3c7fb5dc6 100644 --- a/testing/tests/ikev1/attr-cert/pretest.dat +++ b/testing/tests/ikev1/attr-cert/pretest.dat @@ -1,7 +1,7 @@ moon::echo 1 > /proc/sys/net/ipv4/ip_forward moon::cat /etc/openac/default.conf -moon::ipsec openac --optionsfrom default.conf --usercert /etc/openac/carolCert.pem --groups Research --out /etc/ipsec.d/acerts/carolAC.pem -moon::ipsec openac --optionsfrom default.conf --usercert /etc/openac/daveCert.pem --groups Accounting --out /etc/ipsec.d/acerts/daveAC.pem +moon::ipsec openac --optionsfrom default.conf --usercert /etc/openac/carolCert.pem --groups Research --out /etc/ipsec.d/acerts/carolAC.pem 2> /dev/null +moon::ipsec openac --optionsfrom default.conf --usercert /etc/openac/daveCert.pem --groups Accounting --out /etc/ipsec.d/acerts/daveAC.pem 2> /dev/null carol::ipsec start dave::ipsec start moon::ipsec start diff --git a/testing/tests/ikev2/config-payload/evaltest.dat b/testing/tests/ikev2/config-payload/evaltest.dat index 73d5ea206..40624e3ef 100644 --- a/testing/tests/ikev2/config-payload/evaltest.dat +++ b/testing/tests/ikev2/config-payload/evaltest.dat @@ -1,6 +1,8 @@ carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES carol::ip addr list dev eth0::PH_IP_CAROL1::YES carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES +carol::cat /etc/resolv.conf::nameserver PH_IP_WINNETOU::YES +carol::cat /etc/resolv.conf::nameserver PH_IP_VENUS::YES carol::ipsec status::home.*INSTALLED::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES dave::cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES diff --git a/testing/tests/ikev2/config-payload/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/config-payload/hosts/moon/etc/strongswan.conf index 40eb84b8a..9068f9dcf 100644 --- a/testing/tests/ikev2/config-payload/hosts/moon/etc/strongswan.conf +++ b/testing/tests/ikev2/config-payload/hosts/moon/etc/strongswan.conf @@ -2,4 +2,6 @@ charon { load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink updown + dns1 = PH_IP_WINNETOU + dns2 = PH_IP_VENUS } diff --git a/testing/tests/ikev2/esp-alg-null/description.txt b/testing/tests/ikev2/esp-alg-null/description.txt new file mode 100644 index 000000000..3f1b35e6c --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/description.txt @@ -0,0 +1,3 @@ +Roadwarrior carol proposes to gateway moon the ESP cipher suite +NULL/HMAC_SHA1_96 by defining esp=null-sha1 in ipsec.conf. +A ping from carol to alice successfully checks the established tunnel. diff --git a/testing/tests/ikev2/esp-alg-null/evaltest.dat b/testing/tests/ikev2/esp-alg-null/evaltest.dat new file mode 100644 index 000000000..dc50f11e0 --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/evaltest.dat @@ -0,0 +1,7 @@ +moon::ipsec statusall::rw.*INSTALLED::YES +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::NULL/HMAC_SHA1_96::YES +carol::ipsec statusall::NULL/HMAC_SHA1_96::YES +moon::ip xfrm state::enc ecb(cipher_null)::YES +carol::ip xfrm state::enc ecb(cipher_null)::YES +carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES diff --git a/testing/tests/ikev2/esp-alg-null/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/esp-alg-null/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..5640d74fc --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/hosts/carol/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + ike=aes128-sha1-modp2048! + esp=null-sha1! + +conn home + left=PH_IP_CAROL + leftfirewall=yes + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/ikev2/esp-alg-null/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/esp-alg-null/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..40eb84b8a --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/hosts/carol/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink updown +} diff --git a/testing/tests/ikev2/esp-alg-null/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/esp-alg-null/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..91f4a7c7f --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + ike=aes128-sha1-modp2048! + esp=null-sha1! + +conn rw + left=PH_IP_MOON + leftfirewall=yes + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/ikev2/esp-alg-null/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/esp-alg-null/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..40eb84b8a --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/hosts/moon/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink updown +} diff --git a/testing/tests/ikev2/esp-alg-null/posttest.dat b/testing/tests/ikev2/esp-alg-null/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/esp-alg-null/pretest.dat b/testing/tests/ikev2/esp-alg-null/pretest.dat new file mode 100644 index 000000000..f360351e1 --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home diff --git a/testing/tests/ikev2/esp-alg-null/test.conf b/testing/tests/ikev2/esp-alg-null/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/ikev2/esp-alg-null/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/ikev2/ip-pool-db/evaltest.dat b/testing/tests/ikev2/ip-pool-db/evaltest.dat index d12e10959..9ce2c44a8 100644 --- a/testing/tests/ikev2/ip-pool-db/evaltest.dat +++ b/testing/tests/ikev2/ip-pool-db/evaltest.dat @@ -11,9 +11,9 @@ dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::cat /var/log/daemon.log::peer requested virtual IP %any::YES moon::cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon::cat /var/log/daemon.log::assigning virtual IP::YES -moon::ipsec pool --status::bigpool.*10.3.0.1.*10.3.255.254.*static.*2::YES -moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,id=carol@strongswan.org::online::YES -moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,id=dave@strongswan.org::online::YES +moon::ipsec pool --status 2> /dev/null::bigpool.*10.3.0.1.*10.3.3.232.*static.*2::YES +moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,id=carol@strongswan.org 2> /dev/null::online::YES +moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,id=dave@strongswan.org 2> /dev/null::online::YES moon::ipsec status::rw.*ESTABLISHED.*carol@strongswan.org::YES moon::ipsec status::rw.*ESTABLISHED.*dave@strongswan.org::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/ip-pool-db/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/ip-pool-db/hosts/moon/etc/strongswan.conf index 0d900b871..b77ff97fb 100644 --- a/testing/tests/ikev2/ip-pool-db/hosts/moon/etc/strongswan.conf +++ b/testing/tests/ikev2/ip-pool-db/hosts/moon/etc/strongswan.conf @@ -8,3 +8,7 @@ charon { } load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink sqlite sql updown } + +pool { + load = sqlite +} diff --git a/testing/tests/ikev2/ip-pool-db/posttest.dat b/testing/tests/ikev2/ip-pool-db/posttest.dat index 5d26cbbbc..1505a77ba 100644 --- a/testing/tests/ikev2/ip-pool-db/posttest.dat +++ b/testing/tests/ikev2/ip-pool-db/posttest.dat @@ -4,5 +4,5 @@ dave::ipsec stop moon::/etc/init.d/iptables stop 2> /dev/null carol::/etc/init.d/iptables stop 2> /dev/null dave::/etc/init.d/iptables stop 2> /dev/null -moon::ipsec pool --del bigpool +moon::ipsec pool --del bigpool 2> /dev/null moon::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/ikev2/ip-pool-db/pretest.dat b/testing/tests/ikev2/ip-pool-db/pretest.dat index 78ba3f581..1765538a3 100644 --- a/testing/tests/ikev2/ip-pool-db/pretest.dat +++ b/testing/tests/ikev2/ip-pool-db/pretest.dat @@ -1,6 +1,6 @@ moon::cat /etc/ipsec.d/tables.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.255.254 --timeout 0 +moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2> /dev/null moon::/etc/init.d/iptables start 2> /dev/null carol::/etc/init.d/iptables start 2> /dev/null dave::/etc/init.d/iptables start 2> /dev/null diff --git a/testing/tests/ikev2/ip-pool-wish/description.txt b/testing/tests/ikev2/ip-pool-wish/description.txt index a5487169a..4b08aa33e 100644 --- a/testing/tests/ikev2/ip-pool-wish/description.txt +++ b/testing/tests/ikev2/ip-pool-wish/description.txt @@ -1,8 +1,8 @@ The roadwarriors carol and dave set up a connection each to gateway moon. Both carol and dave request the same virtual IP via the IKEv2 -configuration payload by using the leftsourceip=PH_IP_DAVE1 parameter. On a first-come, -first-served basis, dave gets PH_IP_DAVE1 from the simple address pool managed -by gateway moon and carol gets the first free address PH_IP_CAROL1 +configuration payload by using the leftsourceip=PH_IP_CAROL1 parameter. On a first-come, +first-served basis, carol gets PH_IP_CAROL1 from the simple address pool managed +by gateway moon and dave gets the next free address PH_IP_DAVE1 from the pool.

leftfirewall=yes automatically inserts iptables-based firewall rules that let pass diff --git a/testing/tests/ikev2/ip-pool-wish/evaltest.dat b/testing/tests/ikev2/ip-pool-wish/evaltest.dat index 19e6783af..d02d422ab 100644 --- a/testing/tests/ikev2/ip-pool-wish/evaltest.dat +++ b/testing/tests/ikev2/ip-pool-wish/evaltest.dat @@ -9,7 +9,7 @@ dave::ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES dave::ipsec status::home.*INSTALLED::YES dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::cat /var/log/daemon.log::adding virtual IP address pool::YES -moon::cat /var/log/daemon.log::peer requested virtual IP PH_IP_DAVE1::YES +moon::cat /var/log/daemon.log::peer requested virtual IP PH_IP_CAROL1::YES moon::cat /var/log/daemon.log::assigning virtual IP::YES moon::ipsec status::rw.*ESTABLISHED.*carol@strongswan.org::YES moon::ipsec status::rw.*ESTABLISHED.*dave@strongswan.org::YES diff --git a/testing/tests/ikev2/ip-pool-wish/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ip-pool-wish/hosts/carol/etc/ipsec.conf index 5f93b3987..c9867c7d4 100755 --- a/testing/tests/ikev2/ip-pool-wish/hosts/carol/etc/ipsec.conf +++ b/testing/tests/ikev2/ip-pool-wish/hosts/carol/etc/ipsec.conf @@ -14,7 +14,7 @@ conn %default conn home left=PH_IP_CAROL - leftsourceip=PH_IP_DAVE1 + leftsourceip=PH_IP_CAROL1 leftcert=carolCert.pem leftid=carol@strongswan.org leftfirewall=yes diff --git a/testing/tests/ikev2/ip-pool-wish/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/ip-pool-wish/hosts/dave/etc/ipsec.conf index b58ba5460..98dd99271 100755 --- a/testing/tests/ikev2/ip-pool-wish/hosts/dave/etc/ipsec.conf +++ b/testing/tests/ikev2/ip-pool-wish/hosts/dave/etc/ipsec.conf @@ -14,7 +14,7 @@ conn %default conn home left=PH_IP_DAVE - leftsourceip=PH_IP_DAVE1 + leftsourceip=PH_IP_CAROL1 leftcert=daveCert.pem leftid=dave@strongswan.org leftfirewall=yes diff --git a/testing/tests/ikev2/ip-pool-wish/pretest.dat b/testing/tests/ikev2/ip-pool-wish/pretest.dat index 519c81a31..1f4ff286a 100644 --- a/testing/tests/ikev2/ip-pool-wish/pretest.dat +++ b/testing/tests/ikev2/ip-pool-wish/pretest.dat @@ -1,10 +1,10 @@ moon::/etc/init.d/iptables start 2> /dev/null carol::/etc/init.d/iptables start 2> /dev/null dave::/etc/init.d/iptables start 2> /dev/null -dave::ipsec start carol::ipsec start +dave::ipsec start moon::ipsec start -dave::sleep 2 -dave::ipsec up home +carol::sleep 2 carol::ipsec up home +dave::ipsec up home dave::sleep 1 diff --git a/testing/tests/ikev2/ip-pool/evaltest.dat b/testing/tests/ikev2/ip-pool/evaltest.dat index 15ca7426f..b130d4565 100644 --- a/testing/tests/ikev2/ip-pool/evaltest.dat +++ b/testing/tests/ikev2/ip-pool/evaltest.dat @@ -11,6 +11,9 @@ dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::cat /var/log/daemon.log::adding virtual IP address pool::YES moon::cat /var/log/daemon.log::peer requested virtual IP %any::YES moon::cat /var/log/daemon.log::assigning virtual IP::YES +moon::ipsec leases rw::2/15, 2 online::YES +moon::ipsec leases rw 10.3.0.1::carol@strongswan.org::YES +moon::ipsec leases rw 10.3.0.2::dave@strongswan.org::YES moon::ipsec status::rw.*ESTABLISHED.*carol@strongswan.org::YES moon::ipsec status::rw.*ESTABLISHED.*dave@strongswan.org::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/ikev2/ip-two-pools-db/evaltest.dat b/testing/tests/ikev2/ip-two-pools-db/evaltest.dat index 74c967def..c2bd87c58 100644 --- a/testing/tests/ikev2/ip-two-pools-db/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/evaltest.dat @@ -6,12 +6,12 @@ moon::ipsec status::ext.*ESTABLISHED.*carol@strongswan.org::YES moon::ipsec status::ext.*ESTABLISHED.*dave@strongswan.org::YES moon::ipsec status::int.*ESTABLISHED.*alice@strongswan.org::YES moon::ipsec status::int.*ESTABLISHED.*venus.strongswan.org::YES -moon::ipsec pool --status::extpool.*10.3.0.1.*10.3.255.254.*48h.*2::YES -moon::ipsec pool --status::intpool.*10.4.0.1.*10.4.255.254.*static.*2::YES -moon::ipsec pool --leases --filter pool=extpool,addr=10.3.0.1,id=carol@strongswan.org::online::YES -moon::ipsec pool --leases --filter pool=extpool,addr=10.3.0.2,id=dave@strongswan.org::online::YES -moon::ipsec pool --leases --filter pool=intpool,addr=10.4.0.1,id=alice@strongswan.org::online::YES -moon::ipsec pool --leases --filter pool=intpool,addr=10.4.0.2,id=venus.strongswan.org::online::YES +moon::ipsec pool --status 2> /dev/null::extpool.*10.3.0.1.*10.3.1.244.*48h.*2::YES +moon::ipsec pool --status 2> /dev/null::intpool.*10.4.0.1.*10.4.1.244.*static.*2::YES +moon::ipsec pool --leases --filter pool=extpool,addr=10.3.0.1,id=carol@strongswan.org 2> /dev/null::online::YES +moon::ipsec pool --leases --filter pool=extpool,addr=10.3.0.2,id=dave@strongswan.org 2> /dev/null::online::YES +moon::ipsec pool --leases --filter pool=intpool,addr=10.4.0.1,id=alice@strongswan.org 2> /dev/null::online::YES +moon::ipsec pool --leases --filter pool=intpool,addr=10.4.0.2,id=venus.strongswan.org 2> /dev/null::online::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES dave::cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/strongswan.conf index 7a9cd5311..1b5257ccc 100644 --- a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/strongswan.conf +++ b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/strongswan.conf @@ -8,3 +8,7 @@ charon { } load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke sqlite sql kernel-netlink updown } + +pool { + load = sqlite +} diff --git a/testing/tests/ikev2/ip-two-pools-db/posttest.dat b/testing/tests/ikev2/ip-two-pools-db/posttest.dat index 5ea5128ce..17901fa15 100644 --- a/testing/tests/ikev2/ip-two-pools-db/posttest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/posttest.dat @@ -11,6 +11,6 @@ dave::/etc/init.d/iptables stop 2> /dev/null moon::ip route del 10.3.0.0/16 via PH_IP_MOON moon::ip route del 10.4.0.0/16 via PH_IP_MOON1 moon::conntrack -F -moon::ipsec pool --del extpool -moon::ipsec pool --del intpool +moon::ipsec pool --del extpool 2> /dev/null +moon::ipsec pool --del intpool 2> /dev/null moon::rm /etc/ipsec.d/ipsec.* diff --git a/testing/tests/ikev2/ip-two-pools-db/pretest.dat b/testing/tests/ikev2/ip-two-pools-db/pretest.dat index 3870a2919..fa7c122d9 100644 --- a/testing/tests/ikev2/ip-two-pools-db/pretest.dat +++ b/testing/tests/ikev2/ip-two-pools-db/pretest.dat @@ -1,7 +1,7 @@ moon::cat /etc/ipsec.d/tables.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::ipsec pool --add extpool --start 10.3.0.1 --end 10.3.255.254 --timeout 48 -moon::ipsec pool --add intpool --start 10.4.0.1 --end 10.4.255.254 --timeout 0 +moon::ipsec pool --add extpool --start 10.3.0.1 --end 10.3.1.244 --timeout 48 2> /dev/null +moon::ipsec pool --add intpool --start 10.4.0.1 --end 10.4.1.244 --timeout 0 2> /dev/null moon::ip route add 10.3.0.0/16 via PH_IP_MOON moon::ip route add 10.4.0.0/16 via PH_IP_MOON1 alice::/etc/init.d/iptables start 2> /dev/null diff --git a/testing/tests/ikev2/ip-two-pools/evaltest.dat b/testing/tests/ikev2/ip-two-pools/evaltest.dat index 479a3ae3d..ac0a3eeb3 100644 --- a/testing/tests/ikev2/ip-two-pools/evaltest.dat +++ b/testing/tests/ikev2/ip-two-pools/evaltest.dat @@ -4,6 +4,10 @@ moon::ipsec status::ext.*ESTABLISHED.*carol@strongswan.org::YES moon::ipsec status::int.*ESTABLISHED.*alice@strongswan.org::YES moon::cat /var/log/daemon.log::adding virtual IP address pool.*int.*10.4.0.0/28::YES moon::cat /var/log/daemon.log::adding virtual IP address pool.*ext.*10.3.0.0/28::YES +moon::ipsec leases ext::1/15, 1 online::YES +moon::ipsec leases int::1/15, 1 online::YES +moon::ipsec leases ext 10.3.0.1::carol@strongswan.org::YES +moon::ipsec leases int 10.4.0.1::alice@strongswan.org::YES carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables index db18182a3..cf0d65c58 100755 --- a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables +++ b/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables @@ -17,6 +17,10 @@ start() { /sbin/iptables -P OUTPUT DROP /sbin/iptables -P FORWARD DROP + # allow IPsec tunnel traffic + iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT + iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT + # allow esp iptables -A INPUT -i eth0 -p 50 -j ACCEPT iptables -A INPUT -i eth1 -p 50 -j ACCEPT diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf index 37e92cf5b..6c87468bb 100755 --- a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf +++ b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf @@ -16,7 +16,6 @@ conn mobike left=PH_IP_ALICE1 leftcert=aliceCert.pem leftid=alice@strongswan.org - leftfirewall=yes right=PH_IP_SUN rightid=@sun.strongswan.org rightsubnet=10.2.0.0/16 diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/description.txt b/testing/tests/ikev2/rw-eap-mschapv2-rsa/description.txt new file mode 100644 index 000000000..df7041a97 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/description.txt @@ -0,0 +1,8 @@ +The roadwarrior carol sets up a connection to gateway moon. +carol uses the Extensible Authentication Protocol +in association with the Microsoft CHAP version 2 protocol +(EAP-MSCHAPV2) to authenticate against the gateway. This protocol is used +e.g. by the Windows 7 Agile VPN client. +In addition to her IKEv2 identity PH_IP_CAROL, roadwarrior carol +uses the EAP identy carol. Gateway moon additionaly uses an RSA signature +to authenticate itself against carol. diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-mschapv2-rsa/evaltest.dat new file mode 100644 index 000000000..d8708d122 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/evaltest.dat @@ -0,0 +1,11 @@ +carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES +carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES +moon::cat /var/log/daemon.log::using EAP identity.*carol::YES +moon::cat /var/log/daemon.log::authentication of 'PH_IP_CAROL' with EAP successful::YES +moon::ipsec statusall::rw-eap.*ESTABLISHED::YES +carol::ipsec statusall::home.*ESTABLISHED::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES + + diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..ec09a3375 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.conf @@ -0,0 +1,22 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=eap + +conn home + left=PH_IP_CAROL + leftnexthop=%direct + leftfirewall=yes + eap_identity=carol + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=10.1.0.0/16 + auto=add diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.secrets new file mode 100644 index 000000000..44ba3fa25 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/ipsec.secrets @@ -0,0 +1,3 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +carol : EAP "Ar3etTnp01qlpOgb" diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..26ccc84ce --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/carol/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md4 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink fips-prf eapmschapv2 eapidentity updown +} diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..57a89966a --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.conf @@ -0,0 +1,26 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + strictcrlpolicy=no + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + +conn rw-eap + authby=rsasig + eap=mschapv2 + eap_identity=%identity + left=PH_IP_MOON + leftsubnet=10.1.0.0/16 + leftid=@moon.strongswan.org + leftcert=moonCert.pem + leftfirewall=yes + rightid=%any + rightsendcert=never + right=%any + auto=add diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.secrets new file mode 100644 index 000000000..3868b62f4 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/ipsec.secrets @@ -0,0 +1,5 @@ +# /etc/ipsec.secrets - strongSwan IPsec secrets file + +: RSA moonKey.pem + +carol : EAP "Ar3etTnp01qlpOgb" diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..26ccc84ce --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/hosts/moon/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md4 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink fips-prf eapmschapv2 eapidentity updown +} diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-mschapv2-rsa/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-mschapv2-rsa/pretest.dat new file mode 100644 index 000000000..ed5498bfe --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/pretest.dat @@ -0,0 +1,7 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home +carol::sleep 1 diff --git a/testing/tests/ikev2/rw-eap-mschapv2-rsa/test.conf b/testing/tests/ikev2/rw-eap-mschapv2-rsa/test.conf new file mode 100644 index 000000000..2bd21499b --- /dev/null +++ b/testing/tests/ikev2/rw-eap-mschapv2-rsa/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice carol moon" + +# Corresponding block diagram +# +DIAGRAM="a-m-c.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/pfkey/esp-alg-null/description.txt b/testing/tests/pfkey/esp-alg-null/description.txt new file mode 100644 index 000000000..3f1b35e6c --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/description.txt @@ -0,0 +1,3 @@ +Roadwarrior carol proposes to gateway moon the ESP cipher suite +NULL/HMAC_SHA1_96 by defining esp=null-sha1 in ipsec.conf. +A ping from carol to alice successfully checks the established tunnel. diff --git a/testing/tests/pfkey/esp-alg-null/evaltest.dat b/testing/tests/pfkey/esp-alg-null/evaltest.dat new file mode 100644 index 000000000..dc50f11e0 --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/evaltest.dat @@ -0,0 +1,7 @@ +moon::ipsec statusall::rw.*INSTALLED::YES +carol::ipsec statusall::home.*INSTALLED::YES +moon::ipsec statusall::NULL/HMAC_SHA1_96::YES +carol::ipsec statusall::NULL/HMAC_SHA1_96::YES +moon::ip xfrm state::enc ecb(cipher_null)::YES +carol::ip xfrm state::enc ecb(cipher_null)::YES +carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES diff --git a/testing/tests/pfkey/esp-alg-null/hosts/carol/etc/ipsec.conf b/testing/tests/pfkey/esp-alg-null/hosts/carol/etc/ipsec.conf new file mode 100755 index 000000000..5640d74fc --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/hosts/carol/etc/ipsec.conf @@ -0,0 +1,25 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + ike=aes128-sha1-modp2048! + esp=null-sha1! + +conn home + left=PH_IP_CAROL + leftfirewall=yes + leftcert=carolCert.pem + leftid=carol@strongswan.org + right=PH_IP_MOON + rightsubnet=10.1.0.0/16 + rightid=@moon.strongswan.org + auto=add diff --git a/testing/tests/pfkey/esp-alg-null/hosts/carol/etc/strongswan.conf b/testing/tests/pfkey/esp-alg-null/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..db6fa7486 --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/hosts/carol/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-pfkey kernel-netlink updown +} diff --git a/testing/tests/pfkey/esp-alg-null/hosts/moon/etc/ipsec.conf b/testing/tests/pfkey/esp-alg-null/hosts/moon/etc/ipsec.conf new file mode 100755 index 000000000..91f4a7c7f --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/hosts/moon/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + crlcheckinterval=180 + strictcrlpolicy=yes + plutostart=no + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + ike=aes128-sha1-modp2048! + esp=null-sha1! + +conn rw + left=PH_IP_MOON + leftfirewall=yes + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16 + right=%any + auto=add diff --git a/testing/tests/pfkey/esp-alg-null/hosts/moon/etc/strongswan.conf b/testing/tests/pfkey/esp-alg-null/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..db6fa7486 --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/hosts/moon/etc/strongswan.conf @@ -0,0 +1,5 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-pfkey kernel-netlink updown +} diff --git a/testing/tests/pfkey/esp-alg-null/posttest.dat b/testing/tests/pfkey/esp-alg-null/posttest.dat new file mode 100644 index 000000000..94a400606 --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/posttest.dat @@ -0,0 +1,4 @@ +moon::ipsec stop +carol::ipsec stop +moon::/etc/init.d/iptables stop 2> /dev/null +carol::/etc/init.d/iptables stop 2> /dev/null diff --git a/testing/tests/pfkey/esp-alg-null/pretest.dat b/testing/tests/pfkey/esp-alg-null/pretest.dat new file mode 100644 index 000000000..f360351e1 --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/pretest.dat @@ -0,0 +1,6 @@ +moon::/etc/init.d/iptables start 2> /dev/null +carol::/etc/init.d/iptables start 2> /dev/null +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home diff --git a/testing/tests/pfkey/esp-alg-null/test.conf b/testing/tests/pfkey/esp-alg-null/test.conf new file mode 100644 index 000000000..2b240d895 --- /dev/null +++ b/testing/tests/pfkey/esp-alg-null/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="m-c-w.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" diff --git a/testing/tests/sql/ip-pool-db-expired/evaltest.dat b/testing/tests/sql/ip-pool-db-expired/evaltest.dat index 91dd9dff6..9633fde10 100644 --- a/testing/tests/sql/ip-pool-db-expired/evaltest.dat +++ b/testing/tests/sql/ip-pool-db-expired/evaltest.dat @@ -11,9 +11,9 @@ dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::cat /var/log/daemon.log::peer requested virtual IP %any::YES moon::cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon::cat /var/log/daemon.log::assigning virtual IP::YES -moon::ipsec pool --status::bigpool.*10.3.0.1.*10.3.0.6.*1h.*2::YES -moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,id=carol@strongswan.org::online::YES -moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,id=dave@strongswan.org::online::YES +moon::ipsec pool --status 2> /dev/null::bigpool.*10.3.0.1.*10.3.0.6.*1h.*2::YES +moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,id=carol@strongswan.org 2> /dev/null::online::YES +moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,id=dave@strongswan.org 2> /dev/null::online::YES moon::ipsec status::rw.*ESTABLISHED.*carol@strongswan.org::YES moon::ipsec status::rw.*ESTABLISHED.*dave@strongswan.org::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/ip-pool-db-expired/hosts/moon/etc/strongswan.conf b/testing/tests/sql/ip-pool-db-expired/hosts/moon/etc/strongswan.conf index 29e2395e8..a747a6cb1 100644 --- a/testing/tests/sql/ip-pool-db-expired/hosts/moon/etc/strongswan.conf +++ b/testing/tests/sql/ip-pool-db-expired/hosts/moon/etc/strongswan.conf @@ -8,3 +8,7 @@ charon { } load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink updown sqlite sql } + +pool { + load = sqlite +} diff --git a/testing/tests/sql/ip-pool-db-expired/pretest.dat b/testing/tests/sql/ip-pool-db-expired/pretest.dat index c83449eaf..4df33509f 100644 --- a/testing/tests/sql/ip-pool-db-expired/pretest.dat +++ b/testing/tests/sql/ip-pool-db-expired/pretest.dat @@ -7,7 +7,7 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::ipsec pool --leases +moon::ipsec pool --leases 2> /dev/null moon::/etc/init.d/iptables start 2> /dev/null carol::/etc/init.d/iptables start 2> /dev/null dave::/etc/init.d/iptables start 2> /dev/null diff --git a/testing/tests/sql/ip-pool-db-restart/evaltest.dat b/testing/tests/sql/ip-pool-db-restart/evaltest.dat index 7a33cb6ba..f4c713c9f 100644 --- a/testing/tests/sql/ip-pool-db-restart/evaltest.dat +++ b/testing/tests/sql/ip-pool-db-restart/evaltest.dat @@ -11,9 +11,9 @@ dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::cat /var/log/daemon.log::peer requested virtual IP %any::YES moon::cat /var/log/daemon.log::acquired existing lease for address.*in pool.*bigpool::YES moon::cat /var/log/daemon.log::assigning virtual IP::YES -moon::ipsec pool --status::bigpool.*10.3.0.1.*10.3.0.6.*static.*2::YES -moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,id=carol@strongswan.org::online::YES -moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,id=dave@strongswan.org::online::YES +moon::ipsec pool --status 2> /dev/null::bigpool.*10.3.0.1.*10.3.0.6.*static.*2::YES +moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,id=carol@strongswan.org 2> /dev/null::online::YES +moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,id=dave@strongswan.org 2> /dev/null::online::YES moon::ipsec status::rw.*ESTABLISHED.*carol@strongswan.org::YES moon::ipsec status::rw.*ESTABLISHED.*dave@strongswan.org::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/ip-pool-db-restart/hosts/moon/etc/strongswan.conf b/testing/tests/sql/ip-pool-db-restart/hosts/moon/etc/strongswan.conf index 29e2395e8..a747a6cb1 100644 --- a/testing/tests/sql/ip-pool-db-restart/hosts/moon/etc/strongswan.conf +++ b/testing/tests/sql/ip-pool-db-restart/hosts/moon/etc/strongswan.conf @@ -8,3 +8,7 @@ charon { } load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink updown sqlite sql } + +pool { + load = sqlite +} diff --git a/testing/tests/sql/ip-pool-db-restart/pretest.dat b/testing/tests/sql/ip-pool-db-restart/pretest.dat index 4ecf6347a..1d64321b5 100644 --- a/testing/tests/sql/ip-pool-db-restart/pretest.dat +++ b/testing/tests/sql/ip-pool-db-restart/pretest.dat @@ -7,7 +7,7 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db -moon::ipsec pool --leases +moon::ipsec pool --leases 2> /dev/null moon::/etc/init.d/iptables start 2> /dev/null carol::/etc/init.d/iptables start 2> /dev/null dave::/etc/init.d/iptables start 2> /dev/null diff --git a/testing/tests/sql/ip-pool-db/evaltest.dat b/testing/tests/sql/ip-pool-db/evaltest.dat index 0aeeff9c8..49051ed22 100644 --- a/testing/tests/sql/ip-pool-db/evaltest.dat +++ b/testing/tests/sql/ip-pool-db/evaltest.dat @@ -11,9 +11,9 @@ dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES moon::cat /var/log/daemon.log::peer requested virtual IP %any::YES moon::cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES moon::cat /var/log/daemon.log::assigning virtual IP::YES -moon::ipsec pool --status::bigpool.*10.3.0.1.*10.3.0.6.*static.*2::YES -moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,id=carol@strongswan.org::online::YES -moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,id=dave@strongswan.org::online::YES +moon::ipsec pool --status 2> /dev/null::bigpool.*10.3.0.1.*10.3.0.6.*static.*2::YES +moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.1,id=carol@strongswan.org 2> /dev/null::online::YES +moon::ipsec pool --leases --filter pool=bigpool,addr=10.3.0.2,id=dave@strongswan.org 2> /dev/null::online::YES moon::ipsec status::rw.*ESTABLISHED.*carol@strongswan.org::YES moon::ipsec status::rw.*ESTABLISHED.*dave@strongswan.org::YES moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES diff --git a/testing/tests/sql/ip-pool-db/hosts/moon/etc/strongswan.conf b/testing/tests/sql/ip-pool-db/hosts/moon/etc/strongswan.conf index 29e2395e8..a747a6cb1 100644 --- a/testing/tests/sql/ip-pool-db/hosts/moon/etc/strongswan.conf +++ b/testing/tests/sql/ip-pool-db/hosts/moon/etc/strongswan.conf @@ -8,3 +8,7 @@ charon { } load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke kernel-netlink updown sqlite sql } + +pool { + load = sqlite +} -- cgit v1.2.3