expanded ikev2/ip-two-pools-db to a spoke-to-hub network using virtual IP addresses
authorAndreas Steffen <andreas.steffen@strongswan.org>
Fri, 11 Jul 2008 15:24:02 +0000 (15:24 -0000)
committerAndreas Steffen <andreas.steffen@strongswan.org>
Fri, 11 Jul 2008 15:24:02 +0000 (15:24 -0000)
13 files changed:
testing/tests/ikev2/ip-two-pools-db/description.txt
testing/tests/ikev2/ip-two-pools-db/evaltest.dat
testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/ipsec.conf
testing/tests/ikev2/ip-two-pools-db/hosts/carol/etc/ipsec.conf
testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/ipsec.conf [new file with mode: 0755]
testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/strongswan.conf [new file with mode: 0644]
testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/ipsec.conf
testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables [new file with mode: 0755]
testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/ipsec.conf [new file with mode: 0755]
testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/strongswan.conf [new file with mode: 0644]
testing/tests/ikev2/ip-two-pools-db/posttest.dat
testing/tests/ikev2/ip-two-pools-db/pretest.dat
testing/tests/ikev2/ip-two-pools-db/test.conf

index d9abd8e..6f36d12 100644 (file)
@@ -1,9 +1,14 @@
-The hosts <b>alice</b> and <b>carol</b> set up a tunnel connection each to gateway <b>moon</b>.
-Both hosts request a <b>virtual IP</b> via the IKEv2 configuration payload by using the
-<b>leftsourceip=%config</b> parameter. Gateway <b>moon</b> assigns virtual IP
-addresses from a pool named <b>extpool</b> [10.3.0.1..10.3.255.254] to hosts connecting
+The hosts <b>alice</b>, <b>venus</b>, <b>carol</b>, and <b>dave</b> set up tunnel connections
+to gateway <b>moon</b> in a spoke-to-hub fashion. Each host requests a <b>virtual IP</b> 
+with the <b>leftsourceip=%config</b> parameter. Gateway <b>moon</b> assigns virtual
+IP addresses from a pool named <b>extpool</b> [10.3.0.1..10.3.255.254] to hosts connecting
 to the <b>eth0</b> (PH_IP_MOON) interface and virtual IP addresses from a pool named <b>intpool</b>
 [10.4.0.1..10.4.255.254] to hosts connecting to the <b>eth1</b> (PH_IP_MOON1) interface.
-<p>
-Thus <b>carol</b> is assigned <b>PH_IP_CAROL1</b> whereas <b>alice</b> gets <b>10.4.0.1</b> and 
-both ping the gateway <b>moon</b>.
+Thus <b>carol</b> and <b>dave</b> are assigned <b>PH_IP_CAROL1</b> and <b>PH_IP_DAVE1</b>,
+respectively, whereas <b>alice</b> and <b>venus</b> get <b>10.4.0.1</b> and <b>10.4.0.2</b>,
+respectively.
+<p> 
+By defining the composite IPsec SA: <b>rightsubnet=10.3.0.0/16,10.4.0.0/16</b>, each of the four
+hosts can securely reach any other host via the central hub <b>moon</b>. This is
+demonstrated by <b>alice</b> and <b>dave</b> pinging the assigned virtual IP addresses
+of <b>carol</b> and <b>venus</b>.
index 0ea87ae..74c967d 100644 (file)
@@ -1,14 +1,31 @@
 carol::ipsec status::home.*INSTALLED::YES
+dave::ipsec status::home.*INSTALLED::YES
 alice::ipsec status::home.*INSTALLED::YES
+venus::ipsec status::home.*INSTALLED::YES
 moon::ipsec status::ext.*ESTABLISHED.*carol@strongswan.org::YES
+moon::ipsec status::ext.*ESTABLISHED.*dave@strongswan.org::YES
 moon::ipsec status::int.*ESTABLISHED.*alice@strongswan.org::YES
-moon::ipsec pool --status::extpool.*10.3.0.1.*10.3.255.254.*48h.*1::YES
-moon::ipsec pool --status::intpool.*10.4.0.1.*10.4.255.254.*static.*1::YES
+moon::ipsec status::int.*ESTABLISHED.*venus.strongswan.org::YES
+moon::ipsec pool --status::extpool.*10.3.0.1.*10.3.255.254.*48h.*2::YES
+moon::ipsec pool --status::intpool.*10.4.0.1.*10.4.255.254.*static.*2::YES
 moon::ipsec pool --leases --filter pool=extpool,addr=10.3.0.1,id=carol@strongswan.org::online::YES
+moon::ipsec pool --leases --filter pool=extpool,addr=10.3.0.2,id=dave@strongswan.org::online::YES
 moon::ipsec pool --leases --filter pool=intpool,addr=10.4.0.1,id=alice@strongswan.org::online::YES
-carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
-carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::ipsec pool --leases --filter pool=intpool,addr=10.4.0.2,id=venus.strongswan.org::online::YES
+carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
+dave::cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES
+alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES
+venus::cat /var/log/daemon.log::installing new virtual IP 10.4.0.2::YES
+alice::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES
+alice::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_seq=1::YES
+dave::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_seq=1::YES
 alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES
 alice::tcpdump::IP moon1.strongswan.org > alice.strongswan.org: ESP::YES
+dave::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+dave::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+venus::tcpdump::IP moon1.strongswan.org > venus.strongswan.org: ESP::YES
+venus::tcpdump::IP venus.strongswan.org > moon1.strongswan.org: ESP::YES
+
index f5ce168..d925a25 100755 (executable)
@@ -20,4 +20,5 @@ conn home
        leftfirewall=yes
        right=PH_IP_MOON1
        rightid=@moon.strongswan.org
+       rightsubnet=10.3.0.0/16,10.4.0.0/16
        auto=add
index e647f1e..2b673ec 100755 (executable)
@@ -20,4 +20,5 @@ conn home
        leftfirewall=yes
        right=PH_IP_MOON
        rightid=@moon.strongswan.org
+       rightsubnet=10.3.0.0/16,10.4.0.0/16
        auto=add
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/ipsec.conf
new file mode 100755 (executable)
index 0000000..22f9b66
--- /dev/null
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+       crlcheckinterval=180
+       strictcrlpolicy=no
+       plutostart=no
+
+conn %default
+       ikelifetime=60m
+       keylife=20m
+       rekeymargin=3m
+       keyingtries=1
+       keyexchange=ikev2
+
+conn home
+       left=PH_IP_DAVE
+       leftsourceip=%config
+       leftcert=daveCert.pem
+       leftid=dave@strongswan.org
+       leftfirewall=yes
+       right=PH_IP_MOON
+       rightid=@moon.strongswan.org
+       rightsubnet=10.3.0.0/16,10.4.0.0/16
+       auto=add
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/strongswan.conf b/testing/tests/ikev2/ip-two-pools-db/hosts/dave/etc/strongswan.conf
new file mode 100644 (file)
index 0000000..ca22de6
--- /dev/null
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke
+}
index 2a8c8e1..a4c37e1 100755 (executable)
@@ -18,10 +18,12 @@ conn %default
 
 conn int 
        left=PH_IP_MOON1
+       leftsubnet=10.3.0.0/16,10.4.0.0/16
        rightsourceip=%intpool
        auto=add
 
 conn ext 
        left=PH_IP_MOON
+       leftsubnet=10.3.0.0/16,10.4.0.0/16
        rightsourceip=%extpool
        auto=add
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables
new file mode 100755 (executable)
index 0000000..97b7736
--- /dev/null
@@ -0,0 +1,78 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+       before net
+       need logger
+}
+
+start() {
+       ebegin "Starting firewall"
+
+       # default policy is DROP
+       /sbin/iptables -P INPUT DROP
+       /sbin/iptables -P OUTPUT DROP
+       /sbin/iptables -P FORWARD DROP
+
+        # allow ESP 
+        iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+        iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+       # allow IKE
+        iptables -A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+        iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+                       
+       # allow MOBIKE 
+       iptables -A INPUT  -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+
+       # allow crl fetch from winnetou
+       iptables -A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+       # allow ssh
+       iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+       iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+       eend $?
+}
+
+stop() {
+       ebegin "Stopping firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+       
+                       if [ $a == nat ]; then
+                               /sbin/iptables -t nat -P PREROUTING ACCEPT
+                               /sbin/iptables -t nat -P POSTROUTING ACCEPT
+                               /sbin/iptables -t nat -P OUTPUT ACCEPT
+                       elif [ $a == mangle ]; then
+                               /sbin/iptables -t mangle -P PREROUTING ACCEPT
+                               /sbin/iptables -t mangle -P INPUT ACCEPT
+                               /sbin/iptables -t mangle -P FORWARD ACCEPT
+                               /sbin/iptables -t mangle -P OUTPUT ACCEPT
+                               /sbin/iptables -t mangle -P POSTROUTING ACCEPT
+                       elif [ $a == filter ]; then
+                               /sbin/iptables -t filter -P INPUT ACCEPT
+                               /sbin/iptables -t filter -P FORWARD ACCEPT
+                               /sbin/iptables -t filter -P OUTPUT ACCEPT
+                       fi
+               done
+       eend $?
+}
+
+reload() {
+       ebegin "Flushing firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+               done;
+        eend $?
+       start
+}
+
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/ipsec.conf b/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/ipsec.conf
new file mode 100755 (executable)
index 0000000..2dbd84f
--- /dev/null
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+       strictcrlpolicy=no
+       plutostart=no
+
+conn %default
+       ikelifetime=60m
+       keylife=20m
+       rekeymargin=3m
+       keyingtries=1
+       keyexchange=ikev2
+               
+conn home 
+       left=%defaultroute
+       leftsourceip=%config
+       leftcert=venusCert.pem
+       leftid=@venus.strongswan.org
+       leftfirewall=yes
+       right=PH_IP_MOON1
+       rightid=@moon.strongswan.org
+       rightsubnet=10.3.0.0/16,10.4.0.0/16
+       auto=add
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/strongswan.conf b/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/strongswan.conf
new file mode 100644 (file)
index 0000000..ca22de6
--- /dev/null
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 gmp random x509 pubkey hmac xcbc stroke
+}
index dc2ece7..5ea5128 100644 (file)
@@ -1,9 +1,15 @@
 alice::ipsec stop
+venus::ipsec stop
 moon::ipsec stop
 carol::ipsec stop
+dave::ipsec stop
+alice::/etc/init.d/iptables stop 2> /dev/null
+venus::/etc/init.d/iptables stop 2> /dev/null
 moon::/etc/init.d/iptables stop 2> /dev/null
 carol::/etc/init.d/iptables stop 2> /dev/null
-alice::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+moon::ip route del 10.3.0.0/16 via PH_IP_MOON
+moon::ip route del 10.4.0.0/16 via PH_IP_MOON1
 moon::conntrack -F
 moon::ipsec pool --del extpool
 moon::ipsec pool --del intpool
index 6d72cf8..3870a29 100644 (file)
@@ -2,13 +2,21 @@ moon::cat /etc/ipsec.d/tables.sql > /etc/ipsec.d/ipsec.sql
 moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
 moon::ipsec pool --add extpool --start 10.3.0.1 --end 10.3.255.254 --timeout 48 
 moon::ipsec pool --add intpool --start 10.4.0.1 --end 10.4.255.254 --timeout  0
+moon::ip route add 10.3.0.0/16 via PH_IP_MOON
+moon::ip route add 10.4.0.0/16 via PH_IP_MOON1
+alice::/etc/init.d/iptables start 2> /dev/null
+venus::/etc/init.d/iptables start 2> /dev/null
 moon::/etc/init.d/iptables start 2> /dev/null
 carol::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+alice::ipsec start
+venus::ipsec start
 carol::ipsec start
+dave::ipsec start
 moon::ipsec start
-alice::ipsec start
 carol::sleep 2 
 carol::ipsec up home
+dave::ipsec up home
 alice::ipsec up home
+venus::ipsec up home
 alice::sleep 1
index 329774c..ea1307b 100644 (file)
@@ -5,17 +5,17 @@
 
 # All UML instances that are required for this test
 #
-UMLHOSTS="alice moon carol winnetou"
+UMLHOSTS="alice moon carol winnetou dave"
 
 # Corresponding block diagram
 #
-DIAGRAM="a-m-c-w.png"
+DIAGRAM="a-v-m-c-w-d.png"
 
 # UML instances on which tcpdump is to be started
 #
-TCPDUMPHOSTS="alice carol"
+TCPDUMPHOSTS="alice venus carol dave"
 
 # UML instances on which IPsec is started
 # Used for IPsec logging purposes
 #
-IPSECHOSTS="alice moon carol"
+IPSECHOSTS="alice venus moon carol dave"