added ikev2/dhcp-dynamic scenario
authorAndreas Steffen <andreas.steffen@strongswan.org>
Fri, 23 Apr 2010 09:52:37 +0000 (11:52 +0200)
committerAndreas Steffen <andreas.steffen@strongswan.org>
Fri, 23 Apr 2010 09:52:37 +0000 (11:52 +0200)
17 files changed:
testing/hosts/default/etc/hosts
testing/tests/ikev2/dhcp-dynamic/description.txt [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/evaltest.dat [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/hosts/carol/etc/ipsec.conf [new file with mode: 0755]
testing/tests/ikev2/dhcp-dynamic/hosts/carol/etc/strongswan.conf [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/hosts/dave/etc/ipsec.conf [new file with mode: 0755]
testing/tests/ikev2/dhcp-dynamic/hosts/dave/etc/strongswan.conf [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/dhcpd.conf [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables [new file with mode: 0755]
testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/ipsec.conf [new file with mode: 0755]
testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/strongswan.conf [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd [new file with mode: 0755]
testing/tests/ikev2/dhcp-dynamic/posttest.dat [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/pretest.dat [new file with mode: 0644]
testing/tests/ikev2/dhcp-dynamic/test.conf [new file with mode: 0644]

index 4e239cb..fb07a2f 100644 (file)
@@ -16,6 +16,8 @@
 10.1.0.20      venus.strongswan.org    venus
 10.1.0.30      carol2.strongswan.org   carol2
 10.1.0.40      dave2.strongswan.org    dave2
+10.1.0.50      carol3.strongswan.org   carol3
+10.1.0.51      dave3.strongswan.org    dave3
 10.1.0.1       moon1.strongswan.org    moon1
 192.168.0.1    moon.strongswan.org     moon
 192.168.0.50   alice1.strongswan.org   alice1
diff --git a/testing/tests/ikev2/dhcp-dynamic/description.txt b/testing/tests/ikev2/dhcp-dynamic/description.txt
new file mode 100644 (file)
index 0000000..b29a1de
--- /dev/null
@@ -0,0 +1,8 @@
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
+and request a <b>virtual IP</b> via the IKEv2 configuration payload by using the <b>leftsourceip=%config</b>
+parameter. The <b>dhcp</b> plugin on gateway <b>moon</b> then requests an IP address and DNS server
+information from DHCP server <b>venus</b> using the DHCP protocol. The IP addresses are assigned dynamically
+by <b>venus</b> from the pool 10.1.0.50..10.1.0.60 so that <b>carol</b> and <b>dave</b> become full members
+of the subnet 10.1.0.0/16 hidden behind gateway <b>moon</b>. And this thanks to the <b>farp</b> plugin
+through which <b>moon</b> acts as a proxy for ARP requests e.g. from <b>alice</b> who wants to ping
+<b>carol</b> and <b>dave</b>. 
diff --git a/testing/tests/ikev2/dhcp-dynamic/evaltest.dat b/testing/tests/ikev2/dhcp-dynamic/evaltest.dat
new file mode 100644 (file)
index 0000000..b381408
--- /dev/null
@@ -0,0 +1,22 @@
+carol::ipsec status::home.*INSTALLED::YES
+alice::ping -c 1 10.1.0.50::64 bytes from 10.1.0.50: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ipsec status::home.*INSTALLED::YES
+alice::ping -c 1 10.1.0.51::64 bytes from 10.1.0.51: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::ipsec status::rw{.*10.1.0.0/16 === 10.1.0.50/32::YES
+moon::ipsec status::rw{.*10.1.0.0/16 === 10.1.0.51/32::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+alice::tcpdump::arp reply carol3.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo request::YES
+alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
+alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo request::YES
+alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo reply::YES
+alice::tcpdump::arp reply dave3.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::IP alice.strongswan.org > dave3.strongswan.org: ICMP echo request::YES
+alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
+alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo request::YES
+alice::tcpdump::IP alice.strongswan.org > dave3.strongswan.org: ICMP echo reply::YES
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/carol/etc/ipsec.conf
new file mode 100755 (executable)
index 0000000..a19f6cf
--- /dev/null
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+       crlcheckinterval=180
+       strictcrlpolicy=no
+       plutostart=no
+
+conn %default
+       ikelifetime=60m
+       keylife=20m
+       rekeymargin=3m
+       keyingtries=1
+       keyexchange=ikev2
+
+conn home
+       left=PH_IP_CAROL
+       leftsourceip=%config
+       leftcert=carolCert.pem
+       leftid=carol@strongswan.org
+       leftfirewall=yes
+       right=PH_IP_MOON
+       rightsubnet=10.1.0.0/16
+       rightid=@moon.strongswan.org
+       auto=add
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/carol/etc/strongswan.conf
new file mode 100644 (file)
index 0000000..5af37dc
--- /dev/null
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink socket-default updown resolve
+}
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/dave/etc/ipsec.conf
new file mode 100755 (executable)
index 0000000..1a89f4e
--- /dev/null
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+       crlcheckinterval=180
+       strictcrlpolicy=no
+       plutostart=no
+
+conn %default
+       ikelifetime=60m
+       keylife=20m
+       rekeymargin=3m
+       keyingtries=1
+       keyexchange=ikev2
+
+conn home
+       left=PH_IP_DAVE
+       leftsourceip=%config
+       leftcert=daveCert.pem
+       leftid=dave@strongswan.org
+       leftfirewall=yes
+       right=PH_IP_MOON
+       rightsubnet=10.1.0.0/16
+       rightid=@moon.strongswan.org
+       auto=add
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/dave/etc/strongswan.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/dave/etc/strongswan.conf
new file mode 100644 (file)
index 0000000..5af37dc
--- /dev/null
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink socket-default updown resolve
+}
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/dhcpd.conf
new file mode 100644 (file)
index 0000000..0340d56
--- /dev/null
@@ -0,0 +1,9 @@
+subnet 10.1.0.0 netmask 255.255.0.0 {
+  option routers 10.1.0.1;
+  option broadcast-address 10.1.255.255;
+  option domain-name servers PH_IP_WINNETOU PH_IP_VENUS
+  option netbios-name-servers PH_IP_VENUS;
+
+  # dynamic address pool for visitors
+  range 10.1.0.30 10.1.0.50;
+}
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables
new file mode 100755 (executable)
index 0000000..058bebb
--- /dev/null
@@ -0,0 +1,91 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+       before net
+       need logger
+}
+
+start() {
+       ebegin "Starting firewall"
+
+       # enable IP forwarding
+       echo 1 > /proc/sys/net/ipv4/ip_forward
+       
+       # default policy is DROP
+       /sbin/iptables -P INPUT DROP
+       /sbin/iptables -P OUTPUT DROP
+       /sbin/iptables -P FORWARD DROP
+
+       # allow bootpc and bootps
+       iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
+       iptables -A INPUT  -p udp --sport bootps --dport bootps -j ACCEPT
+
+       # allow broadcasts from eth1
+       iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
+
+       # allow esp
+       iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+       # allow IKE
+       iptables -A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+       # allow MobIKE
+       iptables -A INPUT  -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+       # allow crl fetch from winnetou
+       iptables -A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+       iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+       # allow ssh
+       iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+       iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+        # log dropped packets
+        iptables -A INPUT  -j LOG --log-prefix " IN: "
+        iptables -A OUTPUT -j LOG --log-prefix " OUT: "
+
+       eend $?
+}
+
+stop() {
+       ebegin "Stopping firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+       
+                       if [ $a == nat ]; then
+                               /sbin/iptables -t nat -P PREROUTING ACCEPT
+                               /sbin/iptables -t nat -P POSTROUTING ACCEPT
+                               /sbin/iptables -t nat -P OUTPUT ACCEPT
+                       elif [ $a == mangle ]; then
+                               /sbin/iptables -t mangle -P PREROUTING ACCEPT
+                               /sbin/iptables -t mangle -P INPUT ACCEPT
+                               /sbin/iptables -t mangle -P FORWARD ACCEPT
+                               /sbin/iptables -t mangle -P OUTPUT ACCEPT
+                               /sbin/iptables -t mangle -P POSTROUTING ACCEPT
+                       elif [ $a == filter ]; then
+                               /sbin/iptables -t filter -P INPUT ACCEPT
+                               /sbin/iptables -t filter -P FORWARD ACCEPT
+                               /sbin/iptables -t filter -P OUTPUT ACCEPT
+                       fi
+               done
+       eend $?
+}
+
+reload() {
+       ebegin "Flushing firewall"
+               for a in `cat /proc/net/ip_tables_names`; do
+                       /sbin/iptables -F -t $a
+                       /sbin/iptables -X -t $a
+               done;
+        eend $?
+       start
+}
+
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/ipsec.conf
new file mode 100755 (executable)
index 0000000..3868a7a
--- /dev/null
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+       crlcheckinterval=180
+       strictcrlpolicy=no
+       plutostart=no
+
+conn %default
+       ikelifetime=60m
+       keylife=20m
+       rekeymargin=3m
+       keyingtries=1
+       keyexchange=ikev2
+       left=PH_IP_MOON
+       leftsubnet=10.1.0.0/16
+       leftcert=moonCert.pem
+       leftid=@moon.strongswan.org
+       leftfirewall=yes
+
+conn rw
+       right=%any
+       rightsourceip=%dhcp
+       auto=add
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/strongswan.conf
new file mode 100644 (file)
index 0000000..146c81f
--- /dev/null
@@ -0,0 +1,10 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink socket-default updown attr farp dhcp
+  plugins {
+    dhcp {
+      server = 10.1.255.255
+    }
+  }
+}
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf
new file mode 100644 (file)
index 0000000..2176af7
--- /dev/null
@@ -0,0 +1,14 @@
+# dhcpd configuration file
+
+ddns-update-style none;
+
+subnet 10.1.0.0 netmask 255.255.0.0 {
+  option domain-name          "strongswan.org";
+  option domain-name-servers   10.1.0.20;
+  option netbios-name-servers  10.1.0.10;
+  option routers               10.1.0.1;
+  option broadcast-address     10.1.255.255;
+  next-server                  10.1.0.20;
+
+  range 10.1.0.50 10.1.0.60;
+}
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf
new file mode 100644 (file)
index 0000000..2d35dfd
--- /dev/null
@@ -0,0 +1,7 @@
+interface=eth0
+dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255
+dhcp-option=option:router,10.1.0.1
+dhcp-option=option:dns-server,10.1.0.20
+dhcp-option=option:netbios-ns,10.1.0.10
+dhcp-option=option:domain-name,strongswan.org
+log-dhcp
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd
new file mode 100755 (executable)
index 0000000..4044dcc
--- /dev/null
@@ -0,0 +1,24 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop"
+
+depend() {
+       need net
+       need logger
+}
+
+start() {
+       ebegin "Starting DHCP server"
+       start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd
+       eend $?
+}
+
+stop() {
+       ebegin "Stopping DHCP server"
+       start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid
+       rm -f /var/state/dhcp/dhcpd.leases
+       touch /var/state/dhcp/dhcpd.leases
+       eend $?
+}
diff --git a/testing/tests/ikev2/dhcp-dynamic/posttest.dat b/testing/tests/ikev2/dhcp-dynamic/posttest.dat
new file mode 100644 (file)
index 0000000..1f54875
--- /dev/null
@@ -0,0 +1,10 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+venus::cat /var/state/dhcp/dhcpd.leases
+venus::/etc/init.d/dhcpd stop 2> /dev/null
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+alice::arp -d 10.1.0.50
+alice::arp -d 10.1.0.51
diff --git a/testing/tests/ikev2/dhcp-dynamic/pretest.dat b/testing/tests/ikev2/dhcp-dynamic/pretest.dat
new file mode 100644 (file)
index 0000000..bd36b4f
--- /dev/null
@@ -0,0 +1,12 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+venus::cat /etc/dhcpd.conf
+venus::/etc/init.d/dhcpd start 2> /dev/null
+carol::ipsec start
+dave::ipsec start
+moon::ipsec start
+carol::sleep 2 
+carol::ipsec up home
+dave::ipsec up home
+carol::sleep 1
diff --git a/testing/tests/ikev2/dhcp-dynamic/test.conf b/testing/tests/ikev2/dhcp-dynamic/test.conf
new file mode 100644 (file)
index 0000000..a2ad7b2
--- /dev/null
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice venus moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon alice"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"