From 995a9c8a0a00d52b2e5008433f22485b2f1bcf01 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Mon, 17 Sep 2012 16:23:10 +0200 Subject: Add a simple test case for the unity plugin, featuring both includes and excludes --- testing/tests/ikev1/rw-cert-unity/description.txt | 6 ++++++ testing/tests/ikev1/rw-cert-unity/evaltest.dat | 8 ++++++++ .../ikev1/rw-cert-unity/hosts/carol/etc/ipsec.conf | 20 ++++++++++++++++++++ .../rw-cert-unity/hosts/carol/etc/strongswan.conf | 14 ++++++++++++++ .../ikev1/rw-cert-unity/hosts/moon/etc/ipsec.conf | 19 +++++++++++++++++++ .../rw-cert-unity/hosts/moon/etc/strongswan.conf | 19 +++++++++++++++++++ testing/tests/ikev1/rw-cert-unity/posttest.dat | 2 ++ testing/tests/ikev1/rw-cert-unity/pretest.dat | 4 ++++ testing/tests/ikev1/rw-cert-unity/test.conf | 21 +++++++++++++++++++++ 9 files changed, 113 insertions(+) create mode 100644 testing/tests/ikev1/rw-cert-unity/description.txt create mode 100644 testing/tests/ikev1/rw-cert-unity/evaltest.dat create mode 100644 testing/tests/ikev1/rw-cert-unity/hosts/carol/etc/ipsec.conf create mode 100644 testing/tests/ikev1/rw-cert-unity/hosts/carol/etc/strongswan.conf create mode 100644 testing/tests/ikev1/rw-cert-unity/hosts/moon/etc/ipsec.conf create mode 100644 testing/tests/ikev1/rw-cert-unity/hosts/moon/etc/strongswan.conf create mode 100644 testing/tests/ikev1/rw-cert-unity/posttest.dat create mode 100644 testing/tests/ikev1/rw-cert-unity/pretest.dat create mode 100644 testing/tests/ikev1/rw-cert-unity/test.conf diff --git a/testing/tests/ikev1/rw-cert-unity/description.txt b/testing/tests/ikev1/rw-cert-unity/description.txt new file mode 100644 index 000000000..5e887c7f4 --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/description.txt @@ -0,0 +1,6 @@ +The roadwarrior carol sets up a connection to gateway moon. +The authentication is based on X.509 certificates. carol +requests a virtual IP using leftsourceip=%config and indicates +support for the Cisco Unity extension. Gateway moon responds with +two Split-Include subnets configured in the leftsubnet definition and a +global Local-LAN exclude option defined in strongswan.conf. diff --git a/testing/tests/ikev1/rw-cert-unity/evaltest.dat b/testing/tests/ikev1/rw-cert-unity/evaltest.dat new file mode 100644 index 000000000..b6a860b86 --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/evaltest.dat @@ -0,0 +1,8 @@ +carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES +moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES +carol::ipsec status 2> /dev/null::10.2.1.1/32 === 192.168.0.0/24 PASS::YES +carol::ipsec status 2> /dev/null::home.*10.2.1.1/32 === 10.1.0.0/16 10.2.1.0/24::YES +moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 10.2.1.0/24 === 10.2.1.1/32::YES +carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES +moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES +moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES diff --git a/testing/tests/ikev1/rw-cert-unity/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-cert-unity/hosts/carol/etc/ipsec.conf new file mode 100644 index 000000000..bad62811b --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/hosts/carol/etc/ipsec.conf @@ -0,0 +1,20 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev1 + +conn home + left=PH_IP_CAROL + leftcert=carolCert.pem + leftid=carol@strongswan.org + leftsourceip=%config + right=PH_IP_MOON + rightid=@moon.strongswan.org + rightsubnet=0.0.0.0/0 + auto=add diff --git a/testing/tests/ikev1/rw-cert-unity/hosts/carol/etc/strongswan.conf b/testing/tests/ikev1/rw-cert-unity/hosts/carol/etc/strongswan.conf new file mode 100644 index 000000000..68e244025 --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/hosts/carol/etc/strongswan.conf @@ -0,0 +1,14 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl test-vectors aes des sha1 sha2 md5 pem pkcs1 pkcs8 gmp random nonce x509 revocation hmac xcbc ctr ccm gcm stroke kernel-netlink socket-default unity + cisco_unity = yes +} + +libstrongswan { + dh_exponent_ansi_x9_42 = no + integrity_test = yes + crypto_test { + on_add = yes + } +} diff --git a/testing/tests/ikev1/rw-cert-unity/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-cert-unity/hosts/moon/etc/ipsec.conf new file mode 100644 index 000000000..ee8ee9093 --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/hosts/moon/etc/ipsec.conf @@ -0,0 +1,19 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file + +config setup + +conn %default + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev1 + +conn rw + left=PH_IP_MOON + leftcert=moonCert.pem + leftid=@moon.strongswan.org + leftsubnet=10.1.0.0/16,10.2.1.0/24 + right=%any + rightsourceip=10.2.1.0/24 + auto=add diff --git a/testing/tests/ikev1/rw-cert-unity/hosts/moon/etc/strongswan.conf b/testing/tests/ikev1/rw-cert-unity/hosts/moon/etc/strongswan.conf new file mode 100644 index 000000000..3164176b2 --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/hosts/moon/etc/strongswan.conf @@ -0,0 +1,19 @@ +# /etc/strongswan.conf - strongSwan configuration file + +charon { + load = curl test-vectors aes des sha1 sha2 md5 pem pkcs1 pkcs8 gmp random nonce x509 revocation hmac xcbc ctr ccm gcm stroke kernel-netlink socket-default attr unity + cisco_unity = yes + plugins { + attr { + split-exclude = 192.168.0.0/24 + } + } +} + +libstrongswan { + dh_exponent_ansi_x9_42 = no + integrity_test = yes + crypto_test { + on_add = yes + } +} diff --git a/testing/tests/ikev1/rw-cert-unity/posttest.dat b/testing/tests/ikev1/rw-cert-unity/posttest.dat new file mode 100644 index 000000000..c6d6235f9 --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/posttest.dat @@ -0,0 +1,2 @@ +moon::ipsec stop +carol::ipsec stop diff --git a/testing/tests/ikev1/rw-cert-unity/pretest.dat b/testing/tests/ikev1/rw-cert-unity/pretest.dat new file mode 100644 index 000000000..4fbe475bf --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/pretest.dat @@ -0,0 +1,4 @@ +moon::ipsec start +carol::ipsec start +carol::sleep 1 +carol::ipsec up home diff --git a/testing/tests/ikev1/rw-cert-unity/test.conf b/testing/tests/ikev1/rw-cert-unity/test.conf new file mode 100644 index 000000000..25cff970f --- /dev/null +++ b/testing/tests/ikev1/rw-cert-unity/test.conf @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This configuration file provides information on the +# UML instances used for this test + +# All UML instances that are required for this test +# +UMLHOSTS="alice moon carol winnetou" + +# Corresponding block diagram +# +DIAGRAM="a-m-c.png" + +# UML instances on which tcpdump is to be started +# +TCPDUMPHOSTS="moon" + +# UML instances on which IPsec is started +# Used for IPsec logging purposes +# +IPSECHOSTS="moon carol" -- cgit v1.2.3