added sql/rw-cert scenario
This commit is contained in:
Andreas Steffen
@@ -0,0 +1,6 @@
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
|
||||
to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
|
||||
Upon the successful establishment of the IPsec tunnels, automatically inserted
|
||||
iptables-based firewall rules let pass the tunneled traffic.
|
||||
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
|
||||
the client <b>alice</b> behind the gateway <b>moon</b>.
|
||||
@@ -0,0 +1,10 @@
|
||||
moon::ipsec statusall::rw.*ESTABLISHED::YES
|
||||
carol::ipsec statusall::home.*ESTABLISHED::YES
|
||||
dave::ipsec statusall::home.*ESTABLISHED::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
|
||||
dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
plutostart=no
|
||||
|
||||
# configuration is read from SQLite database
|
||||
@@ -0,0 +1,300 @@
|
||||
DROP TABLE IF EXISTS identities;
|
||||
CREATE TABLE identities (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL,
|
||||
UNIQUE (type, data)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS child_configs;
|
||||
CREATE TABLE child_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
name TEXT NOT NULL,
|
||||
lifetime INTEGER NOT NULL DEFAULT '1200',
|
||||
rekeytime INTEGER NOT NULL DEFAULT '1020',
|
||||
jitter INTEGER NOT NULL DEFAULT '180',
|
||||
updown TEXT DEFAULT NULL,
|
||||
hostaccess INTEGER NOT NULL DEFAULT '0',
|
||||
mode INTEGER NOT NULL DEFAULT '1'
|
||||
);
|
||||
DROP INDEX IF EXISTS child_configs_name;
|
||||
CREATE INDEX child_configs_name ON child_configs (
|
||||
name
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS child_config_traffic_selector;
|
||||
CREATE TABLE child_config_traffic_selector (
|
||||
child_cfg INTEGER NOT NULL,
|
||||
traffic_selector INTEGER NOT NULL,
|
||||
kind INTEGER NOT NULL
|
||||
);
|
||||
DROP INDEX IF EXISTS child_config_traffic_selector;
|
||||
CREATE INDEX child_config_traffic_selector_all ON child_config_traffic_selector (
|
||||
child_cfg, traffic_selector
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS ike_configs;
|
||||
CREATE TABLE ike_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
certreq INTEGER NOT NULL DEFAULT '1',
|
||||
force_encap INTEGER NOT NULL DEFAULT '0',
|
||||
local TEXT NOT NULL,
|
||||
remote TEXT NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS peer_configs;
|
||||
CREATE TABLE peer_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
name TEXT NOT NULL,
|
||||
ike_version INTEGER NOT NULL DEFAULT '2',
|
||||
ike_cfg INTEGER NOT NULL,
|
||||
local_id TEXT NOT NULL,
|
||||
remote_id TEXT NOT NULL,
|
||||
cert_policy INTEGER NOT NULL DEFAULT '1',
|
||||
auth_method INTEGER NOT NULL DEFAULT '1',
|
||||
eap_type INTEGER NOT NULL DEFAULT '0',
|
||||
eap_vendor INTEGER NOT NULL DEFAULT '0',
|
||||
keyingtries INTEGER NOT NULL DEFAULT '1',
|
||||
rekeytime INTEGER NOT NULL DEFAULT '0',
|
||||
reauthtime INTEGER NOT NULL DEFAULT '3600',
|
||||
jitter INTEGER NOT NULL DEFAULT '180',
|
||||
overtime INTEGER NOT NULL DEFAULT '300',
|
||||
mobike INTEGER NOT NULL DEFAULT '1',
|
||||
dpd_delay INTEGER NOT NULL DEFAULT '120',
|
||||
dpd_action INTEGER NOT NULL DEFAULT '1',
|
||||
mediation INTEGER NOT NULL DEFAULT '0',
|
||||
mediated_by INTEGER NOT NULL DEFAULT '0',
|
||||
peer_id INTEGER NOT NULL DEFAULT '0'
|
||||
);
|
||||
DROP INDEX IF EXISTS peer_configs_name;
|
||||
CREATE INDEX peer_configs_name ON peer_configs (
|
||||
name
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS peer_config_child_config;
|
||||
CREATE TABLE peer_config_child_config (
|
||||
peer_cfg INTEGER NOT NULL,
|
||||
child_cfg INTEGER NOT NULL,
|
||||
PRIMARY KEY (peer_cfg, child_cfg)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS traffic_selectors;
|
||||
CREATE TABLE traffic_selectors (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL DEFAULT '7',
|
||||
protocol INTEGER NOT NULL DEFAULT '0',
|
||||
start_addr BLOB DEFAULT NULL,
|
||||
end_addr BLOB DEFAULT NULL,
|
||||
start_port INTEGER NOT NULL DEFAULT '0',
|
||||
end_port INTEGER NOT NULL DEFAULT '65535'
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS certificates;
|
||||
CREATE TABLE certificates (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
keytype INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS certificate_identity;
|
||||
CREATE TABLE certificate_identity (
|
||||
certificate INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (certificate, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS private_keys;
|
||||
CREATE TABLE private_keys (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS private_key_identity;
|
||||
CREATE TABLE private_key_identity (
|
||||
private_key INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (private_key, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS shared_secrets;
|
||||
CREATE TABLE shared_secrets (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS shared_secret_identity;
|
||||
CREATE TABLE shared_secret_identity (
|
||||
shared_secret INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (shared_secret, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS ike_sas;
|
||||
CREATE TABLE ike_sas (
|
||||
local_spi BLOB NOT NULL PRIMARY KEY,
|
||||
remote_spi BLOB NOT NULL,
|
||||
id INTEGER NOT NULL,
|
||||
initiator INTEGER NOT NULL,
|
||||
local_id_type INTEGER NOT NULL,
|
||||
local_id_data BLOB NOT NULL,
|
||||
remote_id_type INTEGER NOT NULL,
|
||||
remote_id_data BLOB NOT NULL,
|
||||
host_family INTEGER NOT NULL,
|
||||
local_host_data BLOB NOT NULL,
|
||||
remote_host_data BLOB NOT NULL,
|
||||
created INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS logs;
|
||||
CREATE TABLE logs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
local_spi BLOB NOT NULL,
|
||||
signal INTEGER NOT NULL,
|
||||
level INTEGER NOT NULL,
|
||||
msg TEXT NOT NULL,
|
||||
time INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
/* Identities */
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=strongSwan Root CA */
|
||||
9, X'3045310B300906035504061302434831193017060355040A13104C696E7578207374726F6E675377616E311B3019060355040313127374726F6E675377616E20526F6F74204341'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* keyid of 'C=CH, O=Linux strongSwan, CN=strongSwan Root CA' */
|
||||
202, X'ae096b87b44886d3b820978623dabd0eae22ebbc'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* carol@strongswan.org */
|
||||
3, X'6361726f6c407374726f6e677377616e2e6f7267'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* keyid of 'C=CH, O=Linux strongSwan, CN=carol@strongswan.org' */
|
||||
202, X'985c23660cd9b9a7554da6a4aa31ea02230fd482'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* moon.strongswan.org */
|
||||
2, X'6d6f6f6e2e7374726f6e677377616e2e6f7267'
|
||||
);
|
||||
|
||||
/* Certificates */
|
||||
|
||||
INSERT INTO certificates (
|
||||
type, keytype, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=strongSwan Root CA */
|
||||
1, 1, X'308203b53082029da003020102020100300d06092a864886f70d01010405003045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341301e170d3034303931303131303134355a170d3134303930383131303134355a3045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bff25f62ea3d566e58b3c87a49caf3ac61cfa96377734d842db3f8fd6ea023f7b0132e66265012317386729c6d7c427a8d9f167be138e8ebae2b12b95933baef36a315c3ddf224cee4bb9bd578135d0467382629621ff96b8d45f6e002e5083662dce181805c140b3f2ce93f83aee3c861cff610a39f0189cb3a3c7cb9bf7e2a09544e2170efaa18fdd4ff20fa94be176d7fecff821f68d17152041d9b46f0cfcfc1e4cf43de5d3f3a587763afe9267f53b11699b3264fc55c5189f5682871166cb98307950569641fa30ffb50de134fed2f973cef1a392827862bc4ddaa97bbb01442e293c41070d07224d4be47ae2753eb2bed4bc1da91c68ec780c4620f0f0203010001a381af3081ac300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e041604145da7dd700651327ee7b66db3b5e5e060ea2e4def306d0603551d230466306480145da7dd700651327ee7b66db3b5e5e060ea2e4defa149a4473045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341820100300d06092a864886f70d010104050003820101009ad74e3e60592dfb9b21c78628bd76b63090c1720c74bf94753cad6fddadc9c776eb39d3bfaa52136bf528840078386308fcf79503bd3d1ad6c15ac38e10c846bff7888a03cfe7fa0e644b522b2af5aedf0bbc508dc48330a180757772771095059b2be148f58dc0c753b59e9d6bfb02e9b685a928a284531b187313fd2b835bc9ea27d0020739a8d485e88bdede9a45cde6d28ed553b0e8e92dabf877bed59abf9d151f15e4f2d00b5e6e49fcb665293d2296697926c2954dae367542ef6e98053e76d2728732f6ce69f284f0b856aa6c2823a9ee29b280a66f50828f9b5cf27f84feca3c31c24897db156c7a833768ab306f51286457a51f09dd53bbb4190f'
|
||||
);
|
||||
|
||||
INSERT INTO certificates (
|
||||
type, keytype, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=carol@strongswan.org */
|
||||
1, 1, X'308204223082030aa00302010202010a300d06092a864886f70d01010405003045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341301e170d3035303130313231343331385a170d3039313233313231343331385a305a310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e3111300f060355040b13085265736561726368311d301b060355040314146361726f6c407374726f6e677377616e2e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100b81b84920408e086c8d278d3ad2e9ffc01b89e8c423b612b908010f8174ff96f6729e84b185fb96e60783082c507ace9d64f79beb0252e05e5f1f7a89a0b33e6789f5deb665084cb230191c165bcad1a34563e011b349bb6ab517f01ecf7e2f4de961d36203b85e97811cb26b650cfd014d15dd2d2b71efd656e5638a24bf70986b8128bbae5f3b428d6360e03d3f4e816502e3d1d14d7165ab1a92a9fe15ef045d4e48ff5bd798ec80c9420962c9a9798b54a0ed2a00cf2c9651d7d9882e181c1ef6b1c43edcada2fd191e109962dbd26f38a00208c1ac3ed27a5924c60330c79878eb5c7a90960a6472f979aca9c5aee2bb4d0aed395b546c5e361910a06370203010001a38201063082010230090603551d1304023000300b0603551d0f0404030203a8301d0603551d0e041604145535eca6eba279baef887f18438fd227b16746d1306d0603551d230466306480145da7dd700651327ee7b66db3b5e5e060ea2e4defa149a4473045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341820100301f0603551d110418301681146361726f6c407374726f6e677377616e2e6f726730390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e7374726f6e677377616e2e6f72672f7374726f6e677377616e2e63726c300d06092a864886f70d01010405000382010100b1304a7e65d72573468853e8cedd398bf3581cc1e6b4054b9c8d97c3caf0929035dc5e274e7b3fa5fef52e7860bb06aab5ba40c5f1ca55806b4cd873f133ded948b3c89cc81621e2eadee5fc893b48a34e4462a45ab09c41200918f68ea36babfacf4099aa349b8b65841eb1e416b90e4eb462edd786cdb0008565633a701fcd2c416ae8e4754c5bea3181736179aa901e5526c4fac031ce649d851c85ded514c25e3269b0739a879d273950e1a9ea8341b5e1049c07181792ad37da02aeccd555c56469e8e15a9e72860b520dbec05662d37adb08d79575e133f338b0116198fa5fb556fe02682bd634aca535f6750b0daa123f5ad36f2e67caa260587f1aa9'
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
1, 1
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
1, 2
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
2, 3
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
2, 4
|
||||
);
|
||||
|
||||
/* Private Keys */
|
||||
|
||||
INSERT INTO private_keys (
|
||||
type, data
|
||||
) VALUES ( /* key of 'C=CH, O=Linux strongSwan, CN=carol@strongswan.org' */
|
||||
1, X'308204a30201000282010100b81b84920408e086c8d278d3ad2e9ffc01b89e8c423b612b908010f8174ff96f6729e84b185fb96e60783082c507ace9d64f79beb0252e05e5f1f7a89a0b33e6789f5deb665084cb230191c165bcad1a34563e011b349bb6ab517f01ecf7e2f4de961d36203b85e97811cb26b650cfd014d15dd2d2b71efd656e5638a24bf70986b8128bbae5f3b428d6360e03d3f4e816502e3d1d14d7165ab1a92a9fe15ef045d4e48ff5bd798ec80c9420962c9a9798b54a0ed2a00cf2c9651d7d9882e181c1ef6b1c43edcada2fd191e109962dbd26f38a00208c1ac3ed27a5924c60330c79878eb5c7a90960a6472f979aca9c5aee2bb4d0aed395b546c5e361910a063702030100010282010100a7870abc1f85c061858dd7baae24f61947abaa41f0e6bd85f9c83f28b175e980d0bc168f76cf6c199f18def3afbc4b40c0edb2d7accb3834cfc7bd57234d3c5de4b707ac737ea3478144255079761581f9cbdc41ff72809ad90ba069ad2ae7cf7057e29ee4f7a4e40c890c75de826c8768da16e9072af0bd1db6282902ade34cb1b9c3fdd00a8f0330328e18d477009ac5a43952fe05b7257b8b4e7f8f5288e858ef56ea3a031980d38b879e6327d949a8f3c19bf379c1297b3defc0a374a6ea6f1c0e8124247c33392ae446081f486f58bb41cbcba25915d37eefe0828408f7f679841588424ef59b6dee30805b926fa80e7ff57cb4817167ca72bf51c8cf9102818100da567b0cbbc426e4455ffdd1b8013644d9f47785b05b163a0155c81d57c0cd84fe73aa75125caf116de50b7adc369707ed91127db7d4422bb08cff5ddf91f4a0e5fb264e098fe6fe62f8a2ab933eeac41893f365d8165f79143855b5a5b7dc31c9b34a9d453ee7c8d7b24f89e3ed51bfeadc2e1102308a967b241dfb44c8ad6902818100d7dd78437c533a15fd1dd6b0634334e79c31d215017f5a8869e42cbada3fb09167585e087e72f91575441f7cca9a64246df57f0e45f1ae86a289a4307586aa1cc3cd069c65057cc3b0baac3634064e53179bde9af2531a5af2770a1d7ccbdc263f18299ad2ec0d224b718002633a546af74c7cac72ccdf253ab4370137bf829f02818063b2f5c15cc43716296fa9d167fa75b37eeb18e0dd24dac365f4abca6a55ca031ec5e6624b1e337afbf9890273282253267206458df9c8b5768b0bd8ebcc142e9c95d069f607d5ecf7789d9f473f85a841a8dd8df5dc518052715f01f14841ae22725271fa3abd5082de135fddca7277f660d05047f5ae73048bfb7ccf6deb7102818028b2b4ade48ebc70d0dc03521624e1a0992e3b71826ac462dbb40d4add430cc31d3ce7ddaa197b24b48b37748bae381b363006d8660f7edc1b60dff7d2f0a4b9efa0841290694c7088ad69327ef48167e1179e0c908b6278ab260e5e28dd36906f6cdacb39e10f48dbf8762dfd0f4e432c84db2c98285019f0cb7163656351f902818042a7d7d7f9416b3f3b50cf5815dfbc249cd3572e494c76d1ae99dc1e8bc63fbb32e5c18d5c4f90681e9046999cdcf0826f904350b9d67227f606382d9c7b3b1332d22744b2cefa691ab82dbec8e976a406b0902d0f4889392f80d39e2581ac42feed9085964650485e34811b04fa1f34c47cde5cbdd1d20f30111851a3c187ca'
|
||||
);
|
||||
|
||||
INSERT INTO private_key_identity (
|
||||
private_key, identity
|
||||
) VALUES (
|
||||
1, 3
|
||||
);
|
||||
|
||||
INSERT INTO private_key_identity (
|
||||
private_key, identity
|
||||
) VALUES (
|
||||
1, 4
|
||||
);
|
||||
|
||||
/* Configurations */
|
||||
|
||||
INSERT INTO ike_configs (
|
||||
local, remote
|
||||
) VALUES (
|
||||
'PH_IP_CAROL', 'PH_IP_MOON'
|
||||
);
|
||||
|
||||
INSERT INTO peer_configs (
|
||||
name, ike_cfg, local_id, remote_id
|
||||
) VALUES (
|
||||
'home', 1, 3, 5
|
||||
);
|
||||
|
||||
INSERT INTO child_configs (
|
||||
name, updown
|
||||
) VALUES (
|
||||
'home', 'ipsec _updown iptables'
|
||||
);
|
||||
|
||||
INSERT INTO peer_config_child_config (
|
||||
peer_cfg, child_cfg
|
||||
) VALUES (
|
||||
1, 1
|
||||
);
|
||||
|
||||
INSERT INTO traffic_selectors (
|
||||
type, start_addr, end_addr
|
||||
) VALUES ( /* 10.1.0.0/16 */
|
||||
7, X'0a010000', X'0a01ffff'
|
||||
);
|
||||
|
||||
INSERT INTO traffic_selectors (
|
||||
type
|
||||
) VALUES ( /* dynamic/32 */
|
||||
7
|
||||
);
|
||||
|
||||
INSERT INTO child_config_traffic_selector (
|
||||
child_cfg, traffic_selector, kind
|
||||
) VALUES (
|
||||
1, 1, 1
|
||||
);
|
||||
|
||||
INSERT INTO child_config_traffic_selector (
|
||||
child_cfg, traffic_selector, kind
|
||||
) VALUES (
|
||||
1, 2, 2
|
||||
);
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
# secrets are read from SQLite database
|
||||
@@ -0,0 +1,9 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
plugins {
|
||||
sql {
|
||||
database = sqlite:///etc/ipsec.d/ipsec.db
|
||||
}
|
||||
}
|
||||
}
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
plutostart=no
|
||||
|
||||
# configuration is read from SQLite database
|
||||
@@ -0,0 +1,300 @@
|
||||
DROP TABLE IF EXISTS identities;
|
||||
CREATE TABLE identities (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL,
|
||||
UNIQUE (type, data)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS child_configs;
|
||||
CREATE TABLE child_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
name TEXT NOT NULL,
|
||||
lifetime INTEGER NOT NULL DEFAULT '1200',
|
||||
rekeytime INTEGER NOT NULL DEFAULT '1020',
|
||||
jitter INTEGER NOT NULL DEFAULT '180',
|
||||
updown TEXT DEFAULT NULL,
|
||||
hostaccess INTEGER NOT NULL DEFAULT '0',
|
||||
mode INTEGER NOT NULL DEFAULT '1'
|
||||
);
|
||||
DROP INDEX IF EXISTS child_configs_name;
|
||||
CREATE INDEX child_configs_name ON child_configs (
|
||||
name
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS child_config_traffic_selector;
|
||||
CREATE TABLE child_config_traffic_selector (
|
||||
child_cfg INTEGER NOT NULL,
|
||||
traffic_selector INTEGER NOT NULL,
|
||||
kind INTEGER NOT NULL
|
||||
);
|
||||
DROP INDEX IF EXISTS child_config_traffic_selector;
|
||||
CREATE INDEX child_config_traffic_selector_all ON child_config_traffic_selector (
|
||||
child_cfg, traffic_selector
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS ike_configs;
|
||||
CREATE TABLE ike_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
certreq INTEGER NOT NULL DEFAULT '1',
|
||||
force_encap INTEGER NOT NULL DEFAULT '0',
|
||||
local TEXT NOT NULL,
|
||||
remote TEXT NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS peer_configs;
|
||||
CREATE TABLE peer_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
name TEXT NOT NULL,
|
||||
ike_version INTEGER NOT NULL DEFAULT '2',
|
||||
ike_cfg INTEGER NOT NULL,
|
||||
local_id TEXT NOT NULL,
|
||||
remote_id TEXT NOT NULL,
|
||||
cert_policy INTEGER NOT NULL DEFAULT '1',
|
||||
auth_method INTEGER NOT NULL DEFAULT '1',
|
||||
eap_type INTEGER NOT NULL DEFAULT '0',
|
||||
eap_vendor INTEGER NOT NULL DEFAULT '0',
|
||||
keyingtries INTEGER NOT NULL DEFAULT '1',
|
||||
rekeytime INTEGER NOT NULL DEFAULT '0',
|
||||
reauthtime INTEGER NOT NULL DEFAULT '3600',
|
||||
jitter INTEGER NOT NULL DEFAULT '180',
|
||||
overtime INTEGER NOT NULL DEFAULT '300',
|
||||
mobike INTEGER NOT NULL DEFAULT '1',
|
||||
dpd_delay INTEGER NOT NULL DEFAULT '120',
|
||||
dpd_action INTEGER NOT NULL DEFAULT '1',
|
||||
mediation INTEGER NOT NULL DEFAULT '0',
|
||||
mediated_by INTEGER NOT NULL DEFAULT '0',
|
||||
peer_id INTEGER NOT NULL DEFAULT '0'
|
||||
);
|
||||
DROP INDEX IF EXISTS peer_configs_name;
|
||||
CREATE INDEX peer_configs_name ON peer_configs (
|
||||
name
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS peer_config_child_config;
|
||||
CREATE TABLE peer_config_child_config (
|
||||
peer_cfg INTEGER NOT NULL,
|
||||
child_cfg INTEGER NOT NULL,
|
||||
PRIMARY KEY (peer_cfg, child_cfg)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS traffic_selectors;
|
||||
CREATE TABLE traffic_selectors (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL DEFAULT '7',
|
||||
protocol INTEGER NOT NULL DEFAULT '0',
|
||||
start_addr BLOB DEFAULT NULL,
|
||||
end_addr BLOB DEFAULT NULL,
|
||||
start_port INTEGER NOT NULL DEFAULT '0',
|
||||
end_port INTEGER NOT NULL DEFAULT '65535'
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS certificates;
|
||||
CREATE TABLE certificates (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
keytype INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS certificate_identity;
|
||||
CREATE TABLE certificate_identity (
|
||||
certificate INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (certificate, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS private_keys;
|
||||
CREATE TABLE private_keys (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS private_key_identity;
|
||||
CREATE TABLE private_key_identity (
|
||||
private_key INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (private_key, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS shared_secrets;
|
||||
CREATE TABLE shared_secrets (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS shared_secret_identity;
|
||||
CREATE TABLE shared_secret_identity (
|
||||
shared_secret INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (shared_secret, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS ike_sas;
|
||||
CREATE TABLE ike_sas (
|
||||
local_spi BLOB NOT NULL PRIMARY KEY,
|
||||
remote_spi BLOB NOT NULL,
|
||||
id INTEGER NOT NULL,
|
||||
initiator INTEGER NOT NULL,
|
||||
local_id_type INTEGER NOT NULL,
|
||||
local_id_data BLOB NOT NULL,
|
||||
remote_id_type INTEGER NOT NULL,
|
||||
remote_id_data BLOB NOT NULL,
|
||||
host_family INTEGER NOT NULL,
|
||||
local_host_data BLOB NOT NULL,
|
||||
remote_host_data BLOB NOT NULL,
|
||||
created INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS logs;
|
||||
CREATE TABLE logs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
local_spi BLOB NOT NULL,
|
||||
signal INTEGER NOT NULL,
|
||||
level INTEGER NOT NULL,
|
||||
msg TEXT NOT NULL,
|
||||
time INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
/* Identities */
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=strongSwan Root CA */
|
||||
9, X'3045310B300906035504061302434831193017060355040A13104C696E7578207374726F6E675377616E311B3019060355040313127374726F6E675377616E20526F6F74204341'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* keyid of 'C=CH, O=Linux strongSwan, CN=strongSwan Root CA' */
|
||||
202, X'ae096b87b44886d3b820978623dabd0eae22ebbc'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* dave@strongswan.org */
|
||||
3, X'64617665407374726f6e677377616e2e6f7267'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* keyid of 'C=CH, O=Linux strongSwan, CN=dave@strongswan.org' */
|
||||
202, X'f651b7ea33148cc5a76a622f1c1eb16c6bbdea25'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* moon.strongswan.org */
|
||||
2, X'6d6f6f6e2e7374726f6e677377616e2e6f7267'
|
||||
);
|
||||
|
||||
/* Certificates */
|
||||
|
||||
INSERT INTO certificates (
|
||||
type, keytype, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=strongSwan Root CA */
|
||||
1, 1, X'308203b53082029da003020102020100300d06092a864886f70d01010405003045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341301e170d3034303931303131303134355a170d3134303930383131303134355a3045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bff25f62ea3d566e58b3c87a49caf3ac61cfa96377734d842db3f8fd6ea023f7b0132e66265012317386729c6d7c427a8d9f167be138e8ebae2b12b95933baef36a315c3ddf224cee4bb9bd578135d0467382629621ff96b8d45f6e002e5083662dce181805c140b3f2ce93f83aee3c861cff610a39f0189cb3a3c7cb9bf7e2a09544e2170efaa18fdd4ff20fa94be176d7fecff821f68d17152041d9b46f0cfcfc1e4cf43de5d3f3a587763afe9267f53b11699b3264fc55c5189f5682871166cb98307950569641fa30ffb50de134fed2f973cef1a392827862bc4ddaa97bbb01442e293c41070d07224d4be47ae2753eb2bed4bc1da91c68ec780c4620f0f0203010001a381af3081ac300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e041604145da7dd700651327ee7b66db3b5e5e060ea2e4def306d0603551d230466306480145da7dd700651327ee7b66db3b5e5e060ea2e4defa149a4473045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341820100300d06092a864886f70d010104050003820101009ad74e3e60592dfb9b21c78628bd76b63090c1720c74bf94753cad6fddadc9c776eb39d3bfaa52136bf528840078386308fcf79503bd3d1ad6c15ac38e10c846bff7888a03cfe7fa0e644b522b2af5aedf0bbc508dc48330a180757772771095059b2be148f58dc0c753b59e9d6bfb02e9b685a928a284531b187313fd2b835bc9ea27d0020739a8d485e88bdede9a45cde6d28ed553b0e8e92dabf877bed59abf9d151f15e4f2d00b5e6e49fcb665293d2296697926c2954dae367542ef6e98053e76d2728732f6ce69f284f0b856aa6c2823a9ee29b280a66f50828f9b5cf27f84feca3c31c24897db156c7a833768ab306f51286457a51f09dd53bbb4190f'
|
||||
);
|
||||
|
||||
INSERT INTO certificates (
|
||||
type, keytype, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=dave@strongswan.org */
|
||||
1, 1, X'308204223082030aa003020102020108300d06092a864886f70d01010405003045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341301e170d3034303931303131323635315a170d3039303930393131323635315a305b310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e31133011060355040b130a4163636f756e74696e67311c301a0603550403141364617665407374726f6e677377616e2e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100c66c299463a8a78abef5ffa45679b7a070b5139834b146aa5138d0f1d8845412e112e4429ceeab23473e395e8aa38b2c024118d85b7ddf504118eabedf9c793bd02c949d6799cabeefe03ff62e304ddec98313afd966bcf13f1fb1a619548a060e17fbede205225b574e679adc9f11bdf9e36b48bea058d360d62b8445f9524db98757a4d59865363c675d28667a5dfa967dd03eea23a2dbea32ab0e9a1f8bb885f5e12723113843a12dd00552fcd4f548b31174aab2610e4a8752f6fca95494584db65cc7bd1ef50ee0d8c8211efb5063a995801cc0c1a903042b7ff7c94094a0de5d7390a8f72a01949cd958c6f2012692bd5dba6f30b09c3c0b69622864450203010001a38201053082010130090603551d1304023000300b0603551d0f0404030203a8301d0603551d0e04160414de90b5d11c6c643c7450d36af8886ca31938fb72306d0603551d230466306480145da7dd700651327ee7b66db3b5e5e060ea2e4defa149a4473045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341820100301e0603551d1104173015811364617665407374726f6e677377616e2e6f726730390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e7374726f6e677377616e2e6f72672f7374726f6e677377616e2e63726c300d06092a864886f70d0101040500038201010027a2d727384d2d2432f2f15875fa7693db3af1c7d5317cc21e1658f0843a918875d22c301b08e9c05a8aa3f02f6b8ae6705bb508988210f494fd19d92db786db21c1b6e6b18c0b7baa3fbd427da033fd2c08659daf9bc26dd99cf348c1ec139a9b8c32110199eaea08913f6b3a3d5b0c3d2a6f1f7e2c45b13452858949db416493f96dbf93e2173d81f99bc937b0c0c9e3874f4a90626a571295502ff5cf553dcdbdd7d4673dcbecc8ebbfc3e3ac0ce8a75120d6aa3dd2b6e9a61114cfbf0cba137c5934eddb32cfb96dd02fbf8adc903afa5f8d5959fce7a94fdd9e5a7a3816e35126e50fe7f818887bd2b2365b6b3a86d36a86849e9582d193e6a20b513988'
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
1, 1
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
1, 2
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
2, 3
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
2, 4
|
||||
);
|
||||
|
||||
/* Private Keys */
|
||||
|
||||
INSERT INTO private_keys (
|
||||
type, data
|
||||
) VALUES ( /* key of 'C=CH, O=Linux strongSwan, CN=dave@strongswan.org' */
|
||||
1, X'308204a40201000282010100c66c299463a8a78abef5ffa45679b7a070b5139834b146aa5138d0f1d8845412e112e4429ceeab23473e395e8aa38b2c024118d85b7ddf504118eabedf9c793bd02c949d6799cabeefe03ff62e304ddec98313afd966bcf13f1fb1a619548a060e17fbede205225b574e679adc9f11bdf9e36b48bea058d360d62b8445f9524db98757a4d59865363c675d28667a5dfa967dd03eea23a2dbea32ab0e9a1f8bb885f5e12723113843a12dd00552fcd4f548b31174aab2610e4a8752f6fca95494584db65cc7bd1ef50ee0d8c8211efb5063a995801cc0c1a903042b7ff7c94094a0de5d7390a8f72a01949cd958c6f2012692bd5dba6f30b09c3c0b696228644502030100010282010100903fb9caa2d8cd5454974a0e12bfd1fad5750e95ac58e462954194c4fcfed690130844e1186d7a04df9a20e2d62f26d20ba17f8a6a990b6bb0a788a0d2b7527b654fc38adaf2372eaffc7b036178c4639e63a84042f02993c8ac25ddf6b43ad34413b396b0a5c2e05c8c274db1ee025bf5fa9ad7fb9d5e75ed044606974835c7fbc39ae84b80acaae9e9624e6fe8ac0ca318ad8a7d1c6ed3a79261464e6ebdb9c02ef20cb1c206c58718d542ed9cb1428c5c3cebbd58dc25598bbdd9924c75fdfeac881949e5f10a7dd4dc25800bdb4bd479ca0bfb706f25847361b2d2565a412813273691b4a3a5a814dce52cdbe25d626e6c9e000ecd6a75cac275187e265102818100e596d3ee25cd98563b12bf718c0ce7e7a823ae8c84f1021552b6b0bf220b7e012861510ab49d612fe7ba05a202edf4927201af0f33f4137481811f884fc46723f94db8ed69b283376f3141ad7e6f0f52afee60e537111c5bd94642564981a822e54edb6797521fb5870c772993ff517ea9c24adcd9dc502f1364d26a3f05ec4f02818100dd3f81e8a4f463488db2b048f2ef208c1c98ee136636b6449cbd3424c93ab25916908823a1ef3a23b4798c77f92a3e29b9469f8014c6b862e23ab5fe6000f9552de01f72c0a1fcc731b0867a3bf1d27596fc9da6ecd74931ce120b1687d2a67b4e4fb32b7fb750b46645aa38ab011a4d5fedd53d20e5ae3a4a5551b6cc5f5d2b02818100ba744b9954ca2bb59c341596398f21a7593de13bed9b6d7db3b6fac3befa6652ba608e588b6664cf6afa00291b07f5601986948d5c3c14b0c19c03e7c82051433dec890b06941b4ca1d8f6e5d7908a7934b7fba92b9791d86614513b9266e20db4fcdde2bb59ceb6b5fec1a7dab1b7958e786424082a8c542f03ea7eaec038b1028180055e2312b7ddce02d69d3d35a7df3154f4e4a8f2038ad44539e0454197383b5779faabb2e19ce236378cb361bdc3ce9a488a74183168d8d45d54bb519e96a775ef94fe6e544a19cde360bb02802dcfc356946e66bc5c44c456918d7f507045e5bbf2a710291b13742cff07b03445e49377fe572c127e4009ddffcfe9b56fa2dd02818040d41f525d885c951dca35924f46e4e7f4e43f4ea2e670230deb674884f5b8599a368b1647dd87523c4fdb62661f6543edecc9ce48d4a7b8b2a29de21fd438a9cf4823b92c85180b390c4f8dfbc196628d349fed1edd32cba5c063e2739d2153d3677d4815e55b8b4e9d0989b32cf0060de2ded4cd59edf6a4364cb55aff9276'
|
||||
);
|
||||
|
||||
INSERT INTO private_key_identity (
|
||||
private_key, identity
|
||||
) VALUES (
|
||||
1, 3
|
||||
);
|
||||
|
||||
INSERT INTO private_key_identity (
|
||||
private_key, identity
|
||||
) VALUES (
|
||||
1, 4
|
||||
);
|
||||
|
||||
/* Configurations */
|
||||
|
||||
INSERT INTO ike_configs (
|
||||
local, remote
|
||||
) VALUES (
|
||||
'PH_IP_DAVE', 'PH_IP_MOON'
|
||||
);
|
||||
|
||||
INSERT INTO peer_configs (
|
||||
name, ike_cfg, local_id, remote_id
|
||||
) VALUES (
|
||||
'home', 1, 3, 5
|
||||
);
|
||||
|
||||
INSERT INTO child_configs (
|
||||
name, updown
|
||||
) VALUES (
|
||||
'home', 'ipsec _updown iptables'
|
||||
);
|
||||
|
||||
INSERT INTO peer_config_child_config (
|
||||
peer_cfg, child_cfg
|
||||
) VALUES (
|
||||
1, 1
|
||||
);
|
||||
|
||||
INSERT INTO traffic_selectors (
|
||||
type, start_addr, end_addr
|
||||
) VALUES ( /* 10.1.0.0/16 */
|
||||
7, X'0a010000', X'0a01ffff'
|
||||
);
|
||||
|
||||
INSERT INTO traffic_selectors (
|
||||
type
|
||||
) VALUES ( /* dynamic/32 */
|
||||
7
|
||||
);
|
||||
|
||||
INSERT INTO child_config_traffic_selector (
|
||||
child_cfg, traffic_selector, kind
|
||||
) VALUES (
|
||||
1, 1, 1
|
||||
);
|
||||
|
||||
INSERT INTO child_config_traffic_selector (
|
||||
child_cfg, traffic_selector, kind
|
||||
) VALUES (
|
||||
1, 2, 2
|
||||
);
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
# secrets are read from SQLite database
|
||||
@@ -0,0 +1,9 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
plugins {
|
||||
sql {
|
||||
database = sqlite:///etc/ipsec.d/ipsec.db
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
plutostart=no
|
||||
|
||||
# configuration is read from SQLite database
|
||||
@@ -0,0 +1,300 @@
|
||||
DROP TABLE IF EXISTS identities;
|
||||
CREATE TABLE identities (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL,
|
||||
UNIQUE (type, data)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS child_configs;
|
||||
CREATE TABLE child_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
name TEXT NOT NULL,
|
||||
lifetime INTEGER NOT NULL DEFAULT '1200',
|
||||
rekeytime INTEGER NOT NULL DEFAULT '1020',
|
||||
jitter INTEGER NOT NULL DEFAULT '180',
|
||||
updown TEXT DEFAULT NULL,
|
||||
hostaccess INTEGER NOT NULL DEFAULT '0',
|
||||
mode INTEGER NOT NULL DEFAULT '1'
|
||||
);
|
||||
DROP INDEX IF EXISTS child_configs_name;
|
||||
CREATE INDEX child_configs_name ON child_configs (
|
||||
name
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS child_config_traffic_selector;
|
||||
CREATE TABLE child_config_traffic_selector (
|
||||
child_cfg INTEGER NOT NULL,
|
||||
traffic_selector INTEGER NOT NULL,
|
||||
kind INTEGER NOT NULL
|
||||
);
|
||||
DROP INDEX IF EXISTS child_config_traffic_selector;
|
||||
CREATE INDEX child_config_traffic_selector_all ON child_config_traffic_selector (
|
||||
child_cfg, traffic_selector
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS ike_configs;
|
||||
CREATE TABLE ike_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
certreq INTEGER NOT NULL DEFAULT '1',
|
||||
force_encap INTEGER NOT NULL DEFAULT '0',
|
||||
local TEXT NOT NULL,
|
||||
remote TEXT NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS peer_configs;
|
||||
CREATE TABLE peer_configs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
name TEXT NOT NULL,
|
||||
ike_version INTEGER NOT NULL DEFAULT '2',
|
||||
ike_cfg INTEGER NOT NULL,
|
||||
local_id TEXT NOT NULL,
|
||||
remote_id TEXT NOT NULL,
|
||||
cert_policy INTEGER NOT NULL DEFAULT '1',
|
||||
auth_method INTEGER NOT NULL DEFAULT '1',
|
||||
eap_type INTEGER NOT NULL DEFAULT '0',
|
||||
eap_vendor INTEGER NOT NULL DEFAULT '0',
|
||||
keyingtries INTEGER NOT NULL DEFAULT '1',
|
||||
rekeytime INTEGER NOT NULL DEFAULT '0',
|
||||
reauthtime INTEGER NOT NULL DEFAULT '3600',
|
||||
jitter INTEGER NOT NULL DEFAULT '180',
|
||||
overtime INTEGER NOT NULL DEFAULT '300',
|
||||
mobike INTEGER NOT NULL DEFAULT '1',
|
||||
dpd_delay INTEGER NOT NULL DEFAULT '120',
|
||||
dpd_action INTEGER NOT NULL DEFAULT '1',
|
||||
mediation INTEGER NOT NULL DEFAULT '0',
|
||||
mediated_by INTEGER NOT NULL DEFAULT '0',
|
||||
peer_id INTEGER NOT NULL DEFAULT '0'
|
||||
);
|
||||
DROP INDEX IF EXISTS peer_configs_name;
|
||||
CREATE INDEX peer_configs_name ON peer_configs (
|
||||
name
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS peer_config_child_config;
|
||||
CREATE TABLE peer_config_child_config (
|
||||
peer_cfg INTEGER NOT NULL,
|
||||
child_cfg INTEGER NOT NULL,
|
||||
PRIMARY KEY (peer_cfg, child_cfg)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS traffic_selectors;
|
||||
CREATE TABLE traffic_selectors (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL DEFAULT '7',
|
||||
protocol INTEGER NOT NULL DEFAULT '0',
|
||||
start_addr BLOB DEFAULT NULL,
|
||||
end_addr BLOB DEFAULT NULL,
|
||||
start_port INTEGER NOT NULL DEFAULT '0',
|
||||
end_port INTEGER NOT NULL DEFAULT '65535'
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS certificates;
|
||||
CREATE TABLE certificates (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
keytype INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS certificate_identity;
|
||||
CREATE TABLE certificate_identity (
|
||||
certificate INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (certificate, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS private_keys;
|
||||
CREATE TABLE private_keys (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS private_key_identity;
|
||||
CREATE TABLE private_key_identity (
|
||||
private_key INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (private_key, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS shared_secrets;
|
||||
CREATE TABLE shared_secrets (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
type INTEGER NOT NULL,
|
||||
data BLOB NOT NULL
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS shared_secret_identity;
|
||||
CREATE TABLE shared_secret_identity (
|
||||
shared_secret INTEGER NOT NULL,
|
||||
identity INTEGER NOT NULL,
|
||||
PRIMARY KEY (shared_secret, identity)
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS ike_sas;
|
||||
CREATE TABLE ike_sas (
|
||||
local_spi BLOB NOT NULL PRIMARY KEY,
|
||||
remote_spi BLOB NOT NULL,
|
||||
id INTEGER NOT NULL,
|
||||
initiator INTEGER NOT NULL,
|
||||
local_id_type INTEGER NOT NULL,
|
||||
local_id_data BLOB NOT NULL,
|
||||
remote_id_type INTEGER NOT NULL,
|
||||
remote_id_data BLOB NOT NULL,
|
||||
host_family INTEGER NOT NULL,
|
||||
local_host_data BLOB NOT NULL,
|
||||
remote_host_data BLOB NOT NULL,
|
||||
created INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
DROP TABLE IF EXISTS logs;
|
||||
CREATE TABLE logs (
|
||||
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
|
||||
local_spi BLOB NOT NULL,
|
||||
signal INTEGER NOT NULL,
|
||||
level INTEGER NOT NULL,
|
||||
msg TEXT NOT NULL,
|
||||
time INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
/* Identities */
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=strongSwan Root CA */
|
||||
9, X'3045310B300906035504061302434831193017060355040A13104C696E7578207374726F6E675377616E311B3019060355040313127374726F6E675377616E20526F6F74204341'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* keyid of 'C=CH, O=Linux strongSwan, CN=strongSwan Root CA' */
|
||||
202, X'ae096b87b44886d3b820978623dabd0eae22ebbc'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* moon.strongswan.org */
|
||||
2, X'6d6f6f6e2e7374726f6e677377616e2e6f7267'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* keyid of 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org' */
|
||||
202, X'd70dbd46d5133519064f12f100525ead0802ca95'
|
||||
);
|
||||
|
||||
INSERT INTO identities (
|
||||
type, data
|
||||
) VALUES ( /* %any */
|
||||
0, '%any'
|
||||
);
|
||||
|
||||
/* Certificates */
|
||||
|
||||
INSERT INTO certificates (
|
||||
type, keytype, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=strongSwan Root CA */
|
||||
1, 1, X'308203b53082029da003020102020100300d06092a864886f70d01010405003045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341301e170d3034303931303131303134355a170d3134303930383131303134355a3045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bff25f62ea3d566e58b3c87a49caf3ac61cfa96377734d842db3f8fd6ea023f7b0132e66265012317386729c6d7c427a8d9f167be138e8ebae2b12b95933baef36a315c3ddf224cee4bb9bd578135d0467382629621ff96b8d45f6e002e5083662dce181805c140b3f2ce93f83aee3c861cff610a39f0189cb3a3c7cb9bf7e2a09544e2170efaa18fdd4ff20fa94be176d7fecff821f68d17152041d9b46f0cfcfc1e4cf43de5d3f3a587763afe9267f53b11699b3264fc55c5189f5682871166cb98307950569641fa30ffb50de134fed2f973cef1a392827862bc4ddaa97bbb01442e293c41070d07224d4be47ae2753eb2bed4bc1da91c68ec780c4620f0f0203010001a381af3081ac300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e041604145da7dd700651327ee7b66db3b5e5e060ea2e4def306d0603551d230466306480145da7dd700651327ee7b66db3b5e5e060ea2e4defa149a4473045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341820100300d06092a864886f70d010104050003820101009ad74e3e60592dfb9b21c78628bd76b63090c1720c74bf94753cad6fddadc9c776eb39d3bfaa52136bf528840078386308fcf79503bd3d1ad6c15ac38e10c846bff7888a03cfe7fa0e644b522b2af5aedf0bbc508dc48330a180757772771095059b2be148f58dc0c753b59e9d6bfb02e9b685a928a284531b187313fd2b835bc9ea27d0020739a8d485e88bdede9a45cde6d28ed553b0e8e92dabf877bed59abf9d151f15e4f2d00b5e6e49fcb665293d2296697926c2954dae367542ef6e98053e76d2728732f6ce69f284f0b856aa6c2823a9ee29b280a66f50828f9b5cf27f84feca3c31c24897db156c7a833768ab306f51286457a51f09dd53bbb4190f'
|
||||
);
|
||||
|
||||
INSERT INTO certificates (
|
||||
type, keytype, data
|
||||
) VALUES ( /* C=CH, O=Linux strongSwan, CN=moon.strongswan.org */
|
||||
1, 1, X'3082040d308202f5a003020102020103300d06092a864886f70d01010405003045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341301e170d3034303931303131313732355a170d3039303930393131313732355a3046310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311c301a060355040313136d6f6f6e2e7374726f6e677377616e2e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100afae2e109ac0a71b437b6f1a9e5194d085c999fe2c8de11b261f016c88e734eb1a6767b15bc7d8338bf3acc14e8a18bf857fd3dfbce637e9b0d3654f15d9068bdf4450517cf72651be8d4c8ff738ea961b2f5584bf7089afaa0a37b94910d18083bf649a7d395a41f04e68f14494d10ffc7d984a2c81e97f3421c1ec38c629b2456a3d8f3bf3915e86317ea71bb24422bef475e677e8967670b4f6ee2a80a45adcbd086a6537ab5fc12bf69f9072b620020de1880cec6cdea47543d1fec4c5ff547ac2447a1e210d9c128dc3337726eb63d5c1c731aa2c63ce175dbc8ebfb9c1e5198815be473781c3f82c2b59d23deb9739dda53c98d31a3fba57760aeaa89b0203010001a38201053082010130090603551d1304023000300b0603551d0f0404030203a8301d0603551d0e04160414e5e410876c2ac4bead854942a6de7658303a9fc1306d0603551d230466306480145da7dd700651327ee7b66db3b5e5e060ea2e4defa149a4473045310b300906035504061302434831193017060355040a13104c696e7578207374726f6e675377616e311b3019060355040313127374726f6e675377616e20526f6f74204341820100301e0603551d110417301582136d6f6f6e2e7374726f6e677377616e2e6f726730390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e7374726f6e677377616e2e6f72672f7374726f6e677377616e2e63726c300d06092a864886f70d010104050003820101002f2f2921667aa576bb0c71b601dfa5b358a93e84e8a1af9754ddfbfc67879cb6c6b7833c5749e7c30b11a87b3549e105dda5d371c459f7d40fabd60c4ac8623924be84c96cfa638eb6ce9f6513b9d61080b895d270c405eacc310c709a613b6f61029c94f535ac5836b890be402ad2c52f01f7fd4bff8c0cc0cbea9720ef21c0bb41fb0726852a3c38563d917fdcca186dede6fbc83febd9edf0541382464ee378f7b8c9684df0d2402b07eb11dd4a886ab5e7299d99ea2686994746c2d9c00d95b02b2950d67f7978c6db5b379c4a3170239c414cf743bab866005366809690073a150e73c6866b9b335616acdbd3a8e651596dedb686b5d8d3eeb12df9d729'
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
1, 1
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
1, 2
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
2, 3
|
||||
);
|
||||
|
||||
INSERT INTO certificate_identity (
|
||||
certificate, identity
|
||||
) VALUES (
|
||||
2, 4
|
||||
);
|
||||
|
||||
/* Private Keys */
|
||||
|
||||
INSERT INTO private_keys (
|
||||
type, data
|
||||
) VALUES ( /* key of 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org' */
|
||||
1, X'308204a30201000282010100afae2e109ac0a71b437b6f1a9e5194d085c999fe2c8de11b261f016c88e734eb1a6767b15bc7d8338bf3acc14e8a18bf857fd3dfbce637e9b0d3654f15d9068bdf4450517cf72651be8d4c8ff738ea961b2f5584bf7089afaa0a37b94910d18083bf649a7d395a41f04e68f14494d10ffc7d984a2c81e97f3421c1ec38c629b2456a3d8f3bf3915e86317ea71bb24422bef475e677e8967670b4f6ee2a80a45adcbd086a6537ab5fc12bf69f9072b620020de1880cec6cdea47543d1fec4c5ff547ac2447a1e210d9c128dc3337726eb63d5c1c731aa2c63ce175dbc8ebfb9c1e5198815be473781c3f82c2b59d23deb9739dda53c98d31a3fba57760aeaa89b0203010001028201004080550d67a42036945a377ab072078f5fef9b0885573a34fb941ab3bcb816e7d2f3f050600049d2f3296e5e32f5e50c3c79a852d74a377127a915e329845b30f3b26342e7fcde26d92d8bd4b7d23fdf08f02217f129e2838a8ce1d4b78ce33eaa2095515b74b93cc87c216fa3dc77bdc4d86017ababaf0d3318c9d86f27e29aa3301f6d7990f6f7f71db9de23ac66800ba0db4f42bbe82932ca56e08ba730c63febaf2779198cee387ee0934b32a2610ab990a4b908951bb1db2345cf1905f11aeaa6d1b368b7f82b1345ad14544e11d47d6981fc4be083326050cb950363dad1b28dbc16db42ec0fa973312c7306063bc9f308a6b0bcc965e5cb7e0b323ca102818100e71fffd9c9a528bdcb6e9ad1a5f4b354e3ea337392784aac790b4fba7f46b3b58d55965573f6493b686375cf6a0c68da9379434b055b625f01d64a9f1934cb075b25db5ef568325039674d577590b5ec54284842e04c27c97103a151805c9b620a3df84181e3a0c10752a7da6cac9629471a2bc85b32c3a160f3a8adf2d783d302818100c2968f5baf0d246bb9671b1dcfadab3a23cd6f9f1cba8c4b0d9b09d6c30a24eec174f22a4d9d2818d760b79a61c9cdd1381487723a99773a629b58171a6e28706bf083700f35037a0cb0649c9359987ccf77b44b4b3d94c614c74537c7025b503dc9967095411ecaec4b4427bc39dd5dfccbb8bab5d92e9465ab11e5e05d7319028181008b306e388e837461b89dc786f256c7991c18f31b6ade1eba77bb242cc071a7d0726954bbe9b62cac26559fa165d04b6536e3146f9dae4733c83b717d1705003051e81e90b56226cac18740c0a7009b4ed3efde74c7f7950e6f8d2c1d951c30477ebb8b428822b9b105e3f54a49a0365e6d7f895683f5b273019c3bbd663dfc190281807f5def6e12b1a682407405a2c8ba2356c5f2853a7fa2778bf4d6e364c87b4e5b5d138023427438b7b1da63b35088b808570dd0ee6afee2b4bbb074c382905235ebe11d176f4cc2fed3696e21b2ad358b947d04ed37cd9220e99ed966be0383e38cddf373b3ae514a7fca704d15fe46306bf4a8f0c570e7f5486ae6273269d89902818031055903f23c7db8da8951aad134c83a7ca951c48c9a7b994f36d9815bc82c80527b6da8e4beff9fee67b1fde5064719a40448bd6d70d9da8910122402835a328e74cfd34e8b568c29fae6ff831ef824fc825e609547a06052a4113ec09f00649bb7b7d195a773f11711c88f152b10a1b4ae58bb6d8bfc176e39f96c7c0de5c8'
|
||||
);
|
||||
|
||||
INSERT INTO private_key_identity (
|
||||
private_key, identity
|
||||
) VALUES (
|
||||
1, 3
|
||||
);
|
||||
|
||||
INSERT INTO private_key_identity (
|
||||
private_key, identity
|
||||
) VALUES (
|
||||
1, 4
|
||||
);
|
||||
|
||||
/* Configurations */
|
||||
|
||||
INSERT INTO ike_configs (
|
||||
local, remote
|
||||
) VALUES (
|
||||
'PH_IP_MOON', '0.0.0.0'
|
||||
);
|
||||
|
||||
INSERT INTO peer_configs (
|
||||
name, ike_cfg, local_id, remote_id
|
||||
) VALUES (
|
||||
'rw', 1, 3, 5
|
||||
);
|
||||
|
||||
INSERT INTO child_configs (
|
||||
name, updown
|
||||
) VALUES (
|
||||
'rw', 'ipsec _updown iptables'
|
||||
);
|
||||
|
||||
INSERT INTO peer_config_child_config (
|
||||
peer_cfg, child_cfg
|
||||
) VALUES (
|
||||
1, 1
|
||||
);
|
||||
|
||||
INSERT INTO traffic_selectors (
|
||||
type, start_addr, end_addr
|
||||
) VALUES ( /* 10.1.0.0/16 */
|
||||
7, X'0a010000', X'0a01ffff'
|
||||
);
|
||||
|
||||
INSERT INTO traffic_selectors (
|
||||
type
|
||||
) VALUES ( /* dynamic/32 */
|
||||
7
|
||||
);
|
||||
|
||||
INSERT INTO child_config_traffic_selector (
|
||||
child_cfg, traffic_selector, kind
|
||||
) VALUES (
|
||||
1, 1, 0
|
||||
);
|
||||
|
||||
INSERT INTO child_config_traffic_selector (
|
||||
child_cfg, traffic_selector, kind
|
||||
) VALUES (
|
||||
1, 2, 3
|
||||
);
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
# secrets are read from SQLite database
|
||||
@@ -0,0 +1,9 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
plugins {
|
||||
sql {
|
||||
database = sqlite:///etc/ipsec.d/ipsec.db
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
dave::ipsec stop
|
||||
moon::/etc/init.d/iptables stop 2> /dev/null
|
||||
carol::/etc/init.d/iptables stop 2> /dev/null
|
||||
dave::/etc/init.d/iptables stop 2> /dev/null
|
||||
moon::rm /etc/ipsec.d/ipsec.db
|
||||
carol::rm /etc/ipsec.d/ipsec.db
|
||||
dave::rm /etc/ipsec.d/ipsec.db
|
||||
~
|
||||
@@ -0,0 +1,15 @@
|
||||
moon::rm /etc/ipsec.d/cacerts/*
|
||||
carol::rm /etc/ipsec.d/cacerts/*
|
||||
dave::rm /etc/ipsec.d/cacerts/*
|
||||
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
|
||||
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
|
||||
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
|
||||
moon::/etc/init.d/iptables start 2> /dev/null
|
||||
carol::/etc/init.d/iptables start 2> /dev/null
|
||||
dave::/etc/init.d/iptables start 2> /dev/null
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
dave::ipsec start
|
||||
carol::sleep 1
|
||||
carol::ipsec up home
|
||||
dave::ipsec up home
|
||||
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# UML instances used for this test
|
||||
|
||||
# All UML instances that are required for this test
|
||||
#
|
||||
UMLHOSTS="alice moon carol winnetou dave"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w-d.png"
|
||||
|
||||
# UML instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# UML instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon carol dave"
|
||||
Reference in New Issue
Block a user