added firewall support to scenario

diff --git a/testing/tests/ikev2/host2host-transport/description.txt b/testing/tests/ikev2/host2host-transport/description.txt
index 63d15ab1393b11a3b116901cae53a053c8ddb8ca..fe3482c96f9feddf2f1c51881f2d9bc06b8ed6d8 100644 (file)
--- a/testing/tests/ikev2/host2host-transport/description.txt
+++ b/testing/tests/ikev2/host2host-transport/description.txt
@@ -1,3 +1,4 @@
-A connection between the hosts <b>moon</b> and <b>sun</b> is set up using IPsec transport mode.
-The authentication is based on X.509 certificates. 
-In order to test the host-to-host tunnel <b>moon</b> pings <b>sun</b>.
+An IPsec <b>transport-mode</b> connection between the hosts <b>moon</b> and <b>sun</b> is
+successfully set up. <b>leftfirewall=yes</b> automatically inserts iptables-based firewall
+rules that let pass the decrypted IP packets. In order to test the host-to-host connection
+<b>moon</b> pings <b>sun</b>.

diff --git a/testing/tests/ikev2/host2host-transport/evaltest.dat b/testing/tests/ikev2/host2host-transport/evaltest.dat
index 2dc75a50500fe75498662f5b53b53952048cb3ef..a46e4e4e4f74b8ba195683a2e499b74d32115120 100644 (file)
--- a/testing/tests/ikev2/host2host-transport/evaltest.dat
+++ b/testing/tests/ikev2/host2host-transport/evaltest.dat
@@ -1,5 +1,5 @@
-moon::ipsec statusall::host-host.*TRANSPORT::YES
-sun::ipsec statusall::host-host.*TRANSPORT::YES
+moon::ipsec status::host-host.*INSTALLED.*TRANSPORT::YES
+sun::ipsec status::host-host.*INSTALLED.*TRANSPORT::YES
 moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
 sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
 sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES

diff --git a/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf
index 32fcdb7876c4376bbdce03ca730bf6caaed7b016..9d3060b204275978ace01c169fe5bb7c846d5b6f 100755 (executable)
--- a/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf
@@ -16,6 +16,7 @@ conn host-host
        leftnexthop=%direct
        leftcert=moonCert.pem
        leftid=@moon.strongswan.org
+       leftfirewall=yes
        right=PH_IP_SUN
        rightid=@sun.strongswan.org
        type=transport

diff --git a/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf
index 99cb40e00e0a32ef485d8fb00ab9ed96b2b8d1fe..1467e7ef45808d4ff83e0f37bd17d55cfd1e74c3 100755 (executable)
--- a/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf
@@ -16,6 +16,7 @@ conn host-host
        leftnexthop=%direct
        leftcert=sunCert.pem
        leftid=@sun.strongswan.org
+       leftfirewall=yes
        right=PH_IP_MOON
        rightid=@moon.strongswan.org
        type=transport

diff --git a/testing/tests/ikev2/host2host-transport/posttest.dat b/testing/tests/ikev2/host2host-transport/posttest.dat
index dff181797ed34316c7027bc274eac1ae765e305f..52979508db74fae69ebfcf1bd5b30d9561a5f1bb 100644 (file)
--- a/testing/tests/ikev2/host2host-transport/posttest.dat
+++ b/testing/tests/ikev2/host2host-transport/posttest.dat
@@ -1,2 +1,6 @@
+moon::iptables -v -n -L
+sun::iptables -v -n -L
 moon::ipsec stop
 sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null

diff --git a/testing/tests/ikev2/host2host-transport/pretest.dat b/testing/tests/ikev2/host2host-transport/pretest.dat
index c441ccbfead6510e7546e13fa3f536c097da5a09..e2d98f2eb730c312e106fb46bda54b4682d70f4a 100644 (file)
--- a/testing/tests/ikev2/host2host-transport/pretest.dat
+++ b/testing/tests/ikev2/host2host-transport/pretest.dat
@@ -1,4 +1,6 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
 moon::ipsec start
 sun::ipsec start
-moon::sleep 1 
+moon::sleep 2
 moon::ipsec up host-host

diff --git a/testing/tests/ikev2/host2host-transport/test.conf b/testing/tests/ikev2/host2host-transport/test.conf
index 305a673162c5746a48b5408abb38e043201e8590..cf2e704fdf43ef0d5a5cf4c9a05c2bb1772f1826 100644 (file)
--- a/testing/tests/ikev2/host2host-transport/test.conf
+++ b/testing/tests/ikev2/host2host-transport/test.conf
@@ -6,11 +6,11 @@
 # All UML instances that are required for this test
 #
 UMLHOSTS="moon winnetou sun"
-
+ 
 # Corresponding block diagram
 #
 DIAGRAM="m-w-s.png"
- 
+
 # UML instances on which tcpdump is to be started
 #
 TCPDUMPHOSTS="sun"