testing: Add scenario that uses IKE-specific interface IDs

testing/tests/route-based/net2net-xfrmi-ike/hosts/moon/etc/strongswan.conf

@@ -0,0 +1,9 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
+}

testing/tests/route-based/net2net-xfrmi-ike/hosts/moon/etc/swanctl/swanctl.conf

@@ -0,0 +1,33 @@
+connections {
+
+   gw-gw {
+      local_addrs  = PH_IP_MOON
+      remote_addrs = PH_IP_SUN
+
+      if_id_out = 1337
+      if_id_in = 42
+
+      local {
+         auth = pubkey
+         certs = moonCert.pem
+         id = moon.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = sun.strongswan.org
+      }
+      children {
+         alice-net {
+            local_ts  = 10.1.0.10/32
+            remote_ts = 0.0.0.0/0
+
+            esp_proposals = aes128gcm128-x25519
+         }
+         venus-net : connections.gw-gw.children.alice-net {
+            local_ts  = 10.1.0.20/32
+         }
+      }
+      version = 2
+      proposals = aes128-sha256-x25519
+   }
+}

testing/tests/route-based/net2net-xfrmi-ike/hosts/sun/etc/strongswan.conf

@@ -0,0 +1,12 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default
+  start-scripts {
+    updown = /usr/bin/python /etc/updown.py
+  }
+}

testing/tests/route-based/net2net-xfrmi-ike/hosts/sun/etc/swanctl/swanctl.conf

@@ -0,0 +1,30 @@
+connections {
+
+   gw-gw {
+      local_addrs  = PH_IP_SUN
+      remote_addrs = PH_IP_MOON
+
+      if_id_in = %unique-dir
+      if_id_out = %unique-dir
+
+      local {
+         auth = pubkey
+         certs = sunCert.pem
+         id = sun.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = moon.strongswan.org
+      }
+      children {
+         net-net {
+            local_ts  = 10.2.0.0/16
+            remote_ts = 10.1.0.0/16
+
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      proposals = aes128-sha256-x25519
+   }
+}

testing/tests/route-based/net2net-xfrmi-ike/hosts/sun/etc/updown.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python
+
+import vici
+import daemon
+import logging
+from logging.handlers import SysLogHandler
+import subprocess
+
+
+logger = logging.getLogger('updownLogger')
+handler = SysLogHandler(address='/dev/log', facility=SysLogHandler.LOG_DAEMON)
+handler.setFormatter(logging.Formatter('charon-updown: %(message)s'))
+logger.addHandler(handler)
+logger.setLevel(logging.INFO)
+
+
+def handle_interfaces(ike_sa, up):
+    if_id_in = int(ike_sa['if-id-in'], 16)
+    if_id_out = int(ike_sa['if-id-out'], 16)
+    ifname_in = "xfrm-{}-in".format(if_id_in)
+    ifname_out = "xfrm-{}-out".format(if_id_out)
+
+    if up:
+        logger.info("add XFRM interfaces %s and %s", ifname_in, ifname_out)
+        subprocess.call(["/usr/local/libexec/ipsec/xfrmi", "-n", ifname_out,
+                         "-i", str(if_id_out), "-d", "eth0"])
+        subprocess.call(["/usr/local/libexec/ipsec/xfrmi", "-n", ifname_in,
+                         "-i", str(if_id_in), "-d", "eth0"])
+        subprocess.call(["ip", "link", "set", ifname_out, "up"])
+        subprocess.call(["ip", "link", "set", ifname_in, "up"])
+        subprocess.call(["iptables", "-A", "FORWARD", "-o", ifname_out,
+                         "-j", "ACCEPT"])
+        subprocess.call(["iptables", "-A", "FORWARD", "-i", ifname_in,
+                         "-j", "ACCEPT"])
+
+    else:
+        logger.info("delete XFRM interfaces %s and %s", ifname_in, ifname_out)
+        subprocess.call(["iptables", "-D", "FORWARD", "-o", ifname_out,
+                         "-j", "ACCEPT"])
+        subprocess.call(["iptables", "-D", "FORWARD", "-i", ifname_in,
+                         "-j", "ACCEPT"])
+        subprocess.call(["ip", "link", "del", ifname_out])
+        subprocess.call(["ip", "link", "del", ifname_in])
+
+
+def install_routes(ike_sa):
+    if_id_out = int(ike_sa['if-id-out'], 16)
+    ifname_out = "xfrm-{}-out".format(if_id_out)
+    child_sa = next(ike_sa["child-sas"].itervalues())
+
+    for ts in child_sa['remote-ts']:
+        logger.info("add route to %s via %s", ts, ifname_out)
+        subprocess.call(["ip", "route", "add", ts, "dev", ifname_out])
+
+
+# daemonize and run parallel to the IKE daemon
+with daemon.DaemonContext():
+    logger.debug("starting Python updown listener")
+    try:
+        session = vici.Session()
+        ver = session.version()
+        logger.info("connected to {daemon} {version} ({sysname}, {release}, "
+                    "{machine})".format(**ver))
+    except:
+        logger.error("failed to get status via vici")
+        sys.exit(1)
+
+    try:
+        for label, event in session.listen(["ike-updown", "child-updown"]):
+            logger.debug("received event: %s %s", label, repr(event))
+
+            name = next((x for x in iter(event) if x != "up"))
+            up = event.get("up", "") == "yes"
+            ike_sa = event[name]
+
+            if label == "ike-updown":
+                handle_interfaces(ike_sa, up)
+
+            elif label == "child-updown" and up:
+                install_routes(ike_sa)
+
+    except IOError:
+        logger.error("daemon disconnected")
+    except:
+        logger.error("exception while listening for events " +
+                     repr(sys.exc_info()[1]))