From ab13c1c8089dbb11166f2426ae0c05bdf119f79d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 26 Jun 2023 14:20:14 +0200 Subject: [PATCH 01/19] testing: Configure curve25519-sha256 as key exchange for SSH With Debian bookworm, the PQC KE sntrup761x25519-sha512 is negotiated, by default. This increases the overhead significantly, in particular, the size of the KE message, which wouldn't get through IPsec tunnels without MSS clamping. --- testing/hosts/default/etc/ssh/sshd_config | 1 + 1 file changed, 1 insertion(+) diff --git a/testing/hosts/default/etc/ssh/sshd_config b/testing/hosts/default/etc/ssh/sshd_config index f4ced3e37..700c7caaf 100644 --- a/testing/hosts/default/etc/ssh/sshd_config +++ b/testing/hosts/default/etc/ssh/sshd_config @@ -1,6 +1,7 @@ Port 22 Protocol 2 Ciphers aes128-gcm@openssh.com +KexAlgorithms curve25519-sha256 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ecdsa_key PermitRootLogin yes From e604947df875ad76726b21c098dafdc5305a79d8 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 26 Jun 2023 14:25:35 +0200 Subject: [PATCH 02/19] testing: Switch to MDB backend for OpenLDAP (slapd) The BDB and HDB backends were long deprecated and have finally been removed with OpenLDAP 2.5 that's shipped with Debian bookworm. --- testing/hosts/winnetou/etc/ldap/slapd.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/testing/hosts/winnetou/etc/ldap/slapd.conf b/testing/hosts/winnetou/etc/ldap/slapd.conf index 17a32c7f3..2fb8d41e9 100644 --- a/testing/hosts/winnetou/etc/ldap/slapd.conf +++ b/testing/hosts/winnetou/etc/ldap/slapd.conf @@ -3,7 +3,7 @@ # This file should NOT be world readable. # -moduleload back_bdb.la +moduleload back_mdb.la include /etc/ldap/schema/core.schema @@ -11,10 +11,10 @@ pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args ####################################################################### -# BDB database definitions +# Database definitions ####################################################################### -database bdb +database mdb suffix "o=strongSwan Project,c=CH" rootdn "cn=Manager,o=strongSwan Project,c=CH" checkpoint 32 30 From fbc25f1c25a4ca03584b489509351f6c3fcaa71e Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 26 Jun 2023 14:30:01 +0200 Subject: [PATCH 03/19] leak-detective: Whitelist C++'s __cxa_get_globals() --- src/libstrongswan/utils/leak_detective.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libstrongswan/utils/leak_detective.c b/src/libstrongswan/utils/leak_detective.c index 0f9665843..437eddab7 100644 --- a/src/libstrongswan/utils/leak_detective.c +++ b/src/libstrongswan/utils/leak_detective.c @@ -666,6 +666,8 @@ static char *whitelist[] = { "botan_privkey_load", "botan_privkey_load_rsa_pkcs1", "botan_kdf", + /* C++ due to Botan */ + "__cxa_get_globals", }; /** From c1dbce29ed3f637a78bd910e92181b21e77144b7 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 26 Jun 2023 14:36:03 +0200 Subject: [PATCH 04/19] testing: Remove support for Debian stretch --- testing/scripts/build-baseimage | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage index 26786a916..7d51ec722 100755 --- a/testing/scripts/build-baseimage +++ b/testing/scripts/build-baseimage @@ -31,10 +31,6 @@ bullseye) ;; esac case "$BASEIMGSUITE" in -stretch) - INC=$INC,libahven5-dev,libxmlada-schema6-dev,libgmpada6-dev - INC=$INC,libalog2-dev - ;; buster) INC=$INC,libahven7-dev,libxmlada-schema8-dev,libgmpada8-dev INC=$INC,libalog4-dev,dbus-user-session @@ -153,14 +149,10 @@ do execute_chroot "systemctl disable $service" done -case "$BASEIMGSUITE" in -buster|bullseye) - log_action "Switching from iptables-nft to iptables-legacy" - execute_chroot "update-alternatives --set iptables /usr/sbin/iptables-legacy" 0 - execute_chroot "update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy" 0 - log_status 0 - ;; -esac +log_action "Switching from iptables-nft to iptables-legacy" +execute_chroot "update-alternatives --set iptables /usr/sbin/iptables-legacy" 0 +execute_chroot "update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy" 0 +log_status 0 log_action "Disabling root password" execute_chroot "passwd -d root" From 6b8b67be81b0dba48889c0c5b4a10a1f7533530f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 27 Jun 2023 18:01:29 +0200 Subject: [PATCH 05/19] testing: Fix systemctl wrapper and adapt enabling services on winnetou The wrapper called the command twice for any unit but "strongswan" and it didn't return the correct exit code. This was noticed when an if-updown script tried to check if systemd-resolved is active and always succeeded, which caused failing attempts to configure it. But now that the return code is correct, trying to enable bind9 won't fail silently anymore if the unit doesn't exist (similar on older systems for named), so this is adapted. --- testing/hosts/default/usr/local/bin/systemctl | 5 ++++- testing/scripts/build-guestimages | 17 +++++++++++++---- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/testing/hosts/default/usr/local/bin/systemctl b/testing/hosts/default/usr/local/bin/systemctl index 0fc264fee..51e188c0e 100755 --- a/testing/hosts/default/usr/local/bin/systemctl +++ b/testing/hosts/default/usr/local/bin/systemctl @@ -8,7 +8,7 @@ ORIG=/bin/systemctl CONF=/lib/systemd/system/strongswan.service if [[ "$2" != "strongswan" ]]; then - $ORIG "$@" + exec $ORIG "$@" fi if [[ "$1" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then @@ -16,7 +16,10 @@ if [[ "$1" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then fi $ORIG "$@" +STATUS=$? if [[ "$1" == "stop" ]]; then sed -i '/LEAK_DETECTIVE_LOG/d' $CONF 2>/dev/null fi + +exit $STATUS diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages index 3619b5e94..cef1a8297 100755 --- a/testing/scripts/build-guestimages +++ b/testing/scripts/build-guestimages @@ -76,10 +76,19 @@ do execute_chroot "dnssec-signzone -K /etc/bind -o org. /etc/bind/db.org" 0 execute_chroot "dnssec-signzone -K /etc/bind -o . /etc/bind/db.root" 0 - # on bullseye, enabling via bind9 doesn't work, while disabling does, so - # use named there. on the other hand, older releases don't have named - # service files (systemctl returns 0 even if files are not found) - for service in apache2 slapd bind9 named + # on bullseye and newer, enabling via bind9 doesn't work, while + # disabling does, so use named here. on the other hand, older releases + # like buster don't have named service files + SERVICES="apache2 slapd" + case "$BASEIMGSUITE" in + buster) + SERVICES="$SERVICES bind9" + ;; + *) + SERVICES="$SERVICES named" + ;; + esac + for service in $SERVICES do execute_chroot "systemctl enable $service" 0 done From e0f0f812c7754c664e8be832fccbc94d4a6514a1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 27 Jun 2023 18:40:24 +0200 Subject: [PATCH 06/19] testing: Create traditional RSA keys with OpenSSL 3 This is necessary because TKM can't read PKCS#8 files and in some scenarios we don't have the pkcs8 plugin loaded that would be required to read/decrypt the non-traditional files. --- testing/scripts/build-certs-chroot | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/testing/scripts/build-certs-chroot b/testing/scripts/build-certs-chroot index 053061aa6..6321845ed 100755 --- a/testing/scripts/build-certs-chroot +++ b/testing/scripts/build-certs-chroot @@ -10,6 +10,12 @@ export LEAK_DETECTIVE_DISABLE=1 # Determine testing directory DIR="$(dirname `readlink -f $0`)/.." +# With OpenSSL 3, we need to generate RSA private keys in the traditional format +# and not PKCS#8 so e.g. TKM can read them +if [ 3 -ge $(openssl version | sed -re 's/^OpenSSL ([0-9]+)\..*/\1/') ]; then + TRAD="-traditional" +fi + # Define some global variables PROJECT="strongSwan Project" CA_DIR="${DIR}/hosts/winnetou/etc/ca" @@ -166,7 +172,7 @@ do # Convert host key into DER format openssl rsa -in ${HOST_KEY} -outform der -out ${CA_DIR}/keys/${h}Key.der \ - 2> /dev/null + ${TRAD} 2> /dev/null done # Put DER-encoded moon private key and Root CA certificate into tkm scenarios @@ -413,7 +419,7 @@ pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_BASE_CDP} --type rs HOST_KEY="${DIR}/hosts/carol/${IPSEC_DIR}/private/carolKey.pem" KEY_PWD="nH5ZQEWtku0RJEZ6" openssl rsa -in ${HOST_KEY} -aes128 --passout pass:${KEY_PWD} -out ${HOST_KEY} \ - 2> /dev/null + ${TRAD} 2> /dev/null # Put a copy into the ikev2, botan and wolfssl rw-cert scenarios for d in ikev2 botan wolfssl @@ -615,7 +621,7 @@ pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-224, CN=${CN}" \ --digest sha224 --outform pem > ${TEST_CERT} openssl rsa -in ${TEST_KEY} -aes128 --passout pass:${KEY_PWD} -out ${TEST_KEY} \ - 2> /dev/null + ${TRAD} 2> /dev/null cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem # Generate an AES-192 encrypted carol key and a SHA-384 hashed certificate @@ -632,7 +638,7 @@ pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-384, CN=${CN}" \ --digest sha384 --outform pem > ${TEST_CERT} openssl rsa -in ${TEST_KEY} -aes192 --passout pass:${KEY_PWD} -out ${TEST_KEY} \ - 2> /dev/null + ${TRAD} 2> /dev/null cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem # Generate an AES-256 encrypted dave key and a SHA-512 hashed certificate @@ -649,7 +655,7 @@ pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-512, CN=${CN}" \ --digest sha512 --outform pem > ${TEST_CERT} openssl rsa -in ${TEST_KEY} -aes256 --passout pass:${KEY_PWD} -out ${TEST_KEY} \ - 2> /dev/null + ${TRAD} 2> /dev/null cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem # Generate another carol certificate with an OCSP URI @@ -948,8 +954,8 @@ pki --issue --cakey ${RESEARCH_KEY} --cacert ${RESEARCH_CERT} --type rsa \ cp ${TEST_CERT} ${RESEARCH_DIR}/certs/${SERIAL}.pem # Save a copy of the private key in DER format -openssl rsa -in ${TEST_KEY} -outform der \ - -out ${RESEARCH_DIR}/keys/${SERIAL}.der 2> /dev/null +openssl rsa -in ${TEST_KEY} -outform der -out ${RESEARCH_DIR}/keys/${SERIAL}.der \ + ${TRAD} 2> /dev/null # Put a copy in the following scenarios for t in ikev2-multi-ca/certreq-init ikev2-multi-ca/certreq-resp \ @@ -1056,8 +1062,8 @@ pki --issue --cakey ${SALES_KEY} --cacert ${SALES_CERT} --type rsa \ cp ${TEST_CERT} ${SALES_DIR}/certs/${SERIAL}.pem # Save a copy of the private key in DER format -openssl rsa -in ${TEST_KEY} -outform der \ - -out ${SALES_DIR}/keys/${SERIAL}.der 2> /dev/null +openssl rsa -in ${TEST_KEY} -outform der -out ${SALES_DIR}/keys/${SERIAL}.der \ + ${TRAD} 2> /dev/null # Put a copy in the following scenarios for t in ikev2-multi-ca/certreq-init ikev2-multi-ca/certreq-resp \ From 744955f8ce418e62c374da0695d43c52a9368d32 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 27 Jun 2023 18:41:42 +0200 Subject: [PATCH 07/19] testing: Whitelist all Git repositories in the root image Without this, Git refuses to operate on the build dirs that are mounted with weird ownership. When running as root in the chroot, Git checks SUDO_UID, which won't match. --- testing/scripts/build-strongswan | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/testing/scripts/build-strongswan b/testing/scripts/build-strongswan index f7eeb6fed..1956e132d 100755 --- a/testing/scripts/build-strongswan +++ b/testing/scripts/build-strongswan @@ -165,6 +165,10 @@ if [ "$ALL_RECIPES" ]; then execute "cp -r $RECPDIR/patches $LOOPDIR/root/shared/compile" 0 fi RECIPES=`ls $RECPDIR/*.mk | xargs -n1 basename` + log_action "Whitelist all Git repositories" + echo "[safe]" > $LOOPDIR/root/.gitconfig + echo " directory = *" >> $LOOPDIR/root/.gitconfig + log_status 0 else echo "Building and installing strongSwan" RECIPES=`ls $RECPDIR/*strongswan.mk | xargs -n1 basename` From 995d7785b945990573e0054411a418ff5251fdee Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 27 Jun 2023 18:45:53 +0200 Subject: [PATCH 08/19] testing: Fix vici updown script on Debian bookworm OOM-killer is now already triggered with `import daemon`, so set the limit before that. Also some PEP8 fixes (including an exclusion for the above fix as that causes imports to not be at the beginning of the file). --- .../net2net-xfrmi-ike/hosts/sun/etc/updown.py | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/testing/tests/route-based/net2net-xfrmi-ike/hosts/sun/etc/updown.py b/testing/tests/route-based/net2net-xfrmi-ike/hosts/sun/etc/updown.py index 4abc1aa54..813a3e1ac 100755 --- a/testing/tests/route-based/net2net-xfrmi-ike/hosts/sun/etc/updown.py +++ b/testing/tests/route-based/net2net-xfrmi-ike/hosts/sun/etc/updown.py @@ -2,11 +2,18 @@ import sys import vici -import daemon import logging from logging.handlers import SysLogHandler import subprocess + +# the hard limit (second number) is the value used by python-daemon when closing +# potentially open file descriptors while daemonizing or even triggered by the +# import. since the default limit is 524288 on newer systems, this can take +# quite a while, and due to how this range of FDs is handled internally (as set) +# it can even trigger the OOM killer import resource +resource.setrlimit(resource.RLIMIT_NOFILE, (256, 256)) # noqa +import daemon logger = logging.getLogger('updownLogger') @@ -59,13 +66,6 @@ def install_routes(ike_sa): subprocess.call(["ip", "route", "add", ts, "dev", ifname_out]) -# the hard limit (second number) is the value used by python-daemon when closing -# potentially open file descriptors while daemonizing. since the default is -# 524288 on newer systems, this can take quite a while, and due to how this -# range of FDs is handled internally (as set) it can even trigger the OOM killer -resource.setrlimit(resource.RLIMIT_NOFILE, (256, 256)) - - # daemonize and run parallel to the IKE daemon with daemon.DaemonContext(): setup_logger() @@ -75,7 +75,7 @@ with daemon.DaemonContext(): ver = {k: v.decode("UTF-8") for k, v in session.version().items()} logger.info("connected to {daemon} {version} ({sysname}, {release}, " "{machine})".format(**ver)) - except: + except BaseException: logger.error("failed to get status via vici") sys.exit(1) @@ -95,6 +95,6 @@ with daemon.DaemonContext(): except IOError: logger.error("daemon disconnected") - except: + except BaseException as e: logger.error("exception while listening for events " + - repr(sys.exc_info()[1])) + repr(e)) From 55273157b01560800fd2c67bbdaad4b4fbe58ba8 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 27 Jun 2023 19:03:32 +0200 Subject: [PATCH 09/19] libimcv: Add Debian 12 (bookworm) to database Because libcrypto and libssl are measured, we need a new group for Debian versions with OpenSSL 3 (I've rather added a suffix to the old group as that could eventually get removed, although we might need a 3.1 variant in the future - maybe we should measure some other files?). --- src/libimcv/imv/data.sql | 56 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 1 deletion(-) diff --git a/src/libimcv/imv/data.sql b/src/libimcv/imv/data.sql index 1b32d28d4..88e1e330f 100644 --- a/src/libimcv/imv/data.sql +++ b/src/libimcv/imv/data.sql @@ -616,6 +616,12 @@ INSERT INTO products ( /* 103 */ 'Debian 11 x86_64' ); +INSERT INTO products ( /* 104 */ + name +) VALUES ( + 'Debian 12 x86_64' +); + /* Directories */ INSERT INTO directories ( /* 1 */ @@ -740,6 +746,18 @@ INSERT INTO files ( /* 6 */ 'tnc_config', 2 ); +INSERT INTO files ( /* 7 */ + name, dir +) VALUES ( + 'libcrypto.so.3', 11 +); + +INSERT INTO files ( /* 8 */ + name, dir +) VALUES ( + 'libssl.so.3', 11 +); + /* Algorithms */ INSERT INTO algorithms ( @@ -995,7 +1013,7 @@ INSERT INTO groups ( /* 4 */ INSERT INTO groups ( /* 5 */ name, parent ) VALUES ( - 'Debian x86_64', 2 + 'Debian x86_64 OpenSSL 1.1', 2 ); INSERT INTO groups ( /* 6 */ @@ -1064,6 +1082,12 @@ INSERT INTO groups ( /* 16 */ 'TPM TBOOT' ); +INSERT INTO groups ( /* 17 */ + name, parent +) VALUES ( + 'Debian x86_64', 2 +); + /* Default Product Groups */ INSERT INTO groups_product_defaults ( @@ -1678,6 +1702,12 @@ INSERT INTO groups_product_defaults ( 15, 79 ); +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 17, 104 +); + /* Policies */ INSERT INTO policies ( /* 1 */ @@ -1812,6 +1842,18 @@ INSERT INTO policies ( /* 22 */ 16, 'TPM TBOOT Measurements', 'T', 2, 2 ); +INSERT INTO policies ( /* 23 */ + type, name, file, rec_fail, rec_noresult +) VALUES ( + 6, 'Measure /usr/lib/x86_64-linux-gnu/libcrypto.so.3', 7, 2, 2 +); + +INSERT INTO policies ( /* 24 */ + type, name, file, rec_fail, rec_noresult +) VALUES ( + 6, 'Measure /usr/lib/x86_64-linux-gnu/libssl.so.3', 8, 2, 2 +); + /* Enforcements */ INSERT INTO enforcements ( /* 1 */ @@ -1922,6 +1964,18 @@ INSERT INTO enforcements ( /* 18 */ 22, 16, 60 ); +INSERT INTO enforcements ( /* 19 */ + policy, group_id, max_age +) VALUES ( + 23, 17, 86400 +); + +INSERT INTO enforcements ( /* 20 */ + policy, group_id, max_age +) VALUES ( + 24, 17, 86400 +); + /* swid_entities */ INSERT INTO "swid_entities" ( /* 1 */ From 9b8f26b407d9e90e8eeba02134568d7bf4a566d1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 28 Jun 2023 15:49:32 +0200 Subject: [PATCH 10/19] testing: Install python-daemon via Debian package System-wide installation via pip isn't easily possible anymore on Debian bookworm, so just use the Debian package for this (is available in old releases as well). --- testing/scripts/build-baseimage | 4 ++-- testing/scripts/recipes/013_strongswan.mk | 2 -- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage index 7d51ec722..e5c912a9a 100755 --- a/testing/scripts/build-baseimage +++ b/testing/scripts/build-baseimage @@ -19,8 +19,8 @@ INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libltdl-dev,wget,gnupg,man-db INC=$INC,libboost-thread-dev,libboost-system-dev,git,iperf,htop,valgrind,strace INC=$INC,gnat,gprbuild,acpid,acpi-support-base,libldns-dev,libunbound-dev INC=$INC,dnsutils,libsoup2.4-dev,ca-certificates,unzip,libsystemd-dev -INC=$INC,python3,python3-setuptools,python3-dev,python3-pip,apt-transport-https -INC=$INC,libjson-c-dev,libxslt1-dev,libapache2-mod-wsgi-py3 +INC=$INC,python3,python3-setuptools,python3-dev,python3-pip,python3-daemon, +INC=$INC,apt-transport-https,libjson-c-dev,libxslt1-dev,libapache2-mod-wsgi-py3 INC=$INC,libxerces-c-dev case "$BASEIMGSUITE" in bullseye) diff --git a/testing/scripts/recipes/013_strongswan.mk b/testing/scripts/recipes/013_strongswan.mk index fb80b4e85..c318ac8c9 100644 --- a/testing/scripts/recipes/013_strongswan.mk +++ b/testing/scripts/recipes/013_strongswan.mk @@ -130,5 +130,3 @@ build: configure install: build cd $(BUILDDIR) && make -j install && \ cd $(DIR)/src/libcharon/plugins/vici/python && python3 setup.py install - # for Python-based updown scripts - pip3 install python-daemon From 21bf3e41f94a95fe8a431c08deead91a65b501d8 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 28 Jun 2023 15:52:57 +0200 Subject: [PATCH 11/19] testing: Use venv for strongTNC Also updated to a newer version to fix dependency issues. --- testing/hosts/default/usr/local/bin/init_tnc | 4 +++- testing/scripts/build-baseimage | 2 +- testing/scripts/recipes/015_strongTNC.mk | 6 ++++-- .../alice/etc/apache2/sites-available/000-default.conf | 1 + .../alice/etc/apache2/sites-available/000-default.conf | 1 + .../alice/etc/apache2/sites-available/000-default.conf | 1 + 6 files changed, 11 insertions(+), 4 deletions(-) diff --git a/testing/hosts/default/usr/local/bin/init_tnc b/testing/hosts/default/usr/local/bin/init_tnc index 49084e477..2c93a6861 100755 --- a/testing/hosts/default/usr/local/bin/init_tnc +++ b/testing/hosts/default/usr/local/bin/init_tnc @@ -4,9 +4,11 @@ cd /var/www/tnc if [ -f django.db ] then - exit 0 + exit 0 fi +. /usr/local/venvs/tnc/bin/activate + ./manage.py migrate --database meta ./manage.py setpassword strongSwan strongSwan ./manage.py collectstatic --noinput diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage index e5c912a9a..c2fa40814 100755 --- a/testing/scripts/build-baseimage +++ b/testing/scripts/build-baseimage @@ -19,7 +19,7 @@ INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libltdl-dev,wget,gnupg,man-db INC=$INC,libboost-thread-dev,libboost-system-dev,git,iperf,htop,valgrind,strace INC=$INC,gnat,gprbuild,acpid,acpi-support-base,libldns-dev,libunbound-dev INC=$INC,dnsutils,libsoup2.4-dev,ca-certificates,unzip,libsystemd-dev -INC=$INC,python3,python3-setuptools,python3-dev,python3-pip,python3-daemon, +INC=$INC,python3,python3-setuptools,python3-dev,python3-daemon,python3-venv, INC=$INC,apt-transport-https,libjson-c-dev,libxslt1-dev,libapache2-mod-wsgi-py3 INC=$INC,libxerces-c-dev case "$BASEIMGSUITE" in diff --git a/testing/scripts/recipes/015_strongTNC.mk b/testing/scripts/recipes/015_strongTNC.mk index 973cdabef..4cc08993c 100644 --- a/testing/scripts/recipes/015_strongTNC.mk +++ b/testing/scripts/recipes/015_strongTNC.mk @@ -1,11 +1,12 @@ #!/usr/bin/make PKG = strongTNC -REV = 1.0 +REV = 1.0.2 DIR = $(PKG)-$(REV) ZIP = $(PKG)-$(REV).zip SRC = https://github.com/strongswan/$(PKG)/archive/$(REV).zip DEPS = $(PKG)-deps +VENV = /usr/local/venvs/tnc all: install @@ -22,5 +23,6 @@ $(ZIP): @touch $@ install: .$(PKG)-deps-$(REV) - pip3 install --no-index --find-links=file://`pwd`/$(DEPS) -r $(DIR)/requirements.txt + python3 -m venv $(VENV) + $(VENV)/bin/pip install --no-index --find-links=file://`pwd`/$(DEPS) -r $(DIR)/requirements.txt cp -r $(DIR) /var/www/tnc && chgrp -R www-data /var/www/tnc && chmod g+sw /var/www/tnc diff --git a/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/alice/etc/apache2/sites-available/000-default.conf b/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/alice/etc/apache2/sites-available/000-default.conf index 4075f75bd..f2d62aaf6 100644 --- a/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/alice/etc/apache2/sites-available/000-default.conf +++ b/testing/tests/tnc/tnccs-20-ev-pt-tls/hosts/alice/etc/apache2/sites-available/000-default.conf @@ -1,3 +1,4 @@ +WSGIPythonHome /usr/local/venvs/tnc WSGIPythonPath /var/www/tnc diff --git a/testing/tests/tnc/tnccs-20-pdp-eap/hosts/alice/etc/apache2/sites-available/000-default.conf b/testing/tests/tnc/tnccs-20-pdp-eap/hosts/alice/etc/apache2/sites-available/000-default.conf index cd5056e83..ac447ee6e 100644 --- a/testing/tests/tnc/tnccs-20-pdp-eap/hosts/alice/etc/apache2/sites-available/000-default.conf +++ b/testing/tests/tnc/tnccs-20-pdp-eap/hosts/alice/etc/apache2/sites-available/000-default.conf @@ -1,3 +1,4 @@ +WSGIPythonHome /usr/local/venvs/tnc WSGIPythonPath /var/www/tnc diff --git a/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/alice/etc/apache2/sites-available/000-default.conf b/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/alice/etc/apache2/sites-available/000-default.conf index cd5056e83..ac447ee6e 100644 --- a/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/alice/etc/apache2/sites-available/000-default.conf +++ b/testing/tests/tnc/tnccs-20-pdp-pt-tls/hosts/alice/etc/apache2/sites-available/000-default.conf @@ -1,3 +1,4 @@ +WSGIPythonHome /usr/local/venvs/tnc WSGIPythonPath /var/www/tnc From 6f7fdcadd1fbda3a9b0a88d9b1af9b98e5960418 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 28 Jun 2023 15:54:54 +0200 Subject: [PATCH 12/19] testing: Add support for Debian bookworm base images By default, rsyslog is not installed anymore to avoid storing everything twice (since journald is the default). If this becomes an issue, we could delete /var/log/journal to only log via rsyslog. --- testing/scripts/build-baseimage | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage index c2fa40814..257cbfe3a 100755 --- a/testing/scripts/build-baseimage +++ b/testing/scripts/build-baseimage @@ -21,13 +21,13 @@ INC=$INC,gnat,gprbuild,acpid,acpi-support-base,libldns-dev,libunbound-dev INC=$INC,dnsutils,libsoup2.4-dev,ca-certificates,unzip,libsystemd-dev INC=$INC,python3,python3-setuptools,python3-dev,python3-daemon,python3-venv, INC=$INC,apt-transport-https,libjson-c-dev,libxslt1-dev,libapache2-mod-wsgi-py3 -INC=$INC,libxerces-c-dev +INC=$INC,libxerces-c-dev,rsyslog case "$BASEIMGSUITE" in -bullseye) - INC=$INC,libiptc-dev +buster) + INC=$INC,iptables-dev ;; *) - INC=$INC,iptables-dev + INC=$INC,libiptc-dev ;; esac case "$BASEIMGSUITE" in @@ -42,6 +42,13 @@ bullseye) # package (libboost-regex1.74.0-icu67), which debootstrap can't resolve (#878961) INC=$INC,libboost-regex1.74.0 ;; +bookworm) + INC=$INC,libahven11-dev,libxmlada-schema12-dev,libgmpada12-dev + INC=$INC,libalog8-dev,dbus-user-session + # workaround for dependency issue gdb -> libsource-highlight4v5 -> virtual + # package (libboost-regex1.74.0-icu67), which debootstrap can't resolve (#878961) + INC=$INC,libboost-regex1.74.0 + ;; *) echo_warn "Package list for '$BASEIMGSUITE' might has to be updated" ;; @@ -52,7 +59,13 @@ INC=$INC,${SERVICES// /,} APT1="libgcrypt20-dev traceroute iptables" APT="tmux" # additional services to disable -SERVICES="$SERVICES systemd-timesyncd.service" +case "$BASEIMGSUITE" in +bookworm) + ;; +*) + SERVICES="$SERVICES systemd-timesyncd" + ;; +esac CACHEDIR=$BUILDDIR/cache APTCACHE=$LOOPDIR/var/cache/apt/archives From dee9bfb68249b716dd9225d2597043388be720df Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 28 Jun 2023 15:55:21 +0200 Subject: [PATCH 13/19] testing: Update TKM dependencies to fix compilation with newer GNAT versions --- testing/scripts/recipes/004_spark-crypto.mk | 2 +- testing/scripts/recipes/007_x509-ada.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/testing/scripts/recipes/004_spark-crypto.mk b/testing/scripts/recipes/004_spark-crypto.mk index 00965a587..a4a26a9bf 100644 --- a/testing/scripts/recipes/004_spark-crypto.mk +++ b/testing/scripts/recipes/004_spark-crypto.mk @@ -2,7 +2,7 @@ PKG = spark-crypto SRC = https://git.codelabs.ch/spark-crypto.git -REV = c97939b6cdd5e5f19847cf8d1abb7575e1c01df7 +REV = 153590e2fc784d3173b73642fafa4efb597bb2f3 DESTDIR = /usr/local/ada/lib/gnat diff --git a/testing/scripts/recipes/007_x509-ada.mk b/testing/scripts/recipes/007_x509-ada.mk index e096cef66..27f894eab 100644 --- a/testing/scripts/recipes/007_x509-ada.mk +++ b/testing/scripts/recipes/007_x509-ada.mk @@ -2,7 +2,7 @@ PKG = x509-ada SRC = https://git.codelabs.ch/git/$(PKG).git -REV = v0.1.2 +REV = v0.1.3 PREFIX = /usr/local/ada From 043e10ebb87a2b9782c8b50bc23fff53e5aefbeb Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 13 Jul 2023 10:47:51 +0200 Subject: [PATCH 14/19] testing: Use Debian bookworm to test TKM --- testing/tkm/Dockerfile | 6 +++--- testing/tkm/generate-config.sh | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/testing/tkm/Dockerfile b/testing/tkm/Dockerfile index f4e8d5071..04a0efd90 100644 --- a/testing/tkm/Dockerfile +++ b/testing/tkm/Dockerfile @@ -23,12 +23,12 @@ # # make -j check TESTS_RUNNERS=tkm TESTS_TKM=1 -FROM debian:bullseye +FROM debian:bookworm ARG packages="autoconf automake bison build-essential ca-certificates ccache \ flex gettext git gperf libssl-dev libtool pkg-config \ -gnat gprbuild libahven9-dev libxmlada-schema10-dev libgmpada10-dev \ -libalog6-dev" +gnat gprbuild libahven11-dev libxmlada-schema12-dev libgmpada12-dev \ +libalog8-dev" RUN apt-get update && \ DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \ diff --git a/testing/tkm/generate-config.sh b/testing/tkm/generate-config.sh index 1c12f840d..9bd5d4507 100755 --- a/testing/tkm/generate-config.sh +++ b/testing/tkm/generate-config.sh @@ -1,7 +1,7 @@ #!/bin/bash openssl genrsa -out key.pem 2048 -openssl rsa -in key.pem -outform der -out key.der +openssl rsa -in key.pem -outform der -out key.der -traditional openssl req -x509 -nodes -newkey rsa:4096 -keyout cakey.pem -outform der \ -out ca.der -sha256 -subj "/CN=CA" -addext basicConstraints=critical,CA:TRUE From 79ad33bfba85d501968c25829a601beecd15b519 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 28 Jun 2023 15:56:28 +0200 Subject: [PATCH 15/19] testing: Use Debian 12 (bookworm) --- testing/testing.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testing/testing.conf b/testing/testing.conf index 8a506aad3..b2348ad2e 100644 --- a/testing/testing.conf +++ b/testing/testing.conf @@ -49,7 +49,7 @@ fi # Base image settings # The base image is a pristine OS installation created using debootstrap. : ${BASEIMGSIZE=2500} -: ${BASEIMGSUITE=bullseye} +: ${BASEIMGSUITE=bookworm} : ${BASEIMGARCH=amd64} : ${BASEIMG=$IMGDIR/debian-$BASEIMGSUITE-$BASEIMGARCH.$IMGEXT} : ${BASEIMGMIRROR=http://http.debian.net/debian} From 872781734d43fcfae1b78ffa6d9a3f9d5138f17b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 20 Jul 2023 15:28:51 +0200 Subject: [PATCH 16/19] testing: Copy guest-specific files after default files This allows overriding some files per guest. --- testing/scripts/build-guestimages | 2 +- testing/scripts/restore-defaults | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages index cef1a8297..34cd91fe5 100755 --- a/testing/scripts/build-guestimages +++ b/testing/scripts/build-guestimages @@ -45,8 +45,8 @@ do execute "qemu-nbd -c $NBDEV $IMGDIR/$host.$IMGEXT" 0 partprobe $NBDEV execute "mount $NBDPARTITION $LOOPDIR" 0 - execute "cp -rf $HOSTSDIR/${host}/etc $LOOPDIR" 0 execute "cp -rf $HOSTSDIR/default/* $LOOPDIR" 0 + execute "cp -rf $HOSTSDIR/${host}/etc $LOOPDIR" 0 execute_chroot "ldconfig" 0 execute "mkdir $LOOPDIR/etc/pts" 0 diff --git a/testing/scripts/restore-defaults b/testing/scripts/restore-defaults index 95f3e5d84..0ef08f266 100755 --- a/testing/scripts/restore-defaults +++ b/testing/scripts/restore-defaults @@ -35,7 +35,7 @@ then for host in `ls $TESTSDIR/${testname}/hosts` do eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`" - scp $SSHCONF -r $HOSTCONFIGDIR/${host}/etc $HOSTLOGIN:/ > /dev/null 2>&1 scp $SSHCONF -r $HOSTCONFIGDIR/default/etc $HOSTLOGIN:/ > /dev/null 2>&1 + scp $SSHCONF -r $HOSTCONFIGDIR/${host}/etc $HOSTLOGIN:/ > /dev/null 2>&1 done fi From 732909ce1ece5047ec65d54027f79b66ace0df7d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 20 Jul 2023 15:29:35 +0200 Subject: [PATCH 17/19] testing: Hardcode /testresults mount point in winnetou's fstab Because do-tests runs the restore-defaults script, fstab would get reset to the default version and the mount point wouldn't be available anymore after stopping and restarting the guests (unless the guest images were rebuilt in between). --- testing/hosts/winnetou/etc/fstab | 3 +++ testing/scripts/build-guestimages | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 testing/hosts/winnetou/etc/fstab diff --git a/testing/hosts/winnetou/etc/fstab b/testing/hosts/winnetou/etc/fstab new file mode 100644 index 000000000..4d5f83dcd --- /dev/null +++ b/testing/hosts/winnetou/etc/fstab @@ -0,0 +1,3 @@ +/dev/vda1 / ext3 defaults,relatime,barrier=1 0 1 +/hostshare /root/shared 9p trans=virtio,version=9p2000.L 0 0 +/testresults /var/www/testresults 9p trans=virtio,version=9p2000.L 0 0 \ No newline at end of file diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages index 34cd91fe5..e289c08ca 100755 --- a/testing/scripts/build-guestimages +++ b/testing/scripts/build-guestimages @@ -62,8 +62,6 @@ do execute "cp -rf $DIR/../images $LOOPDIR/var/www/" 0 execute "cp -rf $DIR/../css $LOOPDIR/var/www/" 0 execute "mkdir $LOOPDIR/var/www/testresults" 0 - echo "echo /testresults ... >> $LOOPDIR/etc/fstab" >>$LOGFILE 2>&1 - echo "/testresults /var/www/testresults 9p trans=virtio,version=9p2000.L 0 0" >> $LOOPDIR/etc/fstab execute_chroot "a2enmod -q cgid" 0 execute_chroot "a2enmod -q rewrite" 0 execute_chroot "mkdir /var/www/certs" 0 From 99bd7ca2fd380447e0f8f817f345052b3a8ee176 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 14 Jul 2023 14:30:14 +0200 Subject: [PATCH 18/19] testing: Change memory allocation for alice and winnetou and switch to MiB The services running on alice seem to require a bit more memory with Debian bookworm, so increase the memory allocation. But at the same time reduce winnetou's allocation by the same amount as it really doesn't require that much memory. The unit change makes it easier to read. --- testing/config/kvm/alice.xml | 4 ++-- testing/config/kvm/bob.xml | 4 ++-- testing/config/kvm/carol.xml | 4 ++-- testing/config/kvm/dave.xml | 4 ++-- testing/config/kvm/moon.xml | 4 ++-- testing/config/kvm/sun.xml | 4 ++-- testing/config/kvm/venus.xml | 4 ++-- testing/config/kvm/winnetou.xml | 4 ++-- 8 files changed, 16 insertions(+), 16 deletions(-) diff --git a/testing/config/kvm/alice.xml b/testing/config/kvm/alice.xml index de8f5ab00..9cdb25166 100644 --- a/testing/config/kvm/alice.xml +++ b/testing/config/kvm/alice.xml @@ -1,8 +1,8 @@ alice 1f35c25d-6a7b-4ee1-2461-d7e530e7b2a9 - 184320 - 184320 + 200 + 200 1 hvm diff --git a/testing/config/kvm/bob.xml b/testing/config/kvm/bob.xml index 0854d10d5..982a1aac0 100644 --- a/testing/config/kvm/bob.xml +++ b/testing/config/kvm/bob.xml @@ -1,8 +1,8 @@ bob 72728516-377f-f5be-ea1d-b1f1e851538f - 131072 - 131072 + 128 + 128 1 hvm diff --git a/testing/config/kvm/carol.xml b/testing/config/kvm/carol.xml index 4d1a47e35..33dc08adc 100644 --- a/testing/config/kvm/carol.xml +++ b/testing/config/kvm/carol.xml @@ -1,8 +1,8 @@ carol 6bc2eef5-7faf-cde0-5f27-6fc29f93bc3d - 131072 - 131072 + 128 + 128 1 hvm diff --git a/testing/config/kvm/dave.xml b/testing/config/kvm/dave.xml index fb292944e..93ce82e63 100644 --- a/testing/config/kvm/dave.xml +++ b/testing/config/kvm/dave.xml @@ -1,8 +1,8 @@ dave 05f1debe-4e38-4f3d-10a0-c07fbb70d816 - 131072 - 131072 + 128 + 128 1 hvm diff --git a/testing/config/kvm/moon.xml b/testing/config/kvm/moon.xml index 0fd3dd98f..1623ac83b 100644 --- a/testing/config/kvm/moon.xml +++ b/testing/config/kvm/moon.xml @@ -1,8 +1,8 @@ moon b5e00ad3-1c81-3b2a-7f66-cdf8727b3c65 - 131072 - 131072 + 128 + 128 1 hvm diff --git a/testing/config/kvm/sun.xml b/testing/config/kvm/sun.xml index f9fbad4ae..5f32d1bc0 100644 --- a/testing/config/kvm/sun.xml +++ b/testing/config/kvm/sun.xml @@ -1,8 +1,8 @@ sun 35341843-346c-a63a-786b-9df0fd5e6264 - 147456 - 147456 + 144 + 144 1 hvm diff --git a/testing/config/kvm/venus.xml b/testing/config/kvm/venus.xml index c01c410ce..07e1b995d 100644 --- a/testing/config/kvm/venus.xml +++ b/testing/config/kvm/venus.xml @@ -1,8 +1,8 @@ venus f0838df9-7cc0-84f5-6c14-2d16ab002e8d - 131072 - 131072 + 128 + 128 1 hvm diff --git a/testing/config/kvm/winnetou.xml b/testing/config/kvm/winnetou.xml index 03cb876b1..aa259d06f 100644 --- a/testing/config/kvm/winnetou.xml +++ b/testing/config/kvm/winnetou.xml @@ -1,8 +1,8 @@ winnetou b1d3d2f7-e20b-ab95-277e-66d4cac33cc3 - 184320 - 184320 + 160 + 160 1 hvm From 4ba857930cb8192f40dec4b3fc77c6587234a2d3 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 26 Jul 2023 13:05:56 +0200 Subject: [PATCH 19/19] testing: Format total time in a more readable way --- testing/do-tests | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/testing/do-tests b/testing/do-tests index 75b6b3e34..5880c958a 100755 --- a/testing/do-tests +++ b/testing/do-tests @@ -957,6 +957,8 @@ done # finish the results html file # +printf -v timetotal_fmt '%02d:%02d:%02d' $((timetotal/3600)) $((timetotal%3600/60)) $((timetotal%60)) + cat >> $TESTRESULTSHTML << @EOF      @@ -968,7 +970,7 @@ cat >> $TESTRESULTSHTML << @EOF Failed$failed_cnt   - Time [s]$timetotal   + Time$timetotal_fmt (${timetotal}s)   @@ -1014,4 +1016,4 @@ echo "or via the link http://$ipv4_winnetou/testresults/$TESTDATE" ENDDATE=`date +%Y%m%d-%H%M-%S` echo -echo "Finished : $ENDDATE" +echo "Finished : $ENDDATE ($timetotal_fmt)"