ikev2: Only request reauth during IKE_AUTH if active reauth is not possible

If we can initiate the reauthentication ourselves, there is no reason to explicitly request the peer to do so (at basically the same time).
2021-08-24 14:31:55 +02:00
parent 0d373e25e0
commit 23e46ea5ab
12 changed files with 62 additions and 39 deletions
@@ -1,7 +1,8 @@
 This scenario tests <b>repeated authentication</b> according to RFC 4478.
 The initiator <b>carol</b> sets a large <b>reauth_time=60m</b> but the responder
 <b>moon</b> defining a much shorter <b>reauth_time=30s</b> proposes this
-value via an AUTH_LIFETIME notification to the initiator. Thus the
+value via an AUTH_LIFETIME notification to the initiator as it can't initiate
+the reauthentication itself due to the EAP authentication. Thus the
 IKE reauthentication takes places after less than 30s. A ping from
 <b>carol</b> to client <b>alice</b> hiding in the subnet behind <b>moon</b>
 tests if the CHILD_SA has been recreated under the new IKE_SA.
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file

 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown md5 eap-tls
 }
@@ -9,12 +9,12 @@ connections {
      over_time = 10s

      local {
-         auth = pubkey
+         auth = eap-tls
         certs = carolCert.pem
         id = [email protected]
      }
      remote {
-         auth = pubkey
+         auth = eap-tls
         id = moon.strongswan.org
      }
      children {
@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file

 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac vici kernel-netlink socket-default updown md5 eap-tls
 }
@@ -9,12 +9,12 @@ connections {
      rand_time = 0

      local {
-         auth = pubkey
+         auth = eap-tls
         certs = moonCert.pem
         id = moon.strongswan.org
      }
      remote {
-         auth = pubkey
+         auth = eap-tls
      }
      children {
         net {
@@ -1,7 +1,8 @@
 This scenario tests <b>repeated authentication</b> according to RFC 4478.
 The initiator <b>carol</b> sets a short <b>reauth_time=20s</b> but the responder
 <b>moon</b> defining a much larger <b>reauth_time=60m</b> proposes this
-value via an AUTH_LIFETIME notification to the initiator. The initiator
+value via an AUTH_LIFETIME notification to the initiator as it can't initiate
+the reauthentication itself due to the virtual IP address. The initiator
 ignores this notification and schedules the IKE reauthentication at its
 configured time. A ping from <b>carol</b> to client <b>alice</b>
 hiding in the subnet behind <b>moon</b> tests if the CHILD_SA has been
@@ -1,5 +1,5 @@
-moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=PH_IP_MOON local-port=4500 local-id=moon.strongswan.org remote-host=PH_IP_CAROL remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
-carol::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=PH_IP_CAROL local-port=4500 [email protected] remote-host=PH_IP_MOON remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
+moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=PH_IP_MOON local-port=4500 local-id=moon.strongswan.org remote-host=PH_IP_CAROL remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.1/32]::YES
+carol::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=PH_IP_CAROL local-port=4500 [email protected] remote-host=PH_IP_MOON remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.1.0.0/16]::YES
 carol::cat /var/log/daemon.log::scheduling reauthentication in 20s::YES
 carol::cat /var/log/daemon.log::received AUTH_LIFETIME of 3600s, reauthentication already scheduled in 20s::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
@@ -4,6 +4,8 @@ connections {
      local_addrs  = PH_IP_CAROL
      remote_addrs = PH_IP_MOON

+      vips = 0.0.0.0
+
      # short lifetimes for testing purposes
      reauth_time = 20s
      over_time = 10s
@@ -3,6 +3,8 @@ connections {
   rw {
      local_addrs = PH_IP_MOON

+      pools = rw
+
      # short lifetimes for testing purposes
      reauth_time = 60m
      over_time = 10s
@@ -28,3 +30,9 @@ connections {
      proposals = aes128-sha256-x25519
   }
 }
+
+pools {
+   rw {
+      addrs = 10.3.0.0/24
+   }
+}