denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Add ikev2/start-action-start scenario

Browse Source 
This tests the behavior for configs with start_action=start during
reloads of the config (updates/removal).
This commit is contained in:
Tobias Brunner
2024-07-26 16:56:32 +02:00
parent 7bfaa9acb6
commit 56b6eeb385
12 changed files with 545 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/start-action-start/hosts/moon/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default updown
}
testing/tests/ikev2/start-action-start/hosts/moon/etc/swanctl/conf.d/swanctl-base.conf
Executable
+161
View File
@@ -0,0 +1,161 @@
# basic settings for these test configs
base-conn {
local_addrs = 192.168.0.1
remote_addrs = 192.168.0.2
local {
auth = psk
}
remote {
auth = psk
}
}
connections {
# when updating, we'll change ike/peer parameters for these
one-start : base-conn {
local {
id = moon-one
}
remote {
id = sun-one
}
children {
one-start {
local_ts = dynamic[tcp/1001]
remote_ts = dynamic[tcp/1001]
start_action = start
}
}
}
two-start : base-conn {
local {
id = moon-two
}
remote {
id = sun-two
}
children {
two-start-1 {
local_ts = dynamic[tcp/2001]
remote_ts = dynamic[tcp/2001]
start_action = start
}
two-start-2 {
local_ts = dynamic[tcp/2002]
remote_ts = dynamic[tcp/2002]
start_action = start
}
}
}
four-start : base-conn {
local {
id = moon-four
}
remote {
id = sun-four
}
children {
four-start-1 {
local_ts = dynamic[tcp/4001]
remote_ts = dynamic[tcp/4001]
start_action = start
}
four-start-2 {
local_ts = dynamic[tcp/4002]
remote_ts = dynamic[tcp/4002]
start_action = start
}
four-start-3 {
local_ts = dynamic[tcp/4003]
remote_ts = dynamic[tcp/4003]
start_action = start
}
four-start-4 {
local_ts = dynamic[tcp/4004]
remote_ts = dynamic[tcp/4004]
start_action = start
}
}
}
# when updating, we'll change only child parameters for these
one-start-child : base-conn {
local {
id = moon-one-child
}
remote {
id = sun-one-child
}
children {
one-start-child {
local_ts = dynamic[tcp/1101]
remote_ts = dynamic[tcp/1101]
start_action = start
}
}
}
two-start-child : base-conn {
local {
id = moon-two-child
}
remote {
id = sun-two-child
}
children {
two-start-child-1 {
local_ts = dynamic[tcp/2201]
remote_ts = dynamic[tcp/2201]
start_action = start
}
two-start-child-2 {
local_ts = dynamic[tcp/2202]
remote_ts = dynamic[tcp/2202]
start_action = start
}
}
}
four-start-child : base-conn {
local {
id = moon-four-child
}
remote {
id = sun-four-child
}
children {
four-start-child-1 {
local_ts = dynamic[tcp/4401]
remote_ts = dynamic[tcp/4401]
start_action = start
}
four-start-child-2 {
local_ts = dynamic[tcp/4402]
remote_ts = dynamic[tcp/4402]
start_action = start
}
four-start-child-3 {
local_ts = dynamic[tcp/4403]
remote_ts = dynamic[tcp/4403]
start_action = start
}
four-start-child-4 {
local_ts = dynamic[tcp/4404]
remote_ts = dynamic[tcp/4404]
start_action = start
}
}
}
}
secrets {
ike {
secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
}
}
testing/tests/ikev2/start-action-start/hosts/moon/etc/swanctl/swanctl-remove.conf
Executable
+75
View File
@@ -0,0 +1,75 @@
# basic settings for these test configs
base-conn {
local_addrs = 192.168.0.1
remote_addrs = 192.168.0.2
local {
auth = psk
}
remote {
auth = psk
}
}
connections {
# the initial connections are removed completely
# here all child configs are removed
one-start-child : base-conn {
local {
id = moon-one-child
}
remote {
id = sun-one-child
}
}
# here only one is removed, the other remains unchanged
two-start-child : base-conn {
local {
id = moon-two-child
}
remote {
id = sun-two-child
}
children {
two-start-child-1 {
local_ts = dynamic[tcp/2201]
remote_ts = dynamic[tcp/2201]
rekey_time = 42m
start_action = start
}
}
}
# here two are removed, the others are updated
four-start-child : base-conn {
local {
id = moon-four-child
}
remote {
id = sun-four-child
}
children {
four-start-child-1 {
local_ts = dynamic[tcp/4401]
remote_ts = dynamic[tcp/4401]
rekey_time = 420m
start_action = start
}
four-start-child-2 {
local_ts = dynamic[tcp/4402]
remote_ts = dynamic[tcp/4402]
rekey_time = 420m
start_action = start
}
}
}
}
secrets {
ike {
secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
}
}
testing/tests/ikev2/start-action-start/hosts/moon/etc/swanctl/swanctl-update.conf
Executable
+56
View File
@@ -0,0 +1,56 @@
connections {
# update the rekey time for the IKE_SA for the first connections, so they
# get replaced completely
one-start {
rekey_time = 42m
}
two-start {
rekey_time = 42m
}
four-start {
rekey_time = 42m
}
# for these connections, the rekey time for the children is updated, so the
# IKE_SAs should remain
one-start-child {
children {
one-start-child {
rekey_time = 42m
}
}
}
two-start-child {
children {
two-start-child-1 {
rekey_time = 42m
}
two-start-child-2 {
rekey_time = 42m
}
}
}
four-start-child {
children {
four-start-child-1 {
rekey_time = 42m
}
four-start-child-2 {
rekey_time = 42m
}
four-start-child-3 {
rekey_time = 42m
}
four-start-child-4 {
rekey_time = 42m
}
}
}
}
testing/tests/ikev2/start-action-start/hosts/moon/etc/swanctl/swanctl.conf
Executable
+2
View File
@@ -0,0 +1,2 @@
# include config files from conf.d/
include conf.d/*.conf
testing/tests/ikev2/start-action-start/hosts/sun/etc/strongswan.conf
+8
View File
@@ -0,0 +1,8 @@
# /etc/strongswan.conf - strongSwan configuration file
charon-systemd {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default updown
# disable DoS protection as the initator will create a lot of IKE_SAs in this scenario
dos_protection = no
}
testing/tests/ikev2/start-action-start/hosts/sun/etc/swanctl/swanctl.conf
Executable
+143
View File
@@ -0,0 +1,143 @@
# basic settings for these test configs
base-conn {
local_addrs = 192.168.0.2
remote_addrs = 192.168.0.1
local {
auth = psk
}
remote {
auth = psk
}
}
connections {
one-start : base-conn {
local {
id = sun-one
}
remote {
id = moon-one
}
children {
one-start {
local_ts = dynamic[tcp/1001]
remote_ts = dynamic[tcp/1001]
}
}
}
two-start : base-conn {
local {
id = sun-two
}
remote {
id = moon-two
}
children {
two-start-1 {
local_ts = dynamic[tcp/2001]
remote_ts = dynamic[tcp/2001]
}
two-start-2 {
local_ts = dynamic[tcp/2002]
remote_ts = dynamic[tcp/2002]
}
}
}
four-start : base-conn {
local {
id = sun-four
}
remote {
id = moon-four
}
children {
four-start-1 {
local_ts = dynamic[tcp/4001]
remote_ts = dynamic[tcp/4001]
}
four-start-2 {
local_ts = dynamic[tcp/4002]
remote_ts = dynamic[tcp/4002]
}
four-start-3 {
local_ts = dynamic[tcp/4003]
remote_ts = dynamic[tcp/4003]
}
four-start-4 {
local_ts = dynamic[tcp/4004]
remote_ts = dynamic[tcp/4004]
}
}
}
one-start-child : base-conn {
local {
id = sun-one-child
}
remote {
id = moon-one-child
}
children {
one-start-child {
local_ts = dynamic[tcp/1101]
remote_ts = dynamic[tcp/1101]
}
}
}
two-start-child : base-conn {
local {
id = sun-two-child
}
remote {
id = moon-two-child
}
children {
two-start-child-1 {
local_ts = dynamic[tcp/2201]
remote_ts = dynamic[tcp/2201]
}
two-start-child-2 {
local_ts = dynamic[tcp/2202]
remote_ts = dynamic[tcp/2202]
}
}
}
four-start-child : base-conn {
local {
id = sun-four-child
}
remote {
id = moon-four-child
}
children {
four-start-child-1 {
local_ts = dynamic[tcp/4401]
remote_ts = dynamic[tcp/4401]
}
four-start-child-2 {
local_ts = dynamic[tcp/4402]
remote_ts = dynamic[tcp/4402]
}
four-start-child-3 {
local_ts = dynamic[tcp/4403]
remote_ts = dynamic[tcp/4403]
}
four-start-child-4 {
local_ts = dynamic[tcp/4404]
remote_ts = dynamic[tcp/4404]
}
}
}
}
secrets {
ike {
secret = 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
}
}