From 5e85ce17a2ee5cf2f27c1200db26b9211d7774b4 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 13 Aug 2025 13:37:36 +0200 Subject: [PATCH 01/22] testing: Remove xconsole config for rsyslogd This produces a warning and we don't have X. --- testing/hosts/default/etc/rsyslog.conf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/testing/hosts/default/etc/rsyslog.conf b/testing/hosts/default/etc/rsyslog.conf index 9f76da36e..ee0a324d1 100644 --- a/testing/hosts/default/etc/rsyslog.conf +++ b/testing/hosts/default/etc/rsyslog.conf @@ -119,7 +119,7 @@ news.notice -/var/log/news/news.notice # NOTE: adjust the list below, or you'll go crazy if you have a reasonably # busy site.. # -daemon.*;mail.*;\ - news.err;\ - *.=debug;*.=info;\ - *.=notice;*.=warn |/dev/xconsole +#daemon.*;mail.*;\ +# news.err;\ +# *.=debug;*.=info;\ +# *.=notice;*.=warn |/dev/xconsole From acaf4b2d17636edc6abcac0ed0395e35e83a1070 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 13 Aug 2025 13:38:52 +0200 Subject: [PATCH 02/22] testing: Move sysctl settings to sysctl.d and add some memory settings Debian trixie doesn't provide a 99-sysctl.conf symlink in that directory anymore. The memory settings are also useful there as the default of one changed and overbooking helps when forking a process with large memory footprint (e.g. the IKE daemon). --- testing/hosts/default/etc/sysctl.conf | 62 ------------------- .../default/etc/sysctl.d/99-strongswan.conf | 16 +++++ 2 files changed, 16 insertions(+), 62 deletions(-) delete mode 100644 testing/hosts/default/etc/sysctl.conf create mode 100644 testing/hosts/default/etc/sysctl.d/99-strongswan.conf diff --git a/testing/hosts/default/etc/sysctl.conf b/testing/hosts/default/etc/sysctl.conf deleted file mode 100644 index 364b64ad6..000000000 --- a/testing/hosts/default/etc/sysctl.conf +++ /dev/null @@ -1,62 +0,0 @@ -# -# /etc/sysctl.conf - Configuration file for setting system variables -# See /etc/sysctl.d/ for additional system variables -# See sysctl.conf (5) for information. -# - -#kernel.domainname = example.com - -# Uncomment the following to stop low-level messages on console -#kernel.printk = 3 4 1 3 - -##############################################################3 -# Functions previously found in netbase -# - -# Uncomment the next two lines to enable Spoof protection (reverse-path filter) -# Turn on Source Address Verification in all interfaces to -# prevent some spoofing attacks -#net.ipv4.conf.default.rp_filter=1 -#net.ipv4.conf.all.rp_filter=1 - -# Uncomment the next line to enable TCP/IP SYN cookies -# See http://lwn.net/Articles/277146/ -# Note: This may impact IPv6 TCP sessions too -#net.ipv4.tcp_syncookies=1 - -# Uncomment the next line to enable packet forwarding for IPv4 -net.ipv4.ip_forward=1 - -# Uncomment the next line to enable packet forwarding for IPv6 -# Enabling this option disables Stateless Address Autoconfiguration -# based on Router Advertisements for this host -net.ipv6.conf.all.forwarding=1 - - -################################################################### -# Additional settings - these settings can improve the network -# security of the host and prevent against some network attacks -# including spoofing attacks and man in the middle attacks through -# redirection. Some network environments, however, require that these -# settings are disabled so review and enable them as needed. -# -# Do not accept ICMP redirects (prevent MITM attacks) -#net.ipv4.conf.all.accept_redirects = 0 -#net.ipv6.conf.all.accept_redirects = 0 -# _or_ -# Accept ICMP redirects only for gateways listed in our default -# gateway list (enabled by default) -# net.ipv4.conf.all.secure_redirects = 1 -# -# Do not send ICMP redirects (we are not a router) -#net.ipv4.conf.all.send_redirects = 0 -# -# Do not accept IP source route packets (we are not a router) -#net.ipv4.conf.all.accept_source_route = 0 -#net.ipv6.conf.all.accept_source_route = 0 -# -# Log Martian Packets -#net.ipv4.conf.all.log_martians = 1 - -# Enable coredump for suid binaries -fs.suid_dumpable = 1 diff --git a/testing/hosts/default/etc/sysctl.d/99-strongswan.conf b/testing/hosts/default/etc/sysctl.d/99-strongswan.conf new file mode 100644 index 000000000..c21ce4195 --- /dev/null +++ b/testing/hosts/default/etc/sysctl.d/99-strongswan.conf @@ -0,0 +1,16 @@ +# Enable packet forwarding for IPv4 +net.ipv4.ip_forward=1 + +# Enable packet forwarding for IPv6 +# Enabling this option disables Stateless Address Autoconfiguration +# based on Router Advertisements for this host +net.ipv6.conf.all.forwarding=1 + +# Enable coredump for suid binaries +fs.suid_dumpable = 1 + +# As we run with very little memory, use the old default to reduce overhead +vm.max_map_count = 65530 + +# Allow overcommitting, in particular for forks +vm.overcommit_memory = 1 From 2025f630df134b0af2adb002668c2ab3924cf366 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 13 Aug 2025 13:52:20 +0200 Subject: [PATCH 03/22] testing: Remove unnecessary workaround for DHCP --- testing/hosts/moon/etc/rc.local | 20 -------------------- 1 file changed, 20 deletions(-) delete mode 100755 testing/hosts/moon/etc/rc.local diff --git a/testing/hosts/moon/etc/rc.local b/testing/hosts/moon/etc/rc.local deleted file mode 100755 index 8649a2bcb..000000000 --- a/testing/hosts/moon/etc/rc.local +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/sh -e -# -# rc.local -# -# This script is executed at the end of each multiuser runlevel. -# Make sure that the script will "exit 0" on success or any other -# value on error. -# -# In order to enable or disable this script just change the execution -# bits. -# - -# Disable checksum offloading on eth1 because it does not currently work with -# libvirt and isc-dhcp-server running on venus, see [1] -# [1] - https://bugs.mageia.org/show_bug.cgi?id=1243 - -ethtool --offload eth1 tx off >/dev/null 2>&1 -ethtool --offload eth1 rx off >/dev/null 2>&1 - -exit 0 From a418666f59bb46d6b5d554563417f848113209e5 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 13 Aug 2025 13:54:01 +0200 Subject: [PATCH 04/22] testing: Use new recommended approach to install key for custom apt repository apt-key add is deprecated (and not available in trixie) as it makes the available for all sources. The recommended approach makes the key very specifically available for just our repository. --- testing/scripts/build-baseimage | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage index edb1588c4..ce8bdc690 100755 --- a/testing/scripts/build-baseimage +++ b/testing/scripts/build-baseimage @@ -125,13 +125,13 @@ EOF execute_chroot "locale-gen" log_action "Downloading signing key for custom apt repo" -execute_chroot "wget -q $BASEIMGEXTKEY -O /tmp/key" +execute_chroot "wget -q $BASEIMGEXTKEY -O /tmp/strongswan.key" log_action "Installing signing key for custom apt repo" -execute_chroot "apt-key add /tmp/key" +execute_chroot "mv /tmp/strongswan.key /etc/apt/keyrings/" log_action "Enabling custom apt repo" cat > $LOOPDIR/etc/apt/sources.list.d/strongswan.list << EOF -deb $BASEIMGEXTREPO $BASEIMGSUITE main +deb [signed-by=/etc/apt/keyrings/strongswan.key] $BASEIMGEXTREPO $BASEIMGSUITE main EOF log_status $? From b51731e197195a141679983f9343895b11d63571 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 13 Aug 2025 13:57:13 +0200 Subject: [PATCH 05/22] testing: Mount /proc in the chroot to make systemctl happy --- testing/scripts/build-guestimages | 3 +++ 1 file changed, 3 insertions(+) diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages index 5050b3748..511974624 100755 --- a/testing/scripts/build-guestimages +++ b/testing/scripts/build-guestimages @@ -37,6 +37,7 @@ mkdir -p $LOOPDIR # just to be sure do_on_exit qemu-nbd -d $NBDEV do_on_exit umount $LOOPDIR +do_on_exit umount $LOOPDIR/proc for host in $STRONGSWANHOSTS do @@ -45,6 +46,7 @@ do execute "qemu-nbd -c $NBDEV $IMGDIR/$host.$IMGEXT" 0 blockdev --rereadpt $NBDEV execute "mount $NBDPARTITION $LOOPDIR" 0 + execute "mount -t proc none $LOOPDIR/proc" 0 execute "cp -rf $HOSTSDIR/default/* $LOOPDIR" 0 execute "cp -rf $HOSTSDIR/${host}/etc $LOOPDIR" 0 execute_chroot "ldconfig" 0 @@ -92,6 +94,7 @@ do done fi sync + execute "umount -l $LOOPDIR/proc" 0 execute "umount -l $LOOPDIR" 0 execute "qemu-nbd -d $NBDEV" 0 log_status 0 From a9e3db6b797d545849615a1be3c92f268fcef0bb Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 13 Aug 2025 14:01:08 +0200 Subject: [PATCH 06/22] testing: Pass base image codename to application Makefiles Some might require it to use different revisions or commands. --- testing/scripts/build-strongswan | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testing/scripts/build-strongswan b/testing/scripts/build-strongswan index 772c92da7..23cb2a028 100755 --- a/testing/scripts/build-strongswan +++ b/testing/scripts/build-strongswan @@ -195,7 +195,7 @@ do execute_chroot "make SRCDIR=/root/strongswan BUILDDIR=/root/shared/build-strongswan QUICK_REBUILD=$QUICK_REBUILD -f /root/shared/build-strongswan/$r" else cp $RECPDIR/$r ${LOOPDIR}/root/shared/compile - execute_chroot "make SWANVERSION=$TARBALL -C /root/shared/compile -f $r" + execute_chroot "make SWANVERSION=$TARBALL BASEIMG=$BASEIMGSUITE -C /root/shared/compile -f $r" fi done From 0e768233f2d34ffb807df1c6d38c019b8e9a8cdb Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:33:16 +0200 Subject: [PATCH 07/22] leak-detective: Include OpenSSL symbol seen on Debian trixie --- src/libstrongswan/utils/leak_detective.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/libstrongswan/utils/leak_detective.c b/src/libstrongswan/utils/leak_detective.c index 038cd0a0c..1ae19fd96 100644 --- a/src/libstrongswan/utils/leak_detective.c +++ b/src/libstrongswan/utils/leak_detective.c @@ -617,6 +617,7 @@ static char *whitelist[] = { "OSSL_DECODER_CTX_new_for_pkey", "OSSL_ENCODER_do_all_provided", "OSSL_PROVIDER_try_load", + "OSSL_PROVIDER_try_load_ex", "OSSL_PROVIDER_load", "RAND_get0_private", "RAND_get0_public", From b9986953448dc198c3c466a45e0d4f7d90c17af8 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 15:11:48 +0200 Subject: [PATCH 08/22] testing: Ignore unknown memory in leak detective This is set in two locations for systemd services and login shells. The memory is freed by OPENSSL_cleanup(). --- testing/hosts/default/etc/ssh/sshd_config | 1 + .../etc/systemd/system.conf.d/99-ignore-unknown-memory.conf | 2 ++ 2 files changed, 3 insertions(+) create mode 100644 testing/hosts/default/etc/systemd/system.conf.d/99-ignore-unknown-memory.conf diff --git a/testing/hosts/default/etc/ssh/sshd_config b/testing/hosts/default/etc/ssh/sshd_config index bed9e8238..622887f04 100644 --- a/testing/hosts/default/etc/ssh/sshd_config +++ b/testing/hosts/default/etc/ssh/sshd_config @@ -13,4 +13,5 @@ PrintLastLog no UsePAM no AcceptEnv LANG LC_* AcceptEnv LEAK_DETECTIVE_LOG +SetEnv LEAK_DETECTIVE_IGNORE_UNKNOWN=1 Subsystem sftp /usr/lib/openssh/sftp-server diff --git a/testing/hosts/default/etc/systemd/system.conf.d/99-ignore-unknown-memory.conf b/testing/hosts/default/etc/systemd/system.conf.d/99-ignore-unknown-memory.conf new file mode 100644 index 000000000..acf2eee6d --- /dev/null +++ b/testing/hosts/default/etc/systemd/system.conf.d/99-ignore-unknown-memory.conf @@ -0,0 +1,2 @@ +[Manager] +DefaultEnvironment=LEAK_DETECTIVE_IGNORE_UNKNOWN=1 From 870aa75eed5079b7bfb32bb9c06d4b3658e975d1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:34:17 +0200 Subject: [PATCH 09/22] testing: Start a login shell in chroot script This ensures we have the same environment (e.g. stuff from /etc/profile.d) as when logging in via SSH later. --- testing/scripts/chroot | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testing/scripts/chroot b/testing/scripts/chroot index 60a75df7e..b686abd97 100755 --- a/testing/scripts/chroot +++ b/testing/scripts/chroot @@ -68,4 +68,4 @@ echo fi export debian_chroot="$1" -chroot $LOOPDIR /bin/bash -i +chroot $LOOPDIR /bin/bash -l From ddeb3c463efaad4fa7542827e2cde6f569dbb5fe Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:36:45 +0200 Subject: [PATCH 10/22] testing: Run commands in chroot in a login shell Similar to the previous commit, this ensures we have the same environment we do later on the system. --- testing/scripts/function.sh | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/testing/scripts/function.sh b/testing/scripts/function.sh index c162044e5..faf968f9b 100755 --- a/testing/scripts/function.sh +++ b/testing/scripts/function.sh @@ -48,9 +48,23 @@ execute() # execute command in chroot # $1 - command to execute +# $2 - whether or not to log command exit status +# (0 -> disable exit status logging) execute_chroot() { - execute "chroot $LOOPDIR env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin $@" + cmd=${1} + echo chroot $LOOPDIR $cmd >>$LOGFILE 2>&1 + chroot $LOOPDIR /bin/bash -l <<-EOF >>$LOGFILE 2>&1 + $cmd + EOF + status=$? + [ "$2" != 0 ] && log_status $status + if [ $status != 0 ]; then + echo + echo "! Command chroot $LOOPDIR $cmd failed, exiting (status $status)" + echo "! Check why here $LOGFILE" + exit 1 + fi } # write green status message to console From b4a51f1719af2545f3275d881207330fd3bf4c07 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:40:38 +0200 Subject: [PATCH 11/22] testing: Use newer version of TKM on trixie The API for libgmpada has change with 1.6 in a way that's not backwards-compatible. So we use a different revision that includes the required changes depending on the Debian version. This also adds support for esa_select(), to support seamless rekeyings, which requires updating xfrm-ada as well. --- testing/scripts/recipes/008_xfrm-ada.mk | 2 +- testing/scripts/recipes/010_tkm.mk | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/testing/scripts/recipes/008_xfrm-ada.mk b/testing/scripts/recipes/008_xfrm-ada.mk index 185f813e7..6202d7bb6 100644 --- a/testing/scripts/recipes/008_xfrm-ada.mk +++ b/testing/scripts/recipes/008_xfrm-ada.mk @@ -2,7 +2,7 @@ PKG = xfrm-ada SRC = https://git.codelabs.ch/git/$(PKG).git -REV = v0.1 +REV = e0590c6bb3c6a5b7f2edd8f95dce9e8c77e22230 PREFIX = /usr/local/ada diff --git a/testing/scripts/recipes/010_tkm.mk b/testing/scripts/recipes/010_tkm.mk index 589d96533..d82f6a95c 100644 --- a/testing/scripts/recipes/010_tkm.mk +++ b/testing/scripts/recipes/010_tkm.mk @@ -2,7 +2,11 @@ PKG = tkm SRC = https://git.codelabs.ch/git/$(PKG).git +ifeq (,$(filter $(BASEIMG),bullseye bookworm)) +REV = 85d49c9255360663c344ccf3175092524dc66eae +else REV = v0.3 +endif export ADA_PROJECT_PATH=/usr/local/ada/lib/gnat From ecc2e35713cc864bc9be5aba33918af1100a333b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:43:46 +0200 Subject: [PATCH 12/22] testing: Update TKM RPC to be compatible with newer compilers --- testing/scripts/recipes/006_tkm-rpc.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testing/scripts/recipes/006_tkm-rpc.mk b/testing/scripts/recipes/006_tkm-rpc.mk index 779ffacd4..3f930dc76 100644 --- a/testing/scripts/recipes/006_tkm-rpc.mk +++ b/testing/scripts/recipes/006_tkm-rpc.mk @@ -2,7 +2,7 @@ PKG = tkm-rpc SRC = https://git.codelabs.ch/git/$(PKG).git -REV = v0.4 +REV = c43c7d2a070d37e4063b83be0dc01425bf890206 PREFIX = /usr/local/ada From fa1cd747126278789f749101fc27023b09d79aca Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:45:13 +0200 Subject: [PATCH 13/22] testing: Install required packages in venv of updated strongTNC Update revision for some dependency updates. While python3-setuptools is installed on the system, the venv apparently can't use it. legacy-cgi is required to use that old Django version with newer Python releases. --- testing/scripts/recipes/015_strongTNC.mk | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/testing/scripts/recipes/015_strongTNC.mk b/testing/scripts/recipes/015_strongTNC.mk index 673b4b09e..f95d8a72e 100644 --- a/testing/scripts/recipes/015_strongTNC.mk +++ b/testing/scripts/recipes/015_strongTNC.mk @@ -1,13 +1,15 @@ #!/usr/bin/make PKG = strongTNC -REV = 1.0.2 +REV = f0ed6fa8ef6bcde56283c6da1bdbdaa3d651eb11 DIR = $(PKG)-$(REV) ZIP = $(PKG)-$(REV).zip SRC = https://github.com/strongswan/$(PKG)/archive/$(REV).zip DEPS = $(PKG)-deps VENV = /usr/local/venvs/tnc +EXTRAS = setuptools legacy-cgi + all: install $(ZIP): @@ -19,10 +21,10 @@ $(ZIP): .$(PKG)-deps-$(REV): .$(PKG)-unpacked-$(REV) python3 -m venv $(VENV) - $(VENV)/bin/pip download -d $(DEPS) -r $(DIR)/requirements.txt + $(VENV)/bin/pip download -d $(DEPS) -r $(DIR)/requirements.txt $(EXTRAS) @touch $@ install: .$(PKG)-deps-$(REV) python3 -m venv $(VENV) - $(VENV)/bin/pip install --no-index --find-links=file://`pwd`/$(DEPS) -r $(DIR)/requirements.txt + $(VENV)/bin/pip install --no-index --find-links=file://`pwd`/$(DEPS) -r $(DIR)/requirements.txt $(EXTRAS) cp -r $(DIR) /var/www/tnc && chgrp -R www-data /var/www/tnc && chmod g+sw /var/www/tnc From 518b8e42864efd45cecb72878cf0f23e02199567 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:46:13 +0200 Subject: [PATCH 14/22] testing: Use pipx to install swidGenerator on Debian trixie We could use the same approach on bookworm (if the base image is updated), but just use the old approach there for now. --- testing/scripts/recipes/014_swid_generator.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/testing/scripts/recipes/014_swid_generator.mk b/testing/scripts/recipes/014_swid_generator.mk index 9f8407aa3..c10e00d8d 100644 --- a/testing/scripts/recipes/014_swid_generator.mk +++ b/testing/scripts/recipes/014_swid_generator.mk @@ -17,4 +17,8 @@ $(TAR): @touch $@ install: .$(PKG)-unpacked-$(REV) +ifeq (,$(filter $(BASEIMG),bullseye bookworm)) + cd $(DIR) && pipx install --global --system-site-packages . +else cd $(DIR) && SETUPTOOLS_USE_DISTUTILS=stdlib python3 setup.py install +endif From 1767ba2a13569ca94e808417d600918a5477684a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:47:44 +0200 Subject: [PATCH 15/22] testing: Add support for Debian trixie base images --- testing/scripts/build-baseimage | 24 ++++++++---------------- testing/scripts/build-guestimages | 13 +------------ 2 files changed, 9 insertions(+), 28 deletions(-) diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage index ce8bdc690..37dfef2d4 100755 --- a/testing/scripts/build-baseimage +++ b/testing/scripts/build-baseimage @@ -18,23 +18,11 @@ INC=$INC,libxml2-dev,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libltdl-dev,wget,gnupg,man-db INC=$INC,libboost-thread-dev,libboost-system-dev,git,iperf3,htop,valgrind,strace INC=$INC,gnat,gprbuild,acpid,acpi-support-base,libldns-dev,libunbound-dev -INC=$INC,dnsutils,ca-certificates,unzip,libsystemd-dev +INC=$INC,bind9-dnsutils,ca-certificates,unzip,libsystemd-dev INC=$INC,python3,python3-setuptools,python3-build,python3-dev,python3-daemon,python3-venv, INC=$INC,apt-transport-https,libjson-c-dev,libxslt1-dev,libapache2-mod-wsgi-py3 -INC=$INC,libxerces-c-dev,rsyslog,ncat,socat +INC=$INC,libxerces-c-dev,rsyslog,ncat,socat,libiptc-dev,binutils-dev case "$BASEIMGSUITE" in -buster) - INC=$INC,iptables-dev - ;; -*) - INC=$INC,libiptc-dev - ;; -esac -case "$BASEIMGSUITE" in -buster) - INC=$INC,libahven7-dev,libxmlada-schema8-dev,libgmpada8-dev - INC=$INC,libalog4-dev,dbus-user-session - ;; bullseye) INC=$INC,libahven9-dev,libxmlada-schema10-dev,libgmpada10-dev INC=$INC,libalog6-dev,dbus-user-session @@ -44,11 +32,15 @@ bullseye) ;; bookworm) INC=$INC,libahven11-dev,libxmlada-schema12-dev,libgmpada12-dev - INC=$INC,libalog8-dev,dbus-user-session + INC=$INC,libalog8-dev,dbus-user-session,pipx # workaround for dependency issue gdb -> libsource-highlight4v5 -> virtual # package (libboost-regex1.74.0-icu67), which debootstrap can't resolve (#878961) INC=$INC,libboost-regex1.74.0 ;; +trixie) + INC=$INC,libahven-dev,libxmlada-schema-dev,libgmpada-dev + INC=$INC,libalog-dev,dbus-user-session,pipx,systemd-dev + ;; *) echo_warn "Package list for '$BASEIMGSUITE' might has to be updated" ;; @@ -60,7 +52,7 @@ APT1="libgcrypt20-dev traceroute iptables" APT="tmux" # additional services to disable case "$BASEIMGSUITE" in -bookworm) +bookworm|trixie) ;; *) SERVICES="$SERVICES systemd-timesyncd" diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages index 511974624..caf423111 100755 --- a/testing/scripts/build-guestimages +++ b/testing/scripts/build-guestimages @@ -76,18 +76,7 @@ do execute_chroot "dnssec-signzone -K /etc/bind -o org. /etc/bind/db.org" 0 execute_chroot "dnssec-signzone -K /etc/bind -o . /etc/bind/db.root" 0 - # on bullseye and newer, enabling via bind9 doesn't work, while - # disabling does, so use named here. on the other hand, older releases - # like buster don't have named service files - SERVICES="apache2 slapd" - case "$BASEIMGSUITE" in - buster) - SERVICES="$SERVICES bind9" - ;; - *) - SERVICES="$SERVICES named" - ;; - esac + SERVICES="apache2 slapd named" for service in $SERVICES do execute_chroot "systemctl enable $service" 0 From 3aa7e1d418dfcc4532c9eba6486d48385320402a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 14:48:49 +0200 Subject: [PATCH 16/22] testing: Increase memory for guest hosts to run Debian trixie While some increase was necessary anyway because the idle system requires about 5-10 MiB more memory, the main issue is resolving the code line and function name in case of a memory leak. Calling addr2line requires a lot more memory than before. Using backtraces via libbfd doesn't help either because the trigger is the bfd_find_nearest_line() call we use as well. And because we'd try to resolve all symbols that way (for whitelisting), the memory overhead would be even higher and affect every shutdown, even if no leak occurred. It also causes a significant time overhead (running all tests took 75m instead of 48m). I also tested switching to ASAN/LSAN. The peak memory usage is slightly higher than when using libbfd, but enabling it also increased the runtime overhead a lot (the daemon and swanctl both required about 10-20 MiB more memory, not just during the shutdown). --- testing/config/kvm/alice.xml | 4 ++-- testing/config/kvm/bob.xml | 4 ++-- testing/config/kvm/carol.xml | 4 ++-- testing/config/kvm/dave.xml | 4 ++-- testing/config/kvm/moon.xml | 4 ++-- testing/config/kvm/sun.xml | 4 ++-- testing/config/kvm/venus.xml | 4 ++-- testing/config/kvm/winnetou.xml | 4 ++-- 8 files changed, 16 insertions(+), 16 deletions(-) diff --git a/testing/config/kvm/alice.xml b/testing/config/kvm/alice.xml index 9cdb25166..d1212665e 100644 --- a/testing/config/kvm/alice.xml +++ b/testing/config/kvm/alice.xml @@ -1,8 +1,8 @@ alice 1f35c25d-6a7b-4ee1-2461-d7e530e7b2a9 - 200 - 200 + 260 + 260 1 hvm diff --git a/testing/config/kvm/bob.xml b/testing/config/kvm/bob.xml index 982a1aac0..b55bf8ca2 100644 --- a/testing/config/kvm/bob.xml +++ b/testing/config/kvm/bob.xml @@ -1,8 +1,8 @@ bob 72728516-377f-f5be-ea1d-b1f1e851538f - 128 - 128 + 150 + 150 1 hvm diff --git a/testing/config/kvm/carol.xml b/testing/config/kvm/carol.xml index 33dc08adc..60c15350d 100644 --- a/testing/config/kvm/carol.xml +++ b/testing/config/kvm/carol.xml @@ -1,8 +1,8 @@ carol 6bc2eef5-7faf-cde0-5f27-6fc29f93bc3d - 128 - 128 + 150 + 150 1 hvm diff --git a/testing/config/kvm/dave.xml b/testing/config/kvm/dave.xml index 93ce82e63..e9402b4fb 100644 --- a/testing/config/kvm/dave.xml +++ b/testing/config/kvm/dave.xml @@ -1,8 +1,8 @@ dave 05f1debe-4e38-4f3d-10a0-c07fbb70d816 - 128 - 128 + 150 + 150 1 hvm diff --git a/testing/config/kvm/moon.xml b/testing/config/kvm/moon.xml index df77348d0..e2271384c 100644 --- a/testing/config/kvm/moon.xml +++ b/testing/config/kvm/moon.xml @@ -1,8 +1,8 @@ moon b5e00ad3-1c81-3b2a-7f66-cdf8727b3c65 - 128 - 128 + 150 + 150 4 hvm diff --git a/testing/config/kvm/sun.xml b/testing/config/kvm/sun.xml index 68c160a80..b76ff3541 100644 --- a/testing/config/kvm/sun.xml +++ b/testing/config/kvm/sun.xml @@ -1,8 +1,8 @@ sun 35341843-346c-a63a-786b-9df0fd5e6264 - 144 - 144 + 150 + 150 2 hvm diff --git a/testing/config/kvm/venus.xml b/testing/config/kvm/venus.xml index 07e1b995d..ca1369584 100644 --- a/testing/config/kvm/venus.xml +++ b/testing/config/kvm/venus.xml @@ -1,8 +1,8 @@ venus f0838df9-7cc0-84f5-6c14-2d16ab002e8d - 128 - 128 + 150 + 150 1 hvm diff --git a/testing/config/kvm/winnetou.xml b/testing/config/kvm/winnetou.xml index aa259d06f..89c07b981 100644 --- a/testing/config/kvm/winnetou.xml +++ b/testing/config/kvm/winnetou.xml @@ -1,8 +1,8 @@ winnetou b1d3d2f7-e20b-ab95-277e-66d4cac33cc3 - 160 - 160 + 200 + 200 1 hvm From d8a1747fa13afbf8cd0cd27b3b0b3dff6307cd3d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 18 Aug 2025 12:40:18 +0200 Subject: [PATCH 17/22] libimcv: Add Debian 13 (trixie) to database --- src/libimcv/imv/data.sql | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/libimcv/imv/data.sql b/src/libimcv/imv/data.sql index 88e1e330f..b15b4c111 100644 --- a/src/libimcv/imv/data.sql +++ b/src/libimcv/imv/data.sql @@ -622,6 +622,12 @@ INSERT INTO products ( /* 104 */ 'Debian 12 x86_64' ); +INSERT INTO products ( /* 105 */ + name +) VALUES ( + 'Debian 13 x86_64' +); + /* Directories */ INSERT INTO directories ( /* 1 */ @@ -1708,6 +1714,12 @@ INSERT INTO groups_product_defaults ( 17, 104 ); +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 17, 105 +); + /* Policies */ INSERT INTO policies ( /* 1 */ From f3cc9bec18d0ad6a4fe721035e1c6c6578025fe7 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 18 Aug 2025 12:43:50 +0200 Subject: [PATCH 18/22] testing: Use proper directory for slapd PID files --- testing/hosts/winnetou/etc/ldap/slapd.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/testing/hosts/winnetou/etc/ldap/slapd.conf b/testing/hosts/winnetou/etc/ldap/slapd.conf index 2fb8d41e9..7c4fd3aca 100644 --- a/testing/hosts/winnetou/etc/ldap/slapd.conf +++ b/testing/hosts/winnetou/etc/ldap/slapd.conf @@ -7,8 +7,8 @@ moduleload back_mdb.la include /etc/ldap/schema/core.schema -pidfile /var/run/openldap/slapd.pid -argsfile /var/run/openldap/slapd.args +pidfile /var/run/slapd/slapd.pid +argsfile /var/run/slapd/slapd.args ####################################################################### # Database definitions From a0a5bd76697d6f3c869f7b443215196260b978ff Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 15:10:09 +0200 Subject: [PATCH 19/22] testing: Use Debian trixie --- testing/testing.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testing/testing.conf b/testing/testing.conf index f02b44ac1..74e81a336 100644 --- a/testing/testing.conf +++ b/testing/testing.conf @@ -49,7 +49,7 @@ fi # Base image settings # The base image is a pristine OS installation created using debootstrap. : ${BASEIMGSIZE=2500} -: ${BASEIMGSUITE=bookworm} +: ${BASEIMGSUITE=trixie} : ${BASEIMGARCH=amd64} : ${BASEIMG=$IMGDIR/debian-$BASEIMGSUITE-$BASEIMGARCH.$IMGEXT} : ${BASEIMGMIRROR=http://http.debian.net/debian} From 906205b7ee950a3be99a8869b9ab61678a487172 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 15:10:21 +0200 Subject: [PATCH 20/22] testing: Use Debian trixie to test TKM --- testing/tkm/Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/testing/tkm/Dockerfile b/testing/tkm/Dockerfile index d7dcc76fb..f97d2c377 100644 --- a/testing/tkm/Dockerfile +++ b/testing/tkm/Dockerfile @@ -23,12 +23,12 @@ # # make -j check TESTS_RUNNERS=tkm TESTS_TKM=1 -FROM debian:bookworm +FROM debian:trixie ARG packages="autoconf automake bison build-essential ca-certificates ccache \ flex git gperf libssl-dev libtool pkg-config \ -gnat gprbuild libahven11-dev libxmlada-schema12-dev libgmpada12-dev \ -libalog8-dev" +gnat gprbuild libahven-dev libxmlada-schema-dev libgmpada-dev \ +libalog-dev" RUN apt-get update && \ DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \ @@ -48,8 +48,8 @@ RUN cd /tmp/recipes \ && make -f 010_tkm.mk \ && rm -rf /tmp/recipes -ENV ADA_PROJECT_PATH /usr/local/ada/lib/gnat -ENV PATH /usr/lib/ccache:$PATH +ENV ADA_PROJECT_PATH=/usr/local/ada/lib/gnat +ENV PATH=/usr/lib/ccache:$PATH COPY tkm/generate-config.sh /usr/local/share/tkm/ COPY tests/tkm/host2host-initiator/hosts/moon/etc/tkm/tkm.conf /usr/local/share/tkm/ From e9ebe49d44ea342cf645503ab04054364257e75d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 15 Aug 2025 18:32:24 +0200 Subject: [PATCH 21/22] testing: Add option to run tests without leak detective This new option allows to disable leak detective to reduce the runtime during development. Either only for the command line (swanctl, pki etc.) or optionally also for the daemon(s). Disabling leak detective only for the CLI tools already brings a considerable reduction in runtime (from 48m to 38m on my dev host) as there are many such calls in the post-test stage. Any leaks in those tools are also a lot less of an issue than leaks in the daemon. So using this during development should be fine as long as a full test run is done regularly (in particular before releases). Disabling leak detective completely further reduces the runtime (to 30m on my dev host). But that should probably only be used for functional regression tests after verifying new code didn't introduce new leaks. This also fixes the service script which is used for charon-tkm since 16fcdb460afd ("charon-tkm: Don't use starter/stroke with charon-tkm anymore"). --- testing/do-tests | 19 ++++++++++++++----- testing/hosts/default/etc/ssh/sshd_config | 2 +- testing/hosts/default/usr/local/bin/service | 12 +++++++++--- testing/hosts/default/usr/local/bin/systemctl | 8 +++++++- testing/hosts/default/usr/local/sbin/ipsec | 12 ++++++++++++ testing/scripts/build-guestimages | 1 + testing/ssh_config | 2 +- 7 files changed, 45 insertions(+), 11 deletions(-) create mode 100755 testing/hosts/default/usr/local/sbin/ipsec diff --git a/testing/do-tests b/testing/do-tests index 33f946a2e..8d63477ef 100755 --- a/testing/do-tests +++ b/testing/do-tests @@ -59,11 +59,13 @@ function usage() cat << EOF Usage: ${0##*/} [-h] [-v|-t] [-i|-e] [TESTDIRS] - --help (-h) show usage information - --verbose (-v) show complete logs on errors (implies -t) - --timestamps (-t) show timestamps in console.log - --pre (-i) run pretest script only (single test only) - --post (-e) run posttest script only (single test only) + --help (-h) show usage information + --verbose (-v) show complete logs on errors (implies -t) + --timestamps (-t) show timestamps in console.log + --pre (-i) run pretest script only (single test only) + --post (-e) run posttest script only (single test only) + --no-leaks [daemon] (-n) disable leak detective in commands (e.g. swanctl) + and optionally the daemon as well TESTDIRS list of test directories (relative to testing/tests). wildcards (*) are supported. default is to run all tests. @@ -91,6 +93,13 @@ while [ $# -gt 0 ]; do -e|--post) posttest_only=YES ;; + -n|--no-leaks) + export LEAK_DETECTIVE_DISABLE=1 + if [[ "$2" =~ d(aemon)? ]]; then + export LEAK_DETECTIVE_DISABLE_DAEMON=1 + shift + fi + ;; *) TESTDIRS+=("$1") ;; diff --git a/testing/hosts/default/etc/ssh/sshd_config b/testing/hosts/default/etc/ssh/sshd_config index 622887f04..cfe0444c3 100644 --- a/testing/hosts/default/etc/ssh/sshd_config +++ b/testing/hosts/default/etc/ssh/sshd_config @@ -12,6 +12,6 @@ PrintMotd no PrintLastLog no UsePAM no AcceptEnv LANG LC_* -AcceptEnv LEAK_DETECTIVE_LOG +AcceptEnv LEAK_DETECTIVE_* SetEnv LEAK_DETECTIVE_IGNORE_UNKNOWN=1 Subsystem sftp /usr/lib/openssh/sftp-server diff --git a/testing/hosts/default/usr/local/bin/service b/testing/hosts/default/usr/local/bin/service index c5db4f61b..0182f0b84 100755 --- a/testing/hosts/default/usr/local/bin/service +++ b/testing/hosts/default/usr/local/bin/service @@ -3,15 +3,20 @@ # LEAK_DETECTIVE_LOG is set for automated runs, however, `service` strips # the environment. This wrapper is used to set the variable for the charon # init script. +# Similar for LEAK_DETECTIVE_DISABLE. However, we don't pass that along +# directly, to be able to run the daemon with it while still improving the +# performance when collecting results etc. ORIG=/usr/sbin/service -CONF=/etc/default/charon +CONF=/etc/default/charon-tkm -if [[ "$1" != "charon" ]]; then +if [[ "$1" != "charon-tkm" ]]; then $ORIG "$@" fi -if [[ "$2" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then +if [[ "$2" == "start" && -n $LEAK_DETECTIVE_DISABLE_DAEMON ]]; then + echo "export LEAK_DETECTIVE_DISABLE=$LEAK_DETECTIVE_DISABLE_DAEMON" >> $CONF +elif [[ "$2" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then echo "export LEAK_DETECTIVE_LOG=$LEAK_DETECTIVE_LOG" >> $CONF fi @@ -19,4 +24,5 @@ $ORIG "$@" if [[ "$2" == "stop" ]]; then sed -i '/LEAK_DETECTIVE_LOG/d' $CONF 2>/dev/null + sed -i '/LEAK_DETECTIVE_DISABLE/d' $CONF 2>/dev/null fi diff --git a/testing/hosts/default/usr/local/bin/systemctl b/testing/hosts/default/usr/local/bin/systemctl index 51e188c0e..07027508b 100755 --- a/testing/hosts/default/usr/local/bin/systemctl +++ b/testing/hosts/default/usr/local/bin/systemctl @@ -3,6 +3,9 @@ # LEAK_DETECTIVE_LOG is set for automated runs, however, this is not passed # to a process started via systemctl. This wrapper is used to set the variable # for the strongswan.service unit. +# Similar for LEAK_DETECTIVE_DISABLE. However, we don't pass that along +# directly, to be able to run the daemon with it while still improving the +# performance when collecting results etc. ORIG=/bin/systemctl CONF=/lib/systemd/system/strongswan.service @@ -11,7 +14,9 @@ if [[ "$2" != "strongswan" ]]; then exec $ORIG "$@" fi -if [[ "$1" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then +if [[ "$1" == "start" && -n $LEAK_DETECTIVE_DISABLE_DAEMON ]]; then + sed -i "s:Type=:Environment=LEAK_DETECTIVE_DISABLE=$LEAK_DETECTIVE_DISABLE_DAEMON\nType=:" $CONF 2>/dev/null +elif [[ "$1" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then sed -i "s:Type=:Environment=LEAK_DETECTIVE_LOG=$LEAK_DETECTIVE_LOG\nType=:" $CONF 2>/dev/null fi @@ -20,6 +25,7 @@ STATUS=$? if [[ "$1" == "stop" ]]; then sed -i '/LEAK_DETECTIVE_LOG/d' $CONF 2>/dev/null + sed -i '/LEAK_DETECTIVE_DISABLE/d' $CONF 2>/dev/null fi exit $STATUS diff --git a/testing/hosts/default/usr/local/sbin/ipsec b/testing/hosts/default/usr/local/sbin/ipsec new file mode 100755 index 000000000..60c88274f --- /dev/null +++ b/testing/hosts/default/usr/local/sbin/ipsec @@ -0,0 +1,12 @@ +#!/bin/bash +# +# LEAK_DETECTIVE_DISABLE might be set, however, we only want to actually use +# it for the daemons if LEAK_DETECTIVE_DISABLE_DAEMON is set. + +ORIG=/usr/local/sbin/ipsec.orig + +if [[ "$1" == "start" && -z $LEAK_DETECTIVE_DISABLE_DAEMON ]]; then + unset LEAK_DETECTIVE_DISABLE +fi + +$ORIG "$@" diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages index caf423111..ce6a0aee1 100755 --- a/testing/scripts/build-guestimages +++ b/testing/scripts/build-guestimages @@ -47,6 +47,7 @@ do blockdev --rereadpt $NBDEV execute "mount $NBDPARTITION $LOOPDIR" 0 execute "mount -t proc none $LOOPDIR/proc" 0 + execute "mv $LOOPDIR/usr/local/sbin/ipsec $LOOPDIR/usr/local/sbin/ipsec.orig" 0 execute "cp -rf $HOSTSDIR/default/* $LOOPDIR" 0 execute "cp -rf $HOSTSDIR/${host}/etc $LOOPDIR" 0 execute_chroot "ldconfig" 0 diff --git a/testing/ssh_config b/testing/ssh_config index 3ecdd27d1..0974b990b 100644 --- a/testing/ssh_config +++ b/testing/ssh_config @@ -2,7 +2,7 @@ Host * LogLevel QUIET # debian default SendEnv LANG LC_* - SendEnv LEAK_DETECTIVE_LOG + SendEnv LEAK_DETECTIVE_* StrictHostKeyChecking no UserKnownHostsFile /dev/null GSSAPIAuthentication yes From 1043fa32de7040e573976c12ac74ad49c1abd552 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 18 Aug 2025 18:05:01 +0200 Subject: [PATCH 22/22] testing: Add delay after qemu-nbd -c Seems that there is a delay before the disk can be used when using newer QEMU versions (e.g. on Debian trixie). We get errors like these: sfdisk: cannot open /dev/nbd0: Inappropriate ioctl for device or mount: /srv/strongswan-testing/build/loop: special device /dev/nbd0p1 does not exist. A sleep before the next command seems to help. Also see [1]. [1] https://gitlab.com/qemu-project/qemu/-/issues/1413 --- testing/scripts/build-baseimage | 3 +++ testing/scripts/build-certs | 2 ++ testing/scripts/build-guestimages | 2 ++ testing/scripts/build-strongswan | 2 ++ testing/scripts/chroot | 2 ++ 5 files changed, 11 insertions(+) diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage index 37dfef2d4..8221fb86a 100755 --- a/testing/scripts/build-baseimage +++ b/testing/scripts/build-baseimage @@ -78,6 +78,9 @@ log_action "Connecting image to NBD device $NBDEV" execute "qemu-nbd -c $NBDEV $BASEIMG" do_on_exit qemu-nbd -d $NBDEV +# wait for disk to become ready with newer QEMU versions +sleep 1 + log_action "Partitioning disk" sfdisk /dev/nbd0 >>$LOGFILE 2>&1 << EOF ; diff --git a/testing/scripts/build-certs b/testing/scripts/build-certs index a8648033c..04f4fc703 100755 --- a/testing/scripts/build-certs +++ b/testing/scripts/build-certs @@ -22,6 +22,8 @@ mkdir -p $IMGDIR log_action "Connecting root image to NBD device $NBDEV" execute "qemu-nbd -c $NBDEV $ROOTIMG" do_on_exit qemu-nbd -d $NBDEV +# wait for disk to become ready with newer QEMU versions +sleep 1 blockdev --rereadpt $NBDEV log_action "Mounting $NBDPARTITION to $LOOPDIR" diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages index ce6a0aee1..c4d87c187 100755 --- a/testing/scripts/build-guestimages +++ b/testing/scripts/build-guestimages @@ -44,6 +44,8 @@ do log_action "Creating guest image for $host" execute "qemu-img create -b $ROOTIMG -f $IMGEXT -F $IMGEXT $IMGDIR/$host.$IMGEXT" 0 execute "qemu-nbd -c $NBDEV $IMGDIR/$host.$IMGEXT" 0 + # wait for disk to become ready with newer QEMU versions + sleep 1 blockdev --rereadpt $NBDEV execute "mount $NBDPARTITION $LOOPDIR" 0 execute "mount -t proc none $LOOPDIR/proc" 0 diff --git a/testing/scripts/build-strongswan b/testing/scripts/build-strongswan index 23cb2a028..8e6126ad3 100755 --- a/testing/scripts/build-strongswan +++ b/testing/scripts/build-strongswan @@ -115,6 +115,8 @@ case "$GUEST" in esac do_on_exit qemu-nbd -d $NBDEV +# wait for disk to become ready with newer QEMU versions +sleep 1 blockdev --rereadpt $NBDEV log_action "Mounting $NBDPARTITION to $LOOPDIR" diff --git a/testing/scripts/chroot b/testing/scripts/chroot index b686abd97..c9a9dec7c 100755 --- a/testing/scripts/chroot +++ b/testing/scripts/chroot @@ -42,6 +42,8 @@ root) esac do_on_exit qemu-nbd -d $NBDEV +# wait for disk to become ready with newer QEMU versions +sleep 1 blockdev --rereadpt $NBDEV log_action "Mounting $NBDPARTITION to $LOOPDIR"