denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Make timing for TKM rekey scenarios a bit more stable

Browse Source 
In particular for the first one randomization could trigger an additional
rekeying, which let the "Adding ESA ..." check fail.  But even without
randomization (could be seen in the second scenario that already uses
`rand_time=0`) 4 seconds can apparently be too low some time.
This commit is contained in:
Tobias Brunner
2024-11-25 11:44:04 +01:00
parent af28aac85f
commit 7e310e3425
5 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/tkm/xfrmproxy-rekey/evaltest.dat
+1 -1
View File
@@ -1,6 +1,6 @@
moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
moon::sleep 4::wait for rekeying::NO
moon::sleep 5::wait for rekeying::NO
sun::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
testing/tests/tkm/xfrmproxy-rekey/hosts/sun/etc/swanctl/swanctl.conf
+1 -1
View File
@@ -18,7 +18,7 @@ connections {
children {
host-host {
life_time=10s
rekey_time=4s
rekey_time=5s
rand_time=0
mode = transport
esp_proposals = aes256-sha512-modp4096