testing: Add ikev2/per-cpu-sas-encap scenario

Basically the same as the one without UDP encapsulation, but here the
outbound SAs use random source ports.

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/description.txt b/testing/tests/ikev2/per-cpu-sas-encap/description.txt
new file mode 100755 (executable)
index 0000000..3c2f110
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/description.txt
@@ -0,0 +1,13 @@
+The two gateways <b>moon</b> and <b>sun</b> are configured to use per-CPU
+CHILD_SAs in order to improve performance. Using the <b>taskset</b> utility
+pings are sent from different CPUs triggering the creation of additional SA
+via the installed trap policy. The first ping triggers the creation of a
+fallback SA that's used while per-CPU SAs are created for later packets. Note
+that responses sent from the peer may create per-CPU SAs that are not triggered
+by local acquires.
+<p>
+UDP encapsulation is forced and the special value <b>encap</b> is used when
+enabling per-CPU SAs to force random source ports for the outbound SAs.
+<p>
+The updown script automatically inserts iptables-based firewall rules
+that let pass the tunneled traffic.

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/evaltest.dat b/testing/tests/ikev2/per-cpu-sas-encap/evaltest.dat
new file mode 100755 (executable)
index 0000000..8b653a2
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/evaltest.dat
@@ -0,0 +1,80 @@
+moon::swanctl --list-pols --raw 2> /dev/null::net-net.*mode=TUNNEL local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
+moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8]::YES
+moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8].*cpu::NO
+moon::swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*per-cpu-sas=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
+sun:: swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*per-cpu-sas=yes.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
+# this triggers a per-CPU SA for CPU 1 and creates one for CPU 3 as responder,
+# the packet is sent and received via fallback SA
+moon::taskset -c 1 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8].*cpu {1}::YES
+moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=0::YES
+moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=0.*packets-out=0::YES
+# this takes the per-CPU SA created above, the response most likely the one
+# created as responder
+moon::taskset -c 1 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=1.*packets-out=0::YES
+# trigger another SA for CPU 0, request is sent via fallback SA, received via sub SA
+moon::taskset -c 0 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8].*cpu {0}::YES
+moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=2::YES
+moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=2.*packets-out=0::YES
+moon::swanctl --list-sas --child-id 5 --raw 2> /dev/null::child-sas.*net-net.*cpu=0.*packets-in=0.*packets-out=0::YES
+# create a final SA for CPU 2, request is sent via fallback SA, response via one of the
+# sub SAs (depends on the CPU assignment on the responder as it has to assign multiple
+# SAs to the same CPU, so it could be either the one with unique ID 5, as it might
+# be the newer one for that CPU, or it could be the original SA with unique ID 4)
+moon::taskset -c 2 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::cat /var/log/daemon.log::creating acquire job for policy 10.1.0.1/32\[icmp/8] === 10.2.0.10/32\[icmp/8].*cpu {2}::YES
+moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=3::YES
+moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=2.*packets-out=0::YES
+moon::swanctl --list-sas --child-id 5 --raw 2> /dev/null::child-sas.*net-net.*cpu=0.*packets-in=1.*packets-out=0::YES
+moon::swanctl --list-sas --child-id 6 --raw 2> /dev/null::child-sas.*net-net.*cpu=2.*packets-in=0.*packets-out=0::YES
+# all these pings must be sent via their respective SAs, never the fallback SA
+moon::taskset -c 0 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::taskset -c 1 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::taskset -c 2 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::taskset -c 3 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*packets-in=1.*packets-out=3::YES
+moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*cpu=1.*packets-in=0.*packets-out=2::YES
+moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*cpu=3.*packets-in=2.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 5 --raw 2> /dev/null::child-sas.*net-net.*cpu=0.*packets-in=1.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 6 --raw 2> /dev/null::child-sas.*net-net.*cpu=2.*packets-in=4.*packets-out=1::YES
+# rekey an SA as initiator
+moon::swanctl --rekey --child-id 5
+moon::sleep .5
+moon::taskset -c 0 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::swanctl --list-sas --child-id 7 --raw 2> /dev/null::child-sas.*net-net.*cpu=0.*packets-in=1.*packets-out=1::YES
+# rekey an SA as responder
+sun::swanctl --rekey --child-id 6
+moon::sleep .5
+moon::taskset -c 2 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::swanctl --list-sas --child-id 8 --raw 2> /dev/null::child-sas.*net-net.*cpu=2.*packets-in=1.*packets-out=1::YES
+# rekey the fallback SA
+moon::swanctl --rekey --child-id 2
+moon::sleep .5
+moon::swanctl --list-sas --child-id 9 --raw 2> /dev/null::child-sas.*net-net.*packets-in=0.*packets-out=0::YES
+# all these pings must be sent via their respective SAs, never the fallback SA and not
+# the old ones that remain to process delayed inbound packets
+moon::taskset -c 0 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::taskset -c 1 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::taskset -c 2 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::taskset -c 3 ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*state=DELETED.*packets-in=1.*packets-out=3::YES
+moon::swanctl --list-sas --child-id 3 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*cpu=1.*packets-in=0.*packets-out=3::YES
+moon::swanctl --list-sas --child-id 4 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*cpu=3.*packets-in=2.*packets-out=2::YES
+moon::swanctl --list-sas --child-id 5 --raw 2> /dev/null::child-sas.*net-net.*state=DELETED.*cpu=0.*packets-in=1.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 6 --raw 2> /dev/null::child-sas.*net-net.*state=DELETED.*cpu=2.*packets-in=4.*packets-out=1::YES
+moon::swanctl --list-sas --child-id 7 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*cpu=0.*packets-in=1.*packets-out=2::YES
+moon::swanctl --list-sas --child-id 8 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*cpu=2.*packets-in=5.*packets-out=2::YES
+moon::swanctl --list-sas --child-id 9 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*packets-in=0.*packets-out=0::YES
+# also test forwarding (we don't know which SA this takes, but never the fallback SA)
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+moon::swanctl --list-sas --child-id 2 --raw 2> /dev/null::child-sas.*net-net.*state=DELETED.*packets-in=1.*packets-out=3::YES
+moon::swanctl --list-sas --child-id 9 --raw 2> /dev/null::child-sas.*net-net.*state=INSTALLED.*packets-in=0.*packets-out=0::YES
+sun::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES
+sun::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/per-cpu-sas-encap/hosts/moon/etc/strongswan.conf
new file mode 100755 (executable)
index 0000000..8af0dab
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/hosts/moon/etc/strongswan.conf
@@ -0,0 +1,15 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici
+
+  syslog {
+    daemon {
+      knl = 2
+    }
+  }
+}

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/ikev2/per-cpu-sas-encap/hosts/moon/etc/swanctl/swanctl.conf
new file mode 100755 (executable)
index 0000000..3dddf48
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/hosts/moon/etc/swanctl/swanctl.conf
@@ -0,0 +1,34 @@
+connections {
+
+   gw-gw {
+      local_addrs  = 192.168.0.1
+      remote_addrs = 192.168.0.2
+
+      local {
+         auth = pubkey
+         certs = moonCert.pem
+         id = moon.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = sun.strongswan.org
+      }
+      children {
+         net-net {
+            local_ts  = 10.1.0.0/16
+            remote_ts = 10.2.0.0/16
+
+            per_cpu_sas = encap
+
+            start_action = trap
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            hostaccess = yes
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      mobike = no
+      encap = yes
+      proposals = aes128-sha256-x25519
+   }
+}

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/hosts/sun/etc/strongswan.conf b/testing/tests/ikev2/per-cpu-sas-encap/hosts/sun/etc/strongswan.conf
new file mode 100755 (executable)
index 0000000..8af0dab
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/hosts/sun/etc/strongswan.conf
@@ -0,0 +1,15 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+swanctl {
+  load = pem pkcs1 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
+  load = random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici
+
+  syslog {
+    daemon {
+      knl = 2
+    }
+  }
+}

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/hosts/sun/etc/swanctl/swanctl.conf b/testing/tests/ikev2/per-cpu-sas-encap/hosts/sun/etc/swanctl/swanctl.conf
new file mode 100755 (executable)
index 0000000..f29f86c
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/hosts/sun/etc/swanctl/swanctl.conf
@@ -0,0 +1,34 @@
+connections {
+
+   gw-gw {
+      local_addrs  = 192.168.0.2
+      remote_addrs = 192.168.0.1
+
+      local {
+         auth = pubkey
+         certs = sunCert.pem
+         id = sun.strongswan.org
+      }
+      remote {
+         auth = pubkey
+         id = moon.strongswan.org
+      }
+      children {
+         net-net {
+            local_ts  = 10.2.0.0/16
+            remote_ts = 10.1.0.0/16
+
+            per_cpu_sas = encap
+
+            start_action = trap
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            hostaccess = yes
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      mobike = no
+      encap = yes
+      proposals = aes128-sha256-x25519
+   }
+}

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/posttest.dat b/testing/tests/ikev2/per-cpu-sas-encap/posttest.dat
new file mode 100755 (executable)
index 0000000..cc6a5bf
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/posttest.dat
@@ -0,0 +1,5 @@
+moon::swanctl --terminate --ike gw-gw 2> /dev/null
+moon::systemctl stop strongswan
+sun::systemctl stop strongswan
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/pretest.dat b/testing/tests/ikev2/per-cpu-sas-encap/pretest.dat
new file mode 100755 (executable)
index 0000000..594837d
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/pretest.dat
@@ -0,0 +1,16 @@
+sun::iptables-restore < /etc/iptables.rules
+moon::iptables-restore < /etc/iptables.rules
+sun::systemctl start strongswan
+moon::systemctl start strongswan
+sun::expect-connection gw-gw
+moon::expect-connection gw-gw
+# allow UDP encap from any source to 4500
+moon::iptables -A INPUT  -i eth0 -p udp --dport 4500 -j ACCEPT
+moon::iptables -A OUTPUT -o eth0 -p udp --dport 4500 -j ACCEPT
+sun:: iptables -A INPUT  -i eth0 -p udp --dport 4500 -j ACCEPT
+sun:: iptables -A OUTPUT -o eth0 -p udp --dport 4500 -j ACCEPT
+# triggering packet apparently goes via lo
+moon::iptables -A OUTPUT -o lo -d 10.2.0.0/16 -j ACCEPT
+# trigger the creation of the fallback SA, use -I so no UDP socket is used to
+# determine the source address and trigger the acqurie (this packet is lost)
+moon::ping -c 1 -W 1 -I PH_IP_MOON1 PH_IP_BOB

diff --git a/testing/tests/ikev2/per-cpu-sas-encap/test.conf b/testing/tests/ikev2/per-cpu-sas-encap/test.conf
new file mode 100755 (executable)
index 0000000..07a3b24
--- /dev/null
+++ b/testing/tests/ikev2/per-cpu-sas-encap/test.conf
@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+ 
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
+
+# charon controlled by swanctl
+#
+SWANCTL=1