1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
|
AT_BANNER(IPsec)
dnl IPSEC_SETUP_UNDERLAY()
dnl
dnl Configure anything required in the underlay network
m4_define([IPSEC_SETUP_UNDERLAY],
[AT_CHECK([cp ${abs_top_srcdir}/vswitchd/vswitch.ovsschema vswitch.ovsschema])
dnl Set up the underlay switch
AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])])
dnl IPSEC_ADD_NODE([namespace], [device], [address], [peer address]))
dnl
dnl Creates a dummy host that acts as an IPsec endpoint. Creates host in
dnl 'namespace' and attaches a veth 'device' to 'namespace' to act as the host
dnl NIC. Assigns 'address' to 'device' and adds the other end of veth 'device' to
dnl 'br0' which is an OVS bridge in the default namespace acting as an underlay
dnl switch. Sets the default gateway of 'namespace' to 'peer address'.
dnl
dnl Starts all daemons in 'namespace' that are required for IPsec
m4_define([IPSEC_ADD_NODE],
[ADD_NAMESPACES($1)
dnl Disable DAD. We know we wont get duplicates on this underlay network.
NS_EXEC([$1], [sysctl -w net.ipv6.conf.all.accept_dad=0])
NS_EXEC([$1], [sysctl -w net.ipv6.conf.default.accept_dad=0])
ADD_VETH($2, $1, br0, $3/24)
NS_EXEC([$1], [ip route add default via $4 dev $2])
mkdir -p $ovs_base/$1
touch $ovs_base/$1/.conf.db.~lock~
NS_EXEC([$1], [ovsdb-tool create $ovs_base/$1/conf.db \
$abs_top_srcdir/vswitchd/vswitch.ovsschema], [0], [], [stderr])
dnl Start ovsdb-server.
NS_EXEC([$1],[ovsdb-server $ovs_base/$1/conf.db --detach --no-chdir \
--log-file=$ovs_base/$1/ovsdb.log --pidfile=$ovs_base/$1/ovsdb.pid \
--remote=punix:$OVS_RUNDIR/$1/db.sock], [0], [], [stderr])
on_exit "kill `cat $ovs_base/$1/ovsdb.pid`"
NS_EXEC([$1], [ovs-vsctl --no-wait init])
dnl Start ovs-vswitchd.
NS_EXEC([$1], [ovs-vswitchd unix:${OVS_RUNDIR}/$1/db.sock --detach \
--no-chdir --pidfile=$ovs_base/$1/vswitchd.pid \
--unixctl=$ovs_base/$1/vswitchd.ctl \
--log-file=$ovs_base/$1/vswitchd.log -vvconn -vofproto_dpif -vunixctl],\
[0], [], [stderr])
on_exit "kill_ovs_vswitchd `cat $ovs_base/$1/vswitchd.pid`"
dnl Start pluto
mkdir -p $ovs_base/$1/ipsec.d
touch $ovs_base/$1/ipsec.conf
touch $ovs_base/$1/secrets
ipsec initnss --nssdir $ovs_base/$1/ipsec.d
NS_CHECK_EXEC([$1], [ipsec pluto --config $ovs_base/$1/ipsec.conf \
--ipsecdir $ovs_base/$1 --nssdir $ovs_base/$1/ipsec.d \
--logfile $ovs_base/$1/pluto.log --secretsfile $ovs_base/$1/secrets \
--rundir $ovs_base/$1], [0], [], [stderr])
on_exit "kill `cat $ovs_base/$1/pluto.pid`"
dnl Start ovs-monitor-ipsec
NS_CHECK_EXEC([$1], [ovs-monitor-ipsec unix:${OVS_RUNDIR}/$1/db.sock\
--pidfile=${OVS_RUNDIR}/$1/ovs-monitor-ipsec.pid --ike-daemon=libreswan\
--ipsec-conf=$ovs_base/$1/ipsec.conf --ipsec-d=$ovs_base/$1/ipsec.d \
--ipsec-secrets=$ovs_base/$1/secrets \
--log-file=$ovs_base/$1/ovs-monitor-ipsec.log \
--ipsec-ctl=$ovs_base/$1/pluto.ctl \
--no-restart-ike-daemon --detach ], [0], [], [stderr])
on_exit "kill `cat $ovs_base/$1/ovs-monitor-ipsec.pid`"
dnl Set up OVS bridge
NS_EXEC([$1], [ovs-vsctl --db unix:$ovs_base/$1/db.sock add-br br-ipsec])]
)
m4_define([IPSEC_ADD_NODE_LEFT], [IPSEC_ADD_NODE(left, p0, $1, $2)])
m4_define([IPSEC_ADD_NODE_RIGHT], [IPSEC_ADD_NODE(right, p1, $1, $2)])
dnl OVS_VSCTL([namespace], [sub-command])
dnl
dnl Runs `ovs-vsctl 'sub-command'` in 'namespace'
m4_define([OVS_VSCTL],
[[ip netns exec $1 ovs-vsctl --db unix:$ovs_base/$1/db.sock $2 ]])
m4_define([OVS_VSCTL_LEFT], [OVS_VSCTL(left, $1)])
m4_define([OVS_VSCTL_RIGHT], [OVS_VSCTL(right, $1)])
dnl IPSEC_ADD_TUNNEL([namespace], [type], [options]])
dnl
dnl Creates a tunnel of type 'type' in namespace 'namespace' using 'options'
m4_define([IPSEC_ADD_TUNNEL],
[OVS_VSCTL([$1], [add-port br-ipsec tun -- set Interface tun type=$2 $3])
dnl Wait for all expected connections to be loaded into Libreswan.
dnl GRE creates 1 connection, all others create 2.
m4_if($2, [gre],
[OVS_WAIT_UNTIL([test `IPSEC_STATUS_LOADED($1)` -eq 1])],
[OVS_WAIT_UNTIL([test `IPSEC_STATUS_LOADED($1)` -eq 2])])
])
m4_define([IPSEC_ADD_TUNNEL_LEFT], [IPSEC_ADD_TUNNEL(left, $1, $2)])
m4_define([IPSEC_ADD_TUNNEL_RIGHT], [IPSEC_ADD_TUNNEL(right, $1, $2)])
dnl CHECK_LIBRESWAN()
dnl
dnl Check if necessary Libreswan dependencies are available on the test machine
m4_define([CHECK_LIBRESWAN],
[dnl Skip tests if system has not been set up for Libreswan
AT_SKIP_IF([!(ipsec --version | grep Libreswan)])
AT_SKIP_IF([test ! -x $(which certutil)])
AT_SKIP_IF([test ! -x $(which pk12util)])
AT_SKIP_IF([test ! -x $(which openssl)])
dnl If '$ovs_base' is too long, the following Libreswan issue will trigger
dnl so we check that it is not too long and skip test if it is.
dnl https://github.com/libreswan/libreswan/issues/428
AT_SKIP_IF([test "${#ovs_base}" -gt "90" ])])
dnl IPSEC_STATUS_LOADED([])
dnl
dnl Get number of loaded connections from ipsec status
m4_define([IPSEC_STATUS_LOADED], [ipsec status --rundir $ovs_base/$1 | \
grep "Total IPsec connections" | \
sed 's/[[0-9]]* Total IPsec connections: loaded \([[0-2]]\), active \([[0-2]]\).*/\1/m'])
dnl IPSEC_STATUS_ACTIVE([])
dnl
dnl Get number of active connections from ipsec status
m4_define([IPSEC_STATUS_ACTIVE], [ipsec status --rundir $ovs_base/$1 | \
grep "Total IPsec connections" | \
sed 's/[[0-9]]* Total IPsec connections: loaded \([[0-2]]\), active \([[0-2]]\).*/\2/m'])
dnl CHECK_ESP_TRAFFIC()
dnl
dnl Checks for connectivity between nodes and that the underlay traffic is ESP.
m4_define([CHECK_ESP_TRAFFIC],
[dnl Add test interfaces for pinging
NS_EXEC([left], [ip addr add 192.0.0.1/24 dev br-ipsec])
NS_EXEC([left], [ip link set dev br-ipsec up])
NS_EXEC([right], [ip addr add 192.0.0.2/24 dev br-ipsec])
NS_EXEC([right], [ip link set dev br-ipsec up])
dnl Capture any underlay esp packets
OVS_DAEMONIZE([tcpdump -l -nn -i ovs-p0 esp > $ovs_base/left/tcpdump.log], [tcpdump0.pid])
OVS_DAEMONIZE([tcpdump -l -nn -i ovs-p1 esp > $ovs_base/right/tcpdump.log], [tcpdump1.pid])
dnl Wait for all loaded connections to be active
OVS_WAIT_UNTIL([test `IPSEC_STATUS_LOADED(left)` -eq `IPSEC_STATUS_ACTIVE(left)`])
OVS_WAIT_UNTIL([test `IPSEC_STATUS_LOADED(right)` -eq `IPSEC_STATUS_ACTIVE(right)`])
dnl Ping over IPsec tunnel
NS_CHECK_EXEC([left], [ping -q -c 3 -i 0.3 -w 2 192.0.0.2 | FORMAT_PING], [0], [dnl
3 packets transmitted, 3 received, 0% packet loss, time 0ms
])
NS_CHECK_EXEC([right], [ping -q -c 3 -i 0.3 -w 2 192.0.0.1 | FORMAT_PING], [0], [dnl
3 packets transmitted, 3 received, 0% packet loss, time 0ms
])
dnl Check for esp traffic
dnl Note: Geneve tests may not work on older kernels due to CVE-2020-25645
dnl https://bugzilla.redhat.com/show_bug.cgi?id=1883988
AT_CHECK([cat $ovs_base/left/tcpdump.log | grep ESP], [0], [stdout], [stderr])
AT_CHECK([cat $ovs_base/right/tcpdump.log | grep ESP], [0], [stdout], [stderr])])
AT_SETUP([IPsec -- Libreswan (ipv4, geneve, defaultroute, psk)])
AT_KEYWORDS([ipsec libreswan ipv4 geneve psk])
dnl Note: Geneve test may not work on older kernels due to CVE-2020-25645
dnl https://bugzilla.redhat.com/show_bug.cgi?id=1883988
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(10.1.1.1, 10.1.1.2)
IPSEC_ADD_NODE_RIGHT(10.1.1.2, 10.1.1.1)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([geneve],
[options:remote_ip=10.1.1.2 options:psk=swordfish])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([geneve],
[options:remote_ip=10.1.1.1 options:psk=swordfish])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
AT_SETUP([IPsec -- Libreswan (ipv4, geneve, localip, psk)])
AT_KEYWORDS([ipsec libreswan ipv4 geneve psk])
dnl Note: Geneve test may not work on older kernels due to CVE-2020-25645
dnl https://bugzilla.redhat.com/show_bug.cgi?id=1883988
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(10.1.1.1, 10.1.1.2)
IPSEC_ADD_NODE_RIGHT(10.1.1.2, 10.1.1.1)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([geneve],
[options:remote_ip=10.1.1.2 \
options:local_ip=10.1.1.1 options:psk=swordfish])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([geneve],
[options:remote_ip=10.1.1.1 \
options:local_ip=10.1.1.2 options:psk=swordfish])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
AT_SETUP([IPsec -- Libreswan (ipv4, geneve, defaultroute, self-signed)])
AT_KEYWORDS([ipsec libreswan ipv4 geneve self-signed])
dnl Note: Geneve test may not work on older kernels due to CVE-2020-25645
dnl https://bugzilla.redhat.com/show_bug.cgi?id=1883988
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(10.1.1.1, 10.1.1.2)
IPSEC_ADD_NODE_RIGHT(10.1.1.2, 10.1.1.1)
dnl Create and set self-signed certs
ovs-pki -b -d ${ovs_base} -l ${ovs_base}/ovs-pki.log req -u left
ovs-pki -b -d ${ovs_base} -l ${ovs_base}/ovs-pki.log req -u right
ovs-pki -b -d ${ovs_base} -l ${ovs_base}/ovs-pki.log self-sign left
ovs-pki -b -d ${ovs_base} -l ${ovs_base}/ovs-pki.log self-sign right
OVS_VSCTL_LEFT(set Open_vSwitch . \
other_config:certificate=${ovs_base}/left-cert.pem \
other_config:private_key=${ovs_base}/left-privkey.pem)
OVS_VSCTL_RIGHT(set Open_vSwitch . \
other_config:certificate=${ovs_base}/right-cert.pem \
other_config:private_key=${ovs_base}/right-privkey.pem)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([geneve],
[options:remote_ip=10.1.1.2 \
options:remote_cert=${ovs_base}/right-cert.pem])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([geneve],
[options:remote_ip=10.1.1.1 \
options:remote_cert=${ovs_base}/left-cert.pem])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
AT_SETUP([IPsec -- Libreswan (ipv4, geneve, defaultroute, ca-signed)])
AT_KEYWORDS([ipsec libreswan ipv4 geneve ca-signed])
dnl Note: Geneve test may not work on older kernels due to CVE-2020-25645
dnl https://bugzilla.redhat.com/show_bug.cgi?id=1883988
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(10.1.1.1, 10.1.1.2)
IPSEC_ADD_NODE_RIGHT(10.1.1.2, 10.1.1.1)
dnl Create and set ca-signed certs
ovs-pki --force -b --dir=${ovs_base} -l ${ovs_base}/ovs-pki.log init
ovs-pki -b --dir=${ovs_base} -l ${ovs_base}/ovs-pki.log req+sign -u left
ovs-pki -b --dir=${ovs_base} -l ${ovs_base}/ovs-pki.log req+sign -u right
OVS_VSCTL_LEFT(set Open_vSwitch . \
other_config:ca_cert=${ovs_base}/switchca/cacert.pem \
other_config:certificate=${ovs_base}/left-cert.pem \
other_config:private_key=${ovs_base}/left-privkey.pem)
OVS_VSCTL_RIGHT(set Open_vSwitch . \
other_config:ca_cert=${ovs_base}/switchca/cacert.pem \
other_config:certificate=${ovs_base}/right-cert.pem \
other_config:private_key=${ovs_base}/right-privkey.pem)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([geneve],
[options:remote_ip=10.1.1.2 options:remote_name=right])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([geneve],
[options:remote_ip=10.1.1.1 options:remote_name=left])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
AT_SETUP([IPsec -- Libreswan (ipv4, gre, defaultroute, psk)])
AT_KEYWORDS([ipsec libreswan ipv4 gre psk])
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(10.1.1.1, 10.1.1.2)
IPSEC_ADD_NODE_RIGHT(10.1.1.2, 10.1.1.1)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([gre],
[options:remote_ip=10.1.1.2 options:psk=swordfish])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([gre],
[options:remote_ip=10.1.1.1 options:psk=swordfish])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
AT_SETUP([IPsec -- Libreswan (ipv4, vxlan, defaultroute, psk)])
AT_KEYWORDS([ipsec libreswan ipv4, vxlan psk])
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(10.1.1.1, 10.1.1.2)
IPSEC_ADD_NODE_RIGHT(10.1.1.2, 10.1.1.1)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([vxlan],
[options:remote_ip=10.1.1.2 options:psk=swordfish])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([vxlan],
[options:remote_ip=10.1.1.1 options:psk=swordfish])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
AT_SETUP([IPsec -- Libreswan (ipv6, vxlan, defaultroute, psk)])
AT_KEYWORDS([ipsec libreswan ipv6 vxlan psk])
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(fd01::101, fd01::102)
IPSEC_ADD_NODE_RIGHT(fd01::102, fd01::101)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([vxlan],
[options:remote_ip=fd01::102 options:psk=swordfish])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([vxlan],
[options:remote_ip=fd01::101 options:psk=swordfish])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
AT_SETUP([IPsec -- Libreswan (ipv6, vxlan, localip, psk)])
AT_KEYWORDS([ipsec libreswan ipv6 vxlan psk])
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(fd01::101, fd01::102)
IPSEC_ADD_NODE_RIGHT(fd01::102, fd01::101)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([vxlan],
[options:remote_ip=fd01::102 \
options:local_ip=fd01::101 options:psk=swordfish])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([vxlan],
[options:remote_ip=fd01::101 \
options:local_ip=fd01::102 options:psk=swordfish])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
AT_SETUP([IPsec -- Libreswan (ipv6, geneve, defaultroute, psk)])
AT_KEYWORDS([ipsec libreswan ipv6 geneve psk])
dnl Note: Geneve test may not work on older kernels due to CVE-2020-25645
dnl https://bugzilla.redhat.com/show_bug.cgi?id=1883988
CHECK_LIBRESWAN()
OVS_TRAFFIC_VSWITCHD_START()
IPSEC_SETUP_UNDERLAY()
dnl Set up dummy hosts
IPSEC_ADD_NODE_LEFT(fd01::101, fd01::102)
IPSEC_ADD_NODE_RIGHT(fd01::102, fd01::101)
dnl Set up IPsec tunnel on 'left' host
IPSEC_ADD_TUNNEL_LEFT([geneve],
[options:remote_ip=fd01::102 options:psk=swordfish])
dnl Set up IPsec tunnel on 'right' host
IPSEC_ADD_TUNNEL_RIGHT([geneve],
[options:remote_ip=fd01::101 options:psk=swordfish])
CHECK_ESP_TRAFFIC
OVS_TRAFFIC_VSWITCHD_STOP()
AT_CLEANUP
|
