mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 08:42:29 +01:00
13bfdd71e6
Updated StrongSwan VPN ImplementationThis PR is a merge of @jayapalu changes in #872 and the changes I had to make to get the functionality working. I have done pretty extensive testing of this code so far and we are looking to be in pretty good shape. One thing to note is that a `Diffie-Hellman` group **is required** in order for this feature to work correctly. It is not highlighted in the tests below, but I have shown that the `PFS` is not required for this feature to work. In #872 I have shown a more exhaustive set of tests of this code, but I have limited this set of tests to a recommended `IKE` and `ESP` configuration in order to reduce the noise and test the other areas of functionality. **Test Results** I am testing this functionality by creating two VPCs with VMs in each and creating a S2S VPN connection between the two VPCs. Then I SSH into a VM in one VPC and I ping the private IP of a VM in the other VPC. Then I tear it down and try a different configuration. _Setup_ ``` VPC 1 VPC 2 ===== ===== VPN Gateway VPN Gateway VPN Customer Gateway VPN Customer Gateway VPN Connection <---> VPN Connection - Passive = True - Passive = False ``` _Legend_ `SKIP` => At least one of the VPN Connections did not come up, so no test was run. `OK` => The ping test was successful over the S2S VPN connection. `FAIL` => The ping test failed over the S2S VPN connection. `Passive` => Specifies if either the `<vpc_1> : <vpc_2>` sides of the VPN Connection is set to passive. `Conn State` => Specifies the connection status of the `<vpc_1> : <vpc_2>` VPN Connection in the UI. `Requires Reset` => If the ping test does not result in an `OK`, then a VPN Connection Reset is performed on either `<vpc_1> : <vpc_2>` sides of the VPN Connection based on which side is not showing `Connected`. The results in the `Status` column is the final result after the reset is performed. _Results_ ``` +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | Status | IKE & ESP | DPD | Encap | IKE Life | ESP Life | Passive | Conn State | Requires Reset | +========+======================+=======+=======+==========+==========+===============+=============================+================+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | True | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | | | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : False | Connected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : False | Connected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | True | False | 86400 | 3600 | True : False | Disconnected : Error | True : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | False | False | 86400 | 3600 | True : False | Disconnected : Error | True : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | FAIL | aes128-sha1 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | True : True | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | True | False | 86400 | 3600 | False : False | Connected : Error | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ ``` * pr/1741: complete implementation of the StrongSwan VPN feature Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>