mirror of https://github.com/apache/cloudstack.git
Updated StrongSwan VPN ImplementationThis PR is a merge of @jayapalu changes in #872 and the changes I had to make to get the functionality working. I have done pretty extensive testing of this code so far and we are looking to be in pretty good shape. One thing to note is that a `Diffie-Hellman` group **is required** in order for this feature to work correctly. It is not highlighted in the tests below, but I have shown that the `PFS` is not required for this feature to work. In #872 I have shown a more exhaustive set of tests of this code, but I have limited this set of tests to a recommended `IKE` and `ESP` configuration in order to reduce the noise and test the other areas of functionality. **Test Results** I am testing this functionality by creating two VPCs with VMs in each and creating a S2S VPN connection between the two VPCs. Then I SSH into a VM in one VPC and I ping the private IP of a VM in the other VPC. Then I tear it down and try a different configuration. _Setup_ ``` VPC 1 VPC 2 ===== ===== VPN Gateway VPN Gateway VPN Customer Gateway VPN Customer Gateway VPN Connection <---> VPN Connection - Passive = True - Passive = False ``` _Legend_ `SKIP` => At least one of the VPN Connections did not come up, so no test was run. `OK` => The ping test was successful over the S2S VPN connection. `FAIL` => The ping test failed over the S2S VPN connection. `Passive` => Specifies if either the `<vpc_1> : <vpc_2>` sides of the VPN Connection is set to passive. `Conn State` => Specifies the connection status of the `<vpc_1> : <vpc_2>` VPN Connection in the UI. `Requires Reset` => If the ping test does not result in an `OK`, then a VPN Connection Reset is performed on either `<vpc_1> : <vpc_2>` sides of the VPN Connection based on which side is not showing `Connected`. The results in the `Status` column is the final result after the reset is performed. _Results_ ``` +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | Status | IKE & ESP | DPD | Encap | IKE Life | ESP Life | Passive | Conn State | Requires Reset | +========+======================+=======+=======+==========+==========+===============+=============================+================+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | True | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | | | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : False | Connected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : False | Connected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | True | False | 86400 | 3600 | True : False | Disconnected : Error | True : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | False | False | 86400 | 3600 | True : False | Disconnected : Error | True : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | FAIL | aes128-sha1 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | True : True | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | True | False | 86400 | 3600 | False : False | Connected : Error | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ ``` * pr/1741: complete implementation of the StrongSwan VPN feature Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com> |
||
|---|---|---|
| .. | ||
| cpu_limits | ||
| maint | ||
| __init__.py | ||
| find_hosts_for_migration.py | ||
| test_VirtualRouter_alerts.py | ||
| test_accounts.py | ||
| test_acl_isolatednetwork.py | ||
| test_acl_isolatednetwork_delete.py | ||
| test_acl_listsnapshot.py | ||
| test_acl_listvm.py | ||
| test_acl_listvolume.py | ||
| test_acl_sharednetwork.py | ||
| test_acl_sharednetwork_deployVM-impersonation.py | ||
| test_add_remove_network.py | ||
| test_advancedsg_networks.py | ||
| test_affinity_groups.py | ||
| test_affinity_groups_projects.py | ||
| test_allocation_states.py | ||
| test_asa1000v_fw.py | ||
| test_assign_vm.py | ||
| test_baremetal.py | ||
| test_base_image_updation.py | ||
| test_bigswitch_bcf.py | ||
| test_blocker_bugs.py | ||
| test_brocade_vcs.py | ||
| test_browse_templates.py | ||
| test_browse_templates2.py | ||
| test_browse_volumes.py | ||
| test_concurrent_snapshots_limit.py | ||
| test_cpu_domain_limits.py | ||
| test_cpu_limits.py | ||
| test_cpu_max_limits.py | ||
| test_cpu_project_limits.py | ||
| test_custom_hostname.py | ||
| test_deploy_vgpu_vm.py | ||
| test_deploy_vm_userdata_multi_nic.py | ||
| test_deploy_vm_userdata_reg.py | ||
| test_dhcp_dns_offload.py | ||
| test_dynamic_compute_offering.py | ||
| test_egress_fw_rules.py | ||
| test_egress_rules.py | ||
| test_eip_elb.py | ||
| test_escalation_listTemplateDomainAdmin.py | ||
| test_escalations_instances.py | ||
| test_escalations_ipaddresses.py | ||
| test_escalations_isos.py | ||
| test_escalations_networks.py | ||
| test_escalations_routers.py | ||
| test_escalations_securitygroups.py | ||
| test_escalations_snapshots.py | ||
| test_escalations_templates.py | ||
| test_escalations_vmware.py | ||
| test_escalations_volumes.py | ||
| test_escalations_vpncustomergateways.py | ||
| test_haproxy.py | ||
| test_host_ha.py | ||
| test_host_ha.sh | ||
| test_host_maintenance.py | ||
| test_implicit_planner.py | ||
| test_interop_xd_ccp.py | ||
| test_invalid_gw_nm.py | ||
| test_ip_reservation.py | ||
| test_lb_secondary_ip.py | ||
| test_ldap.py | ||
| test_memory_limits.py | ||
| test_mm_domain_limits.py | ||
| test_mm_max_limits.py | ||
| test_mm_project_limits.py | ||
| test_multiple_ip_ranges.py | ||
| test_multiple_ips_per_nic.py | ||
| test_multiple_public_interfaces.py | ||
| test_netscaler_configs.py | ||
| test_netscaler_lb.py | ||
| test_netscaler_lb_algo.py | ||
| test_netscaler_lb_sticky.py | ||
| test_netscaler_nw_off.py | ||
| test_network_offering.py | ||
| test_non_contiguous_vlan.py | ||
| test_organization_states.py | ||
| test_overcommit.py | ||
| test_persistent_networks.py | ||
| test_portable_ip.py | ||
| test_project_configs.py | ||
| test_project_limits.py | ||
| test_project_resources.py | ||
| test_project_usage.py | ||
| test_projects.py | ||
| test_ps_domain_limits.py | ||
| test_ps_limits.py | ||
| test_ps_max_limits.py | ||
| test_ps_project_limits.py | ||
| test_ps_resize_volume.py | ||
| test_ps_resource_limits_volume.py | ||
| test_recurring_snapshots.py | ||
| test_redundant_router_cleanups.py | ||
| test_redundant_router_services.py | ||
| test_redundant_router_upgrades.py | ||
| test_region_vpc.py | ||
| test_regions.py | ||
| test_regions_accounts.py | ||
| test_reset_ssh_keypair.py | ||
| test_resource_limits.py | ||
| test_routers.py | ||
| test_security_groups.py | ||
| test_shared_networks.py | ||
| test_simultaneous_volume_attach.py | ||
| test_snapshot_gc.py | ||
| test_snapshot_limits.py | ||
| test_snapshots.py | ||
| test_snapshots_improvement.py | ||
| test_ss_domain_limits.py | ||
| test_ss_limits.py | ||
| test_ss_max_limits.py | ||
| test_ss_project_limits.py | ||
| test_stopped_vm.py | ||
| test_storage_motion.py | ||
| test_tags.py | ||
| test_template_from_snapshot_with_template_details | ||
| test_templates.py | ||
| test_update_vm.py | ||
| test_usage.py | ||
| test_vm_passwdenabled.py | ||
| test_vmware_drs.py | ||
| test_volumes.py | ||
| test_vpc.py | ||
| test_vpc_distributed_routing_offering.py | ||
| test_vpc_network.py | ||
| test_vpc_network_internal_lbrules.py | ||
| test_vpc_network_lbrules.py | ||
| test_vpc_network_pfrules.py | ||
| test_vpc_network_staticnatrule.py | ||
| test_vpc_offerings.py | ||
| test_vpc_routers.py | ||
| test_vpc_vm_life_cycle.py | ||
| test_vpc_vms_deployment.py | ||
| test_vpn_service.py | ||
| test_vpn_users.py | ||