Rajani Karuturi 13bfdd71e6 Merge pull request #1741 from swill/strongswanvpn ... Updated StrongSwan VPN ImplementationThis PR is a merge of @jayapalu changes in #872 and the changes I had to make to get the functionality working. I have done pretty extensive testing of this code so far and we are looking to be in pretty good shape. One thing to note is that a `Diffie-Hellman` group **is required** in order for this feature to work correctly. It is not highlighted in the tests below, but I have shown that the `PFS` is not required for this feature to work. In #872 I have shown a more exhaustive set of tests of this code, but I have limited this set of tests to a recommended `IKE` and `ESP` configuration in order to reduce the noise and test the other areas of functionality. **Test Results** I am testing this functionality by creating two VPCs with VMs in each and creating a S2S VPN connection between the two VPCs. Then I SSH into a VM in one VPC and I ping the private IP of a VM in the other VPC. Then I tear it down and try a different configuration. _Setup_ ``` VPC 1 VPC 2 ===== ===== VPN Gateway VPN Gateway VPN Customer Gateway VPN Customer Gateway VPN Connection <---> VPN Connection - Passive = True - Passive = False ``` _Legend_ `SKIP` => At least one of the VPN Connections did not come up, so no test was run. `OK` => The ping test was successful over the S2S VPN connection. `FAIL` => The ping test failed over the S2S VPN connection. `Passive` => Specifies if either the `<vpc_1> : <vpc_2>` sides of the VPN Connection is set to passive. `Conn State` => Specifies the connection status of the `<vpc_1> : <vpc_2>` VPN Connection in the UI. `Requires Reset` => If the ping test does not result in an `OK`, then a VPN Connection Reset is performed on either `<vpc_1> : <vpc_2>` sides of the VPN Connection based on which side is not showing `Connected`. The results in the `Status` column is the final result after the reset is performed. _Results_ ``` +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | Status | IKE & ESP | DPD | Encap | IKE Life | ESP Life | Passive | Conn State | Requires Reset | +========+======================+=======+=======+==========+==========+===============+=============================+================+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | True | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | | | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : False | Connected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : False | Connected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | True | False | 86400 | 3600 | True : False | Disconnected : Error | True : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | False | False | 86400 | 3600 | True : False | Disconnected : Error | True : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | FAIL | aes128-sha1 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | True : True | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | True | False | 86400 | 3600 | False : False | Connected : Error | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ ``` * pr/1741: complete implementation of the StrongSwan VPN feature Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>		2017-02-14 17:59:17 +05:30
..
bindir	Move the system vm to a separate maven project.	2013-09-20 18:31:02 +08:00
certs	Move the system vm to a separate maven project.	2013-09-20 18:31:02 +08:00
conf	CLOUDSTACK-9062: Improve S3 implementation.	2015-11-19 15:29:10 +01:00
conf.dom0	CLOUDSTACK-9105: Logging enhancement: Handle/reference to track API calls end to end in the MS logs	2015-12-04 12:45:57 +05:30
css	console-proxy add support of AltGr key and FR azerty keyboard	2014-12-08 18:05:43 +05:30
distro	CLOUDSTACK-6220: Take 2, Fix cloudstack init scripts so that they	2014-03-10 16:11:52 -06:00
images	Move the system vm to a separate maven project.	2013-09-20 18:31:02 +08:00
js	CLOUDSTACK-9164: Prevent firefox's quick search from opening in VM console	2016-04-25 11:37:43 +05:30
libexec	Move the system vm to a separate maven project.	2013-09-20 18:31:02 +08:00
patches/debian	Merge pull request #1741 from swill/strongswanvpn	2017-02-14 17:59:17 +05:30
scripts	Add Java Default Certificat Authorities into the keystore if using a custom cert SSL	2016-05-25 06:34:15 +01:00
test/python	Fixed defaultroute on VPC routers in CsRoute and CsAddress	2015-08-24 13:35:29 +02:00
ui	Move the system vm to a separate maven project.	2013-09-20 18:31:02 +08:00
vm-script	Move the system vm to a separate maven project.	2013-09-20 18:31:02 +08:00
pom.xml	Updating pom.xml version numbers for release 4.9.3.0-SNAPSHOT	2017-01-06 10:40:15 +05:30
systemvm-descriptor.xml	Remove duplicate scripts and move the remaining items to the systemvm project	2013-10-14 08:02:35 +02:00