From 4edc0611ec0ab39147c136d769a9e8a0f50847e6 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Fri, 2 Feb 2024 20:44:29 +0100 Subject: ipsec: T5998: add replay-windows setting The replay_window for child SA will always be 32 (hence enabled). Add a CLI node to explicitly change this. * set vpn ipsec site-to-site peer replay-window <0-2040> (cherry picked from commit 4d943d8fbf1253154897179b0e3ea2d93b898197) --- data/templates/ipsec/swanctl/peer.j2 | 6 ++++++ data/templates/ipsec/swanctl/remote_access.j2 | 3 +++ .../include/ipsec/replay-window.xml.i | 19 ++++++++++++++++++ interface-definitions/vpn_ipsec.xml.in | 2 ++ smoketest/scripts/cli/test_vpn_ipsec.py | 23 ++++++++++++---------- 5 files changed, 43 insertions(+), 10 deletions(-) create mode 100644 interface-definitions/include/ipsec/replay-window.xml.i diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2 index c5841fb91..58f0199fa 100644 --- a/data/templates/ipsec/swanctl/peer.j2 +++ b/data/templates/ipsec/swanctl/peer.j2 @@ -86,6 +86,9 @@ dpd_action = {{ ike.dead_peer_detection.action }} {% endif %} close_action = {{ ike.close_action }} +{% if peer_conf.replay_window is vyos_defined %} + replay_window = {{ peer_conf.replay_window }} +{% endif %} } {% elif peer_conf.tunnel is vyos_defined %} {% for tunnel_id, tunnel_conf in peer_conf.tunnel.items() if tunnel_conf.disable is not defined %} @@ -136,6 +139,9 @@ dpd_action = {{ ike.dead_peer_detection.action }} {% endif %} close_action = {{ ike.close_action }} +{% if peer_conf.replay_window is vyos_defined %} + replay_window = {{ peer_conf.replay_window }} +{% endif %} {% if peer_conf.vti.bind is vyos_defined %} {# The key defaults to 0 and will match any policies which similarly do not have a lookup key configuration. #} {# Thus we simply shift the key by one to also support a vti0 interface #} diff --git a/data/templates/ipsec/swanctl/remote_access.j2 b/data/templates/ipsec/swanctl/remote_access.j2 index 01dc8a4a7..bce8684fe 100644 --- a/data/templates/ipsec/swanctl/remote_access.j2 +++ b/data/templates/ipsec/swanctl/remote_access.j2 @@ -43,6 +43,9 @@ rand_time = 540s dpd_action = clear inactivity = {{ rw_conf.timeout }} +{% if rw_conf.replay_window is vyos_defined %} + replay_window = {{ rw_conf.replay_window }} +{% endif %} {% set local_prefix = rw_conf.local.prefix if rw_conf.local.prefix is vyos_defined else ['0.0.0.0/0', '::/0'] %} {% set local_port = rw_conf.local.port if rw_conf.local.port is vyos_defined else '' %} {% set local_suffix = '[%any/{1}]'.format(local_port) if local_port else '' %} diff --git a/interface-definitions/include/ipsec/replay-window.xml.i b/interface-definitions/include/ipsec/replay-window.xml.i new file mode 100644 index 000000000..f35ed550a --- /dev/null +++ b/interface-definitions/include/ipsec/replay-window.xml.i @@ -0,0 +1,19 @@ + + + + IPsec replay window to configure for this CHILD_SA + + u32:0 + Disable IPsec replay protection + + + u32:1-2040 + Replay window size in packets + + + + + + 32 + + diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in index 9d1d5d824..44ca1c7a0 100644 --- a/interface-definitions/vpn_ipsec.xml.in +++ b/interface-definitions/vpn_ipsec.xml.in @@ -826,6 +826,7 @@ #include #include #include + #include Timeout to close connection if no data is transmitted @@ -1100,6 +1101,7 @@ #include #include + #include Peer tunnel diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py index f5369ee7a..09e10a2c4 100755 --- a/smoketest/scripts/cli/test_vpn_ipsec.py +++ b/smoketest/scripts/cli/test_vpn_ipsec.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 # -# Copyright (C) 2021-2023 VyOS maintainers and contributors +# Copyright (C) 2021-2024 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as @@ -155,7 +155,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): def tearDownPKI(self): self.cli_delete(['pki']) - def test_01_dhcp_fail_handling(self): + def test_dhcp_fail_handling(self): # Skip process check - connection is not created for this test self.skip_process_check = True @@ -185,7 +185,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.cli_delete(ethernet_path + [interface, 'vif', vif, 'address']) - def test_02_site_to_site(self): + def test_site_to_site(self): self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev2']) local_address = '192.0.2.10' @@ -248,6 +248,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'remote_ts = 10.2.0.0/16', f'priority = {priority}', f'mode = tunnel', + f'replay_window = 32', ] for line in swanctl_conf_lines: self.assertIn(line, swanctl_conf) @@ -263,7 +264,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.assertRegex(swanctl_conf, fr'{line}') - def test_03_site_to_site_vti(self): + def test_site_to_site_vti(self): local_address = '192.0.2.10' vti = 'vti10' # IKE @@ -317,6 +318,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'remote_ts = 172.17.10.0/24,172.17.11.0/24', f'ipcomp = yes', f'start_action = none', + f'replay_window = 32', f'if_id_in = {if_id}', # will be 11 for vti10 - shifted by one f'if_id_out = {if_id}', f'updown = "/etc/ipsec.d/vti-up-down {vti}"' @@ -333,7 +335,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.assertRegex(swanctl_conf, fr'{line}') - def test_04_dmvpn(self): + def test_dmvpn(self): tunnel_if = 'tun100' nhrp_secret = 'secret' ike_lifetime = '3600' @@ -396,7 +398,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): # There is only one NHRP test so no need to delete this globally in tearDown() self.cli_delete(nhrp_path) - def test_05_x509_site2site(self): + def test_site_to_site_x509(self): # Enable PKI self.setupPKI() @@ -474,7 +476,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.tearDownPKI() - def test_06_flex_vpn_vips(self): + def test_flex_vpn_vips(self): local_address = '192.0.2.5' local_id = 'vyos-r1' remote_id = 'vyos-r2' @@ -549,7 +551,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.assertIn(line, charon_conf) - def test_07_ikev2_road_warrior(self): + def test_remote_access(self): # This is a known to be good configuration for Microsoft Windows 10 and Apple iOS 17 self.setupPKI() @@ -640,6 +642,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'rekey_time = {eap_lifetime}s', f'rand_time = 540s', f'dpd_action = clear', + f'replay_window = 32', f'inactivity = 28800', f'local_ts = 0.0.0.0/0,::/0', ] @@ -668,7 +671,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.tearDownPKI() - def test_08_ikev2_road_warrior_client_auth_eap_tls(self): + def test_remote_access_eap_tls(self): # This is a known to be good configuration for Microsoft Windows 10 and Apple iOS 17 self.setupPKI() @@ -780,7 +783,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.tearDownPKI() - def test_09_ikev2_road_warrior_client_auth_x509(self): + def test_remote_access_x509(self): # This is a known to be good configuration for Microsoft Windows 10 and Apple iOS 17 self.setupPKI() -- cgit v1.2.3