From bf9b9790fa570e4af1409050f82bf1d5577f106f Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Sat, 20 Jun 2026 15:29:17 +0300 Subject: T8097: strongswan: update test with ESN By default now for each proposal two proposals are sent: with `-noesn` and without. Update test accordingly. --- smoketest/scripts/cli/test_vpn_ipsec.py | 68 +++++++++++++++++---------------- 1 file changed, 35 insertions(+), 33 deletions(-) (limited to 'smoketest/scripts/cli') diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py index 68aef845e..6b23839b2 100755 --- a/smoketest/scripts/cli/test_vpn_ipsec.py +++ b/smoketest/scripts/cli/test_vpn_ipsec.py @@ -252,8 +252,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'life_bytes = {life_bytes}', f'life_packets = {life_packets}', f'rekey_time = 28800s', # default value - f'proposals = aes128-sha1-modp1024', - f'esp_proposals = aes128-sha1-modp1024', + f'proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', + f'esp_proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', f'life_time = 3600s', # default value f'local_addrs = {local_address} # dhcp:no', f'remote_addrs = {peer_ip}', @@ -406,8 +406,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'life_bytes = {life_bytes}', f'life_packets = {life_packets}', f'rekey_time = 28800s', # default value - f'proposals = aes128-sha1-modp1024', - f'esp_proposals = aes128-sha1-modp1024', + f'proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', + f'esp_proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', f'life_time = 3600s', # default value f'local_addrs = {local_address} # dhcp:no', f'remote_addrs = {peer_ip}', @@ -482,8 +482,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): swanctl_conf_lines = [ 'version = 2', 'auth = psk', - 'proposals = aes128-sha1-modp1024,aes256-sha1-modp1536', - 'esp_proposals = aes128-sha1-modp2048,aes256-sha1-modp2048', + 'proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024,aes256-sha1-modp1536-noesn,aes256-sha1-modp1536', + 'esp_proposals = aes128-sha1-modp2048-noesn,aes128-sha1-modp2048,aes256-sha1-modp2048-noesn,aes256-sha1-modp2048', 'life_time = 3600s', 'mode = transport', # ensure transport mode is used f'{peer_name}-tunnel-{tunnel_id}', @@ -549,8 +549,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): swanctl_conf_lines = [ f'version = 2', f'auth = psk', - f'proposals = aes128-sha1-modp1024', - f'esp_proposals = aes128-sha1-modp1024', + f'proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', + f'esp_proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', f'local_addrs = {local_address} # dhcp:no', f'mobike = no', f'remote_addrs = {peer_ip}', @@ -625,8 +625,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): swanctl_conf_lines = [ f'version = 2', f'auth = psk', - f'proposals = aes128-sha1-modp1024', - f'esp_proposals = aes128-sha1-modp1024', + f'proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', + f'esp_proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', f'local_addrs = {local_address} # dhcp:no', f'mobike = no', f'remote_addrs = {peer_ip}', @@ -765,8 +765,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'version = 2', f'auth = psk', f'rekey_time = 86400s', - f'proposals = aes256gcm128-sha384-prfsha384-ecp384', - f'esp_proposals = aes256gcm128-sha384-ecp384', + f'proposals = aes256gcm128-sha384-prfsha384-ecp384-noesn,aes256gcm128-sha384-prfsha384-ecp384', + f'esp_proposals = aes256gcm128-sha384-ecp384-noesn,aes256gcm128-sha384-ecp384', f'life_time = 28800s', # default value f'local_addrs = {local_address} # dhcp:no', f'remote_addrs = {peer_ip}', @@ -869,22 +869,24 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): swanctl_conf = read_file(swanctl_file) swanctl_lines = [ - f'proposals = aes256-sha1-prfsha1-modp1024', + f'proposals = aes256-sha1-prfsha1-modp1024-noesn,aes256-sha1-prfsha1-modp1024', f'version = 1', f'rekey_time = {ike_lifetime}s', f'rekey_time = {esp_lifetime}s', - f'esp_proposals = aes256-sha1-modp1024,3des-md5-modp1024', + f'esp_proposals = aes256-sha1-modp1024-noesn,aes256-sha1-modp1024,3des-md5-modp1024-noesn,3des-md5-modp1024', f'local_ts = dynamic[gre]', f'remote_ts = dynamic[gre]', f'mode = transport', f'secret = {nhrp_secret}', 'unique = never', ] - for line in swanctl_lines: - self.assertIn(line, swanctl_conf) - - # There is only one NHRP test so no need to delete this globally in tearDown() - self.cli_delete(nhrp_path) + try: + for line in swanctl_lines: + self.assertIn(line, swanctl_conf) + finally: + # There is only one NHRP test so no need to delete this globally in tearDown() + # try/finally so that it is deleted even if test fails, otherwise we get errors + self.cli_delete(nhrp_path) def test_site_to_site_x509(self): # Enable PKI @@ -930,8 +932,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'id = "{peer_name}"', f'auth = pubkey', f'certs = {peer_name}.pem', - f'proposals = aes128-sha1-modp1024', - f'esp_proposals = aes128-sha1-modp1024', + f'proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', + f'esp_proposals = aes128-sha1-modp1024-noesn,aes128-sha1-modp1024', f'local_addrs = {local_address} # dhcp:no', f'remote_addrs = {peer_ip}', f'local_ts = 0.0.0.0/0,::/0', @@ -1186,7 +1188,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'{conn_name}', f'remote_addrs = %any', f'local_addrs = {local_address}', - f'proposals = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048', + f'proposals = aes256-sha512-modp2048-noesn,aes256-sha512-modp2048,aes256-sha256-modp2048-noesn,aes256-sha256-modp2048,aes256-sha256-modp1024-noesn,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048-noesn,aes128gcm128-sha256-modp2048', f'version = 2', f'send_certreq = no', f'rekey_time = {ike_lifetime}s', @@ -1197,7 +1199,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'certs = peer1.pem', f'auth = eap-mschapv2', f'eap_id = %any', - f'esp_proposals = aes256-sha512,aes256-sha384,aes256-sha256,aes256-sha1,aes128gcm128-sha256', + f'esp_proposals = aes256-sha512-noesn,aes256-sha512,aes256-sha384-noesn,aes256-sha384,aes256-sha256-noesn,aes256-sha256,aes256-sha1-noesn,aes256-sha1,aes128gcm128-sha256-noesn,aes128gcm128-sha256', f'life_time = {eap_lifetime}s', f'dpd_action = clear', f'replay_window = 32', @@ -1306,7 +1308,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'{conn_name}', f'remote_addrs = %any', f'local_addrs = {local_address}', - f'proposals = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048', + f'proposals = aes256-sha512-modp2048-noesn,aes256-sha512-modp2048,aes256-sha256-modp2048-noesn,aes256-sha256-modp2048,aes256-sha256-modp1024-noesn,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048-noesn,aes128gcm128-sha256-modp2048', f'version = 2', f'send_certreq = no', f'rekey_time = {ike_lifetime}s', @@ -1318,7 +1320,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'cacerts = MyVyOS-CA.pem', f'auth = eap-tls', f'eap_id = %any', - f'esp_proposals = aes256-sha512,aes256-sha384,aes256-sha256,aes256-sha1,aes128gcm128-sha256', + f'esp_proposals = aes256-sha512-noesn,aes256-sha512,aes256-sha384-noesn,aes256-sha384,aes256-sha256-noesn,aes256-sha256,aes256-sha1-noesn,aes256-sha1,aes128gcm128-sha256-noesn,aes128gcm128-sha256', f'life_time = {eap_lifetime}s', f'dpd_action = clear', f'inactivity = 28800', @@ -1422,7 +1424,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'{conn_name}', f'remote_addrs = %any', f'local_addrs = {local_address}', - f'proposals = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048', + f'proposals = aes256-sha512-modp2048-noesn,aes256-sha512-modp2048,aes256-sha256-modp2048-noesn,aes256-sha256-modp2048,aes256-sha256-modp1024-noesn,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048-noesn,aes128gcm128-sha256-modp2048', f'version = 2', f'send_certreq = no', f'rekey_time = {ike_lifetime}s', @@ -1432,7 +1434,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'auth = pubkey', f'certs = peer1.pem', f'cacerts = MyVyOS-CA.pem,MyVyOS-IntCA.pem', - f'esp_proposals = aes256-sha512,aes256-sha384,aes256-sha256,aes256-sha1,aes128gcm128-sha256', + f'esp_proposals = aes256-sha512-noesn,aes256-sha512,aes256-sha384-noesn,aes256-sha384,aes256-sha256-noesn,aes256-sha256,aes256-sha1-noesn,aes256-sha1,aes128gcm128-sha256-noesn,aes128gcm128-sha256', f'life_time = {eap_lifetime}s', f'dpd_action = clear', f'inactivity = 28800', @@ -1620,7 +1622,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'{conn_name}', f'remote_addrs = %any', f'local_addrs = {local_address}', - f'proposals = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048', + f'proposals = aes256-sha512-modp2048-noesn,aes256-sha512-modp2048,aes256-sha256-modp2048-noesn,aes256-sha256-modp2048,aes256-sha256-modp1024-noesn,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048-noesn,aes128gcm128-sha256-modp2048', f'version = 2', f'send_certreq = no', f'rekey_time = 0s', @@ -1630,7 +1632,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'auth = pubkey', f'certs = peer1.pem', f'cacerts = MyVyOS-CA.pem,MyVyOS-IntCA.pem', - f'esp_proposals = aes256-sha512,aes256-sha384,aes256-sha256,aes256-sha1,aes128gcm128-sha256', + f'esp_proposals = aes256-sha512-noesn,aes256-sha512,aes256-sha384-noesn,aes256-sha384,aes256-sha256-noesn,aes256-sha256,aes256-sha1-noesn,aes256-sha1,aes128gcm128-sha256-noesn,aes128gcm128-sha256', f'life_time = {eap_lifetime}s', f'rekey_time = 0s', f'dpd_action = clear', @@ -1733,7 +1735,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'{conn_name}', f'remote_addrs = %any', f'local_addrs = {local_address}', - f'proposals = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048', + f'proposals = aes256-sha512-modp2048-noesn,aes256-sha512-modp2048,aes256-sha256-modp2048-noesn,aes256-sha256-modp2048,aes256-sha256-modp1024-noesn,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048-noesn,aes128gcm128-sha256-modp2048', f'version = 2', f'send_certreq = no', f'rekey_time = {ike_lifetime}s', @@ -1744,7 +1746,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'certs = peer1.pem', f'auth = eap-mschapv2', f'eap_id = %any', - f'esp_proposals = aes256-sha512,aes256-sha384,aes256-sha256,aes256-sha1,aes128gcm128-sha256', + f'esp_proposals = aes256-sha512-noesn,aes256-sha512,aes256-sha384-noesn,aes256-sha384,aes256-sha256-noesn,aes256-sha256,aes256-sha1-noesn,aes256-sha1,aes128gcm128-sha256-noesn,aes128gcm128-sha256', f'life_time = {eap_lifetime}s', f'dpd_action = clear', f'replay_window = 32', @@ -1866,7 +1868,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'{conn_name}', f'remote_addrs = %any', f'local_addrs = {local_address}', - f'proposals = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048', + f'proposals = aes256-sha512-modp2048-noesn,aes256-sha512-modp2048,aes256-sha256-modp2048-noesn,aes256-sha256-modp2048,aes256-sha256-modp1024-noesn,aes256-sha256-modp1024,aes128gcm128-sha256-modp2048-noesn,aes128gcm128-sha256-modp2048', f'version = 2', f'send_certreq = no', f'rekey_time = {ike_lifetime}s', @@ -1877,7 +1879,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): f'certs = peer1.pem', f'auth = eap-mschapv2', f'eap_id = %any', - f'esp_proposals = aes256-sha512,aes256-sha384,aes256-sha256,aes256-sha1,aes128gcm128-sha256', + f'esp_proposals = aes256-sha512-noesn,aes256-sha512,aes256-sha384-noesn,aes256-sha384,aes256-sha256-noesn,aes256-sha256,aes256-sha1-noesn,aes256-sha1,aes128gcm128-sha256-noesn,aes128gcm128-sha256', f'life_time = {eap_lifetime}s', f'dpd_action = clear', f'replay_window = 32', -- cgit v1.2.3 From 11d5ee39fa41f512e343ef6084675a0f372c9e92 Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Sat, 20 Jun 2026 16:38:35 +0300 Subject: T8097: strongswan: add ESN test --- smoketest/scripts/cli/test_vpn_ipsec.py | 76 +++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) (limited to 'smoketest/scripts/cli') diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py index 6b23839b2..a73cd0b2b 100755 --- a/smoketest/scripts/cli/test_vpn_ipsec.py +++ b/smoketest/scripts/cli/test_vpn_ipsec.py @@ -1965,6 +1965,82 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): cli_value = default_value(base_path + ['options', 'retransmission', cli_option]) self.assertEqual(config_value, cli_value) + def test_esn_settings(self): + self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev2']) + self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'dh-group', '14']) + self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'encryption', 'aes256']) + self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'sha512']) + + local_address = '192.0.2.10' + + # vpn ipsec auth psk id + self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', local_id]) + self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', remote_id]) + self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', local_address]) + self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', peer_ip]) + self.cli_set(base_path + ['authentication', 'psk', connection_name, 'secret', secret]) + + # Site to site + peer_base_path = base_path + ['site-to-site', 'peer', connection_name] + + self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'encryption', 'aes256']) + self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'hash', 'sha512']) + + self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret']) + self.cli_set(peer_base_path + ['ike-group', ike_group]) + self.cli_set(peer_base_path + ['default-esp-group', esp_group]) + self.cli_set(peer_base_path + ['local-address', local_address]) + self.cli_set(peer_base_path + ['remote-address', peer_ip]) + self.cli_set(peer_base_path + ['tunnel', '1', 'protocol', 'tcp']) + self.cli_set(peer_base_path + ['tunnel', '1', 'local', 'prefix', '172.16.10.0/24']) + self.cli_set(peer_base_path + ['tunnel', '1', 'local', 'prefix', '172.16.11.0/24']) + self.cli_set(peer_base_path + ['tunnel', '1', 'local', 'port', '443']) + self.cli_set(peer_base_path + ['tunnel', '1', 'remote', 'prefix', '172.17.10.0/24']) + self.cli_set(peer_base_path + ['tunnel', '1', 'remote', 'prefix', '172.17.11.0/24']) + self.cli_set(peer_base_path + ['tunnel', '1', 'remote', 'port', '443']) + + self.cli_set(peer_base_path + ['tunnel', '2', 'local', 'prefix', '10.1.0.0/16']) + self.cli_set(peer_base_path + ['tunnel', '2', 'remote', 'prefix', '10.2.0.0/16']) + + # Passing the 'unique = never' for StrongSwan's `connections..unique` parameter + self.cli_set(base_path + ['disable-uniqreqids']) + + self.cli_commit() + + # esn - default, disabled + swanctl_conf = read_file(swanctl_file) + swanctl_conf_lines = [ + f'proposals = aes256-sha512-modp2048-noesn,aes256-sha512-modp2048', + f'esp_proposals = aes256-sha512-modp2048-noesn,aes256-sha512-modp2048', + ] + for line in swanctl_conf_lines: + self.assertIn(line, swanctl_conf) + + # esn - optional + self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'esn', 'optional']) + self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'esn', 'optional']) + self.cli_commit() + + swanctl_conf = read_file(swanctl_file) + swanctl_conf_lines = [ + f'proposals = aes256-sha512-modp2048-esn-noesn,aes256-sha512-modp2048', + f'esp_proposals = aes256-sha512-modp2048-esn-noesn,aes256-sha512-modp2048', + ] + for line in swanctl_conf_lines: + self.assertIn(line, swanctl_conf) + + # esn - required + self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'esn', 'required']) + self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'esn', 'required']) + self.cli_commit() + + swanctl_conf = read_file(swanctl_file) + swanctl_conf_lines = [ + f'proposals = aes256-sha512-modp2048-esn', + f'esp_proposals = aes256-sha512-modp2048-esn', + ] + for line in swanctl_conf_lines: + self.assertIn(line, swanctl_conf) if __name__ == '__main__': -- cgit v1.2.3