Difference between revisions of "IKEv2 Interop testing with OpenBSD"

From Libreswan
Jump to navigation Jump to search
(Some changes)
 
(One intermediate revision by one other user not shown)
Line 1: Line 1:
== Introduction ==
+
= Introduction =
  
IPSec standards are produced and maintained by [https://ietf.org/ IEFT] which are implemented by many software including Libreswan. IKED is one such native implementation of [https://tools.ietf.org/html/rfc7296 IKEv2] on OpenBSD. My project’s purpose is to enable Interop tests where one end is Libreswan on Linux and the other is the native IKE daemon on OpenBSD. This helps us test Linux kernel to BSD kernel and understand several issues with Linux when inter-operating with *nix like Operating Systems.
+
IPSec standards are produced and maintained by [https://ietf.org/ Internet Engineering Task Force] which are implemented by many software including Libreswan. [https://www.openiked.org/ OpenIKED] is one such native implementation of [https://tools.ietf.org/html/rfc7296 IKEv2] on OpenBSD. My project’s purpose is to enable Interop tests where one end is Libreswan on Linux and the other is the native IKE daemon on OpenBSD. This helps us test Linux kernel to BSD kernel and understand several issues with Linux when inter-operating with with Non-Linux Operating Systems.
  
== Implementation ==
+
= Implementation =
*Perform a Non-interactive OpenBSD Base installation
+
The libreswan [[  Test_Suite_-_KVM ]] libvirt/qemu testing system auto-installs Linux and then compiles libreswan on these virtual machines. It then fires up these machines for individual tests and verifies the expected results with reference output. The test suite also supports strongswan on Linux. To add OpenBSD to this, the following tasts we completed:
OpenBSD’s autoinstall allows unattended installation by automatically responding to installer questions with answers through a response file([https://man.openbsd.org/autoinstall.8 auto_install.conf]). But this introduces additional complexities into the testing system. To solve this, I have written a pexpect script using python which adds install.conf
 
(which consists of answers to default questions) into the OpenBSD iso and perform’s the installation by taking the values from that file.
 
  
*Mounting the testing directory over NFS:
+
== Perform a Non-interactive OpenBSD Base installation ==
  
The Libreswan’s testing system uses a 9P File System with Libvirt/Qemu to mount the testing directory. As 9P support is constrained in OpenBSD, I had to fall back to use the NFS mount. This required changes in the Libreswan testing infrastructure to provide support for NFS server.
+
OpenBSD’s autoinstall only allows unattended installation by automatically responding to installer questions with answers through a response file ([https://man.openbsd.org/autoinstall.8 auto_install.conf]). But this installation system is not fully working to complete the entire install non-interactively. To solve this, a pexpect script using python was written which adds install.conf to the OpenBSD installer image by modifying the ISO image directly.
  
*Cloning them as openbsde (OpenBSD East) and openbsdw (OpenBSD West) domains
+
== Mounting the testing directory over NFS ==
  
Initially, we create a base image called OpenBSD-base and then clone it as OpenBSD East(openbsde) and OpenBSD(openbsdw).
+
The Libreswan’s testing system uses a 9P File System with Libvirt/Qemu to mount the testing directory. Unfortunately, OpenBSD's 9P filesystem was incompatibility with Linux and failed to work. It was therefor decided to use NFS instead. This has a disadvantage that if the openBSD's IPsec is not working properly, it could make the NFS mounts unreachable to the host, and log files would be lost and the /testing directory would fail to work during part of the test and cause the test case to fail.
  
*Adding additional tests
+
Using NFS for OpenBSD means that the Linux host operating system that launches all the testing virtual machines also needed to be configured as an NFS server.
  
Writing of additional tests to perform interoperability tests between Libreswan on one end and OpenBSD’s IKED daemon on the other end.
+
== Cloning the base install image ==
  
== Issues encountered ==
+
To provide support for OpenBSD being a responder (like the linux "east" machine) and being an initiator (like the linux "west" machine), after the initial openbsd install, the base image is clone into "openbsde" (OpenBSD East) and "openbsdw" (OpenBSD West) virtual machines. There was some unexpected behaviour when the openbsd machines used the "east" or "west" names in the individual tests, which is why the alternative names are used. This also needed some support in the base testing setup because until now, every test always had the machine "east" booted first. Now this can be either "east" (linux) or openbsde (openbsd).
*OpenBSD’s documentation is very incomprehensible on how to automatically perform the non-interactive installation.
 
  
*To mount the 9P File system on OpenBSD, we need to install a port called Plan9port which doesn't work with Qemu. This is because Qemu's 9p is not the same as Plan9port. Plan 9's 9p is 9p2000 which transports a subset of plan 9 system calls over the network while Qemu's 9p is 9p2000.L transports a subset of Linux system calls over the network. It took me a week to get this minute difference.
+
== Adding OpenBSD specific tests ==
  
*When the NFS server was up and running, I was not able to figure out why the NFS mount wasn’t working with OpenBSD. After a thorough analysis of Network packets using TCP Dump, I was able to infer that Fedora’s Firewall was blocking the Packets. I disabled the firewall to make the NFS mount work as intended. This was challenging as it was difficult to figure out whether the issue was with OpenBSD or Linux.
+
Iniitally, two tests were created (interop-ikev2-openbbsd-01 and 02) that perform a basic standard IKEv2 PSK based connection. One test has openbsd initiating and one test has openbsd responding.  
  
== Possible Future Work ==
+
= Issues encountered =
  
*Including additional tests to the testing system which involve shared certificate and more complex operations.
+
OpenBSD’s documentation is very scarce and incomplete. This caused a lot of problems at the start of the project.
*Porting Libreswan to OpenBSD
 
*Performing Interop tests between Libreswan on OpenBSD with Libreswan on Linux.
 
*Adding a dedicated test network subnet to the test networks to exclusively serve NFS mount for OpenBSD systems (suggested).
 
  
== Source code ==
+
The 9P filesystems of Linux and OpenBSD turned out to be incompatible and could not be made to work together. To mount the 9P File system on OpenBSD, the Plan9port port package needs to be installed but this one does not work with the 9P filesystem of Qemu. This is because Qemu's 9p is not the same as Plan9port. Plan 9's 9p is 9p2000 which transports a subset of plan 9 system calls over the network while Qemu's 9p is 9p2000.L and transports a subset of Linux system calls over the network. Significant time was spend in attempting to make this work before falling back to using NFS.
Code Status: Development completed (yet to fix some minor issues) and to be released in the upcoming version.
 
  
Commits:
+
When the NFS server was up and running, the NFS mount were not working initially on OpenBSD. After analysis of logs and network traces using tcpdump, it became clear that Fedora’s firewall was blocking the packets. Disabling the firewall made the NFS mount work as intended. This was challenging as it was difficult to figure out whether the issue was with OpenBSD or Linux - especially due to the lack of documentation and lack of user experiences for OpenBSD. It seems most OpenBSD users work only with OpenBSD machines, resulting in hardly any information or documentation on interoperability with Linux.
  
Add required OpenBSD files to the test system - [https://github.com/RaviTejaCMS/libreswan/commit/fc146e39a53c1090c724d7361b9374d632822d65 https://github.com/RaviTejaCMS/libreswan/commit/fc146e39a53c1090c724d7361b9374d632822d65]
+
= Possible Future Work =
  
OpenBSD installation using Make - [https://github.com/RaviTejaCMS/libreswan/commit/a7c39f2249915ba53e4f3d1e6ffa73821d3e3bb6 https://github.com/RaviTejaCMS/libreswan/commit/a7c39f2249915ba53e4f3d1e6ffa73821d3e3bb6]
+
Additionals tests that cover a lot more features of the OpenBSD IKE daemon should be added. X.509 certificates, ECDSA, IKE fragmentation are examples of test cases that still need to be written.
  
Interop Tests -
+
See if FreeBSD can be added similarly to how OpenBSD has been added.
[https://github.com/RaviTejaCMS/libreswan/commit/144636ab92a16a1aefecd3fdf9df3f8bd032eecf https://github.com/RaviTejaCMS/libreswan/commit/144636ab92a16a1aefecd3fdf9df3f8bd032eecf]
+
 
 +
A separate project would be to port libreswan to OpenBSD natively and then test interop of libreswan on Linux with libreswan on openbsd. While libreswan was recently re-ported to NetBSD, it has not yet been re-ported to OpenBSD of FreeBSD.
 +
 
 +
= Source code =
 +
 
 +
The Source code for this project is merged into the main branch of [https://github.com/libreswan/libreswan Libreswan Repository] and will be released with libreswan version 4.0. The commits associated with this project are :
 +
 
 +
* [https://github.com/libreswan/libreswan/commit/c8f24944ff34f023623fe6b3f1a313107827030e testing: Add OpenBSD support to the KVM testing infrastructure]
 +
* [https://github.com/libreswan/libreswan/commit/5fad89ba87447bcdc27fbe432fbc37a5be2ce636 testing: added first Openbsd interop test interop-ikev2-openbsd-01]
 +
* [https://github.com/libreswan/libreswan/commit/90509ff3c0226700d58fbdd0e01ce91a84356f2e testing: added interop-ikev2-openbsd-01 to TESTLIST]
  
 
This project work was sponsored by Google as part of the [https://summerofcode.withgoogle.com/ Google Summer of Code] 2020 Program. The implementation for this project is done by [https://github.com/RaviTejaCMS Ravi Teja](hello@rtcms.dev) under the guidance of Paul Wouters, Tuomo Soini, and Andrew Cagney.
 
This project work was sponsored by Google as part of the [https://summerofcode.withgoogle.com/ Google Summer of Code] 2020 Program. The implementation for this project is done by [https://github.com/RaviTejaCMS Ravi Teja](hello@rtcms.dev) under the guidance of Paul Wouters, Tuomo Soini, and Andrew Cagney.
  
== License ==
+
= License =
  
 
This project is Licensed under [https://github.com/libreswan/libreswan/blob/master/LICENSE GNU General Public License v2.0].
 
This project is Licensed under [https://github.com/libreswan/libreswan/blob/master/LICENSE GNU General Public License v2.0].

Latest revision as of 04:58, 31 August 2020

Introduction

IPSec standards are produced and maintained by Internet Engineering Task Force which are implemented by many software including Libreswan. OpenIKED is one such native implementation of IKEv2 on OpenBSD. My project’s purpose is to enable Interop tests where one end is Libreswan on Linux and the other is the native IKE daemon on OpenBSD. This helps us test Linux kernel to BSD kernel and understand several issues with Linux when inter-operating with with Non-Linux Operating Systems.

Implementation

The libreswan Test_Suite_-_KVM libvirt/qemu testing system auto-installs Linux and then compiles libreswan on these virtual machines. It then fires up these machines for individual tests and verifies the expected results with reference output. The test suite also supports strongswan on Linux. To add OpenBSD to this, the following tasts we completed:

Perform a Non-interactive OpenBSD Base installation

OpenBSD’s autoinstall only allows unattended installation by automatically responding to installer questions with answers through a response file (auto_install.conf). But this installation system is not fully working to complete the entire install non-interactively. To solve this, a pexpect script using python was written which adds install.conf to the OpenBSD installer image by modifying the ISO image directly.

Mounting the testing directory over NFS

The Libreswan’s testing system uses a 9P File System with Libvirt/Qemu to mount the testing directory. Unfortunately, OpenBSD's 9P filesystem was incompatibility with Linux and failed to work. It was therefor decided to use NFS instead. This has a disadvantage that if the openBSD's IPsec is not working properly, it could make the NFS mounts unreachable to the host, and log files would be lost and the /testing directory would fail to work during part of the test and cause the test case to fail.

Using NFS for OpenBSD means that the Linux host operating system that launches all the testing virtual machines also needed to be configured as an NFS server.

Cloning the base install image

To provide support for OpenBSD being a responder (like the linux "east" machine) and being an initiator (like the linux "west" machine), after the initial openbsd install, the base image is clone into "openbsde" (OpenBSD East) and "openbsdw" (OpenBSD West) virtual machines. There was some unexpected behaviour when the openbsd machines used the "east" or "west" names in the individual tests, which is why the alternative names are used. This also needed some support in the base testing setup because until now, every test always had the machine "east" booted first. Now this can be either "east" (linux) or openbsde (openbsd).

Adding OpenBSD specific tests

Iniitally, two tests were created (interop-ikev2-openbbsd-01 and 02) that perform a basic standard IKEv2 PSK based connection. One test has openbsd initiating and one test has openbsd responding.

Issues encountered

OpenBSD’s documentation is very scarce and incomplete. This caused a lot of problems at the start of the project.

The 9P filesystems of Linux and OpenBSD turned out to be incompatible and could not be made to work together. To mount the 9P File system on OpenBSD, the Plan9port port package needs to be installed but this one does not work with the 9P filesystem of Qemu. This is because Qemu's 9p is not the same as Plan9port. Plan 9's 9p is 9p2000 which transports a subset of plan 9 system calls over the network while Qemu's 9p is 9p2000.L and transports a subset of Linux system calls over the network. Significant time was spend in attempting to make this work before falling back to using NFS.

When the NFS server was up and running, the NFS mount were not working initially on OpenBSD. After analysis of logs and network traces using tcpdump, it became clear that Fedora’s firewall was blocking the packets. Disabling the firewall made the NFS mount work as intended. This was challenging as it was difficult to figure out whether the issue was with OpenBSD or Linux - especially due to the lack of documentation and lack of user experiences for OpenBSD. It seems most OpenBSD users work only with OpenBSD machines, resulting in hardly any information or documentation on interoperability with Linux.

Possible Future Work

Additionals tests that cover a lot more features of the OpenBSD IKE daemon should be added. X.509 certificates, ECDSA, IKE fragmentation are examples of test cases that still need to be written.

See if FreeBSD can be added similarly to how OpenBSD has been added.

A separate project would be to port libreswan to OpenBSD natively and then test interop of libreswan on Linux with libreswan on openbsd. While libreswan was recently re-ported to NetBSD, it has not yet been re-ported to OpenBSD of FreeBSD.

Source code

The Source code for this project is merged into the main branch of Libreswan Repository and will be released with libreswan version 4.0. The commits associated with this project are :

This project work was sponsored by Google as part of the Google Summer of Code 2020 Program. The implementation for this project is done by Ravi Teja(hello@rtcms.dev) under the guidance of Paul Wouters, Tuomo Soini, and Andrew Cagney.

License

This project is Licensed under GNU General Public License v2.0.