4bdc6b43a5
With this commit, we are removing the logic to refresh_mesh. There are
3 main reasons to do that;
1. Current refresh_mesh is completely on dataplain instances. This makes
it hard to develop the code iteratively, because we have to always think
about the migration of the scripts.
2. Current refresh_mesh destroys all the state and policy objects and
recreates them, this causes connection drop in the whole mesh. We don't
want that.
3. There is a huge code overlap with the refresh_keys logic. State
creation, policy creation/update. We can just reuse the code.
The logic is mainly depending on the synchronization of NicNexus and
SubnetNexus strands. They are 2 separate entities, there are many nic
objects in a private subnet and we have to make sure a tunnel's two end
get into the rekeying sequence together. If not, that tunnel wouldn't
work because of the nature of the ipsec tunnelling. More information
regarding that is provided in the commit 85420cc. Therefore, we
implement a pingpong logic in between subnet and nic nexus' to manage
when to create new state objects and update policies. That is managed
via semaphores.
There is a known errata here. Using strand labels directly here to
pick which entities to work on doesn't work well with "push" of
sub progs. In future, we can fix this by adding a fit to purpose
column to the nic entity. For now, this is good enough.
52 lines
1.3 KiB
Ruby
52 lines
1.3 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require_relative "spec_helper"
|
|
|
|
RSpec.describe IpsecTunnel do
|
|
subject(:ipsec_tunnel) {
|
|
described_class.new(
|
|
src_nic_id: src_nic.id,
|
|
dst_nic_id: dst_nic.id
|
|
)
|
|
}
|
|
|
|
let(:vm_host) { instance_double(VmHost, sshable: instance_double(Sshable)) }
|
|
let(:src_vm) {
|
|
instance_double(
|
|
Vm,
|
|
ephemeral_net6: NetAddr.parse_net("2a01:4f8:10a:128b:c0b4::/79"),
|
|
inhost_name: "vm12345",
|
|
vm_host: vm_host
|
|
)
|
|
}
|
|
let(:dst_vm) {
|
|
instance_double(
|
|
Vm,
|
|
ephemeral_net6: NetAddr.parse_net("2a01:4f8:10a:128b:bdc8::/79"),
|
|
inhost_name: "vm67890",
|
|
vm_host: vm_host
|
|
)
|
|
}
|
|
let(:src_nic) {
|
|
instance_double(Nic,
|
|
id: "0a9a166c-e7e7-4447-ab29-7ea442b5bb0e",
|
|
private_ipv6: "fd1b:9793:dcef:cd0a:264c::/79",
|
|
private_ipv4: "10.9.39.31/32",
|
|
vm: src_vm,
|
|
encryption_key: "12345678901234567890123456789012")
|
|
}
|
|
let(:dst_nic) {
|
|
instance_double(Nic,
|
|
id: "46ca6ded-b056-4723-bd91-612959f52f6f",
|
|
private_ipv6: "fd1b:9793:dcef:cd0a:72b6::/79",
|
|
private_ipv4: "10.9.39.9/32",
|
|
vm: dst_vm,
|
|
encryption_key: "12345678901234567890123456789012")
|
|
}
|
|
|
|
it "returns vm_name properly" do
|
|
expect(ipsec_tunnel.vm_name(src_nic)).to eq("vm12345")
|
|
expect(ipsec_tunnel.vm_name(dst_nic)).to eq("vm67890")
|
|
end
|
|
end
|