t_ipsec_natt.sh revision 1.2.2.2
1 1.2.2.2 pgoyette # $NetBSD: t_ipsec_natt.sh,v 1.2.2.2 2018/12/26 14:02:10 pgoyette Exp $ 2 1.2.2.2 pgoyette # 3 1.2.2.2 pgoyette # Copyright (c) 2018 Internet Initiative Japan Inc. 4 1.2.2.2 pgoyette # All rights reserved. 5 1.2.2.2 pgoyette # 6 1.2.2.2 pgoyette # Redistribution and use in source and binary forms, with or without 7 1.2.2.2 pgoyette # modification, are permitted provided that the following conditions 8 1.2.2.2 pgoyette # are met: 9 1.2.2.2 pgoyette # 1. Redistributions of source code must retain the above copyright 10 1.2.2.2 pgoyette # notice, this list of conditions and the following disclaimer. 11 1.2.2.2 pgoyette # 2. Redistributions in binary form must reproduce the above copyright 12 1.2.2.2 pgoyette # notice, this list of conditions and the following disclaimer in the 13 1.2.2.2 pgoyette # documentation and/or other materials provided with the distribution. 14 1.2.2.2 pgoyette # 15 1.2.2.2 pgoyette # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 16 1.2.2.2 pgoyette # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 17 1.2.2.2 pgoyette # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 18 1.2.2.2 pgoyette # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 19 1.2.2.2 pgoyette # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 1.2.2.2 pgoyette # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 1.2.2.2 pgoyette # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 1.2.2.2 pgoyette # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 1.2.2.2 pgoyette # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 1.2.2.2 pgoyette # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 1.2.2.2 pgoyette # POSSIBILITY OF SUCH DAMAGE. 26 1.2.2.2 pgoyette # 27 1.2.2.2 pgoyette 28 1.2.2.2 pgoyette SOCK_LOCAL=unix://ipsec_natt_local 29 1.2.2.2 pgoyette SOCK_NAT=unix://ipsec_natt_nat 30 1.2.2.2 pgoyette SOCK_REMOTE=unix://ipsec_natt_remote 31 1.2.2.2 pgoyette BUS_LOCAL=./bus_ipsec_natt_local 32 1.2.2.2 pgoyette BUS_NAT=./bus_ipsec_natt_nat 33 1.2.2.2 pgoyette 34 1.2.2.2 pgoyette DEBUG=${DEBUG:-false} 35 1.2.2.2 pgoyette HIJACKING_NPF="${HIJACKING},blanket=/dev/npf" 36 1.2.2.2 pgoyette 37 1.2.2.2 pgoyette setup_servers() 38 1.2.2.2 pgoyette { 39 1.2.2.2 pgoyette 40 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_LOCAL netipsec ipsec 41 1.2.2.2 pgoyette rump_server_npf_start $SOCK_NAT 42 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_REMOTE netipsec ipsec 43 1.2.2.2 pgoyette rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL 44 1.2.2.2 pgoyette rump_server_add_iface $SOCK_NAT shmif0 $BUS_LOCAL 45 1.2.2.2 pgoyette rump_server_add_iface $SOCK_NAT shmif1 $BUS_NAT 46 1.2.2.2 pgoyette rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_NAT 47 1.2.2.2 pgoyette } 48 1.2.2.2 pgoyette 49 1.2.2.2 pgoyette setup_ipsecif() 50 1.2.2.2 pgoyette { 51 1.2.2.2 pgoyette local sock=$1 52 1.2.2.2 pgoyette local ifid=$2 53 1.2.2.2 pgoyette local src_ip=$3 54 1.2.2.2 pgoyette local src_port=$4 55 1.2.2.2 pgoyette local dst_ip=$5 56 1.2.2.2 pgoyette local dst_port=$6 57 1.2.2.2 pgoyette local ipsecif_ip=$7 58 1.2.2.2 pgoyette local peer_ip=$8 59 1.2.2.2 pgoyette 60 1.2.2.2 pgoyette export RUMP_SERVER=$sock 61 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig ipsec$ifid create 62 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig ipsec$ifid link0 # enable NAT-T 63 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig ipsec$ifid tunnel ${src_ip},${src_port} ${dst_ip},${dst_port} 64 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig ipsec$ifid ${ipsecif_ip}/32 65 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore \ 66 1.2.2.2 pgoyette rump.route -n add ${peer_ip}/32 $ipsecif_ip 67 1.2.2.2 pgoyette } 68 1.2.2.2 pgoyette 69 1.2.2.2 pgoyette add_sa() 70 1.2.2.2 pgoyette { 71 1.2.2.2 pgoyette local sock=$1 72 1.2.2.2 pgoyette local proto=$2 73 1.2.2.2 pgoyette local algo_args="$3" 74 1.2.2.2 pgoyette local src_ip=$4 75 1.2.2.2 pgoyette local src_port=$5 76 1.2.2.2 pgoyette local dst_ip=$6 77 1.2.2.2 pgoyette local dst_port=$7 78 1.2.2.2 pgoyette local out_spi=$8 79 1.2.2.2 pgoyette local in_spi=$9 80 1.2.2.2 pgoyette local tmpfile=./tmp 81 1.2.2.2 pgoyette 82 1.2.2.2 pgoyette export RUMP_SERVER=$sock 83 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 84 1.2.2.2 pgoyette add $src_ip [$src_port] $dst_ip [$dst_port] $proto $out_spi -m transport $algo_args; 85 1.2.2.2 pgoyette add $dst_ip [$dst_port] $src_ip [$src_port] $proto $in_spi -m transport $algo_args; 86 1.2.2.2 pgoyette EOF 87 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 88 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 89 1.2.2.2 pgoyette # XXX it can be expired if $lifetime is very short 90 1.2.2.2 pgoyette #check_sa_entries $SOCK_LOCAL $ip_local $ip_remote 91 1.2.2.2 pgoyette } 92 1.2.2.2 pgoyette 93 1.2.2.2 pgoyette prepare_file() 94 1.2.2.2 pgoyette { 95 1.2.2.2 pgoyette local file=$1 96 1.2.2.2 pgoyette local data="0123456789" 97 1.2.2.2 pgoyette 98 1.2.2.2 pgoyette touch $file 99 1.2.2.2 pgoyette for i in `seq 1 512` 100 1.2.2.2 pgoyette do 101 1.2.2.2 pgoyette echo $data >> $file 102 1.2.2.2 pgoyette done 103 1.2.2.2 pgoyette } 104 1.2.2.2 pgoyette 105 1.2.2.2 pgoyette build_npf_conf() 106 1.2.2.2 pgoyette { 107 1.2.2.2 pgoyette local outfile=$1 108 1.2.2.2 pgoyette local localnet=$2 109 1.2.2.2 pgoyette 110 1.2.2.2 pgoyette cat > $outfile <<-EOF 111 1.2.2.2 pgoyette set bpf.jit off 112 1.2.2.2 pgoyette \$int_if = inet4(shmif0) 113 1.2.2.2 pgoyette \$ext_if = inet4(shmif1) 114 1.2.2.2 pgoyette \$localnet = { $localnet } 115 1.2.2.2 pgoyette map \$ext_if dynamic \$localnet -> \$ext_if 116 1.2.2.2 pgoyette group "external" on \$ext_if { 117 1.2.2.2 pgoyette pass stateful out final all 118 1.2.2.2 pgoyette } 119 1.2.2.2 pgoyette group "internal" on \$int_if { 120 1.2.2.2 pgoyette block in all 121 1.2.2.2 pgoyette pass in final from \$localnet 122 1.2.2.2 pgoyette pass out final all 123 1.2.2.2 pgoyette } 124 1.2.2.2 pgoyette group default { 125 1.2.2.2 pgoyette pass final on lo0 all 126 1.2.2.2 pgoyette block all 127 1.2.2.2 pgoyette } 128 1.2.2.2 pgoyette EOF 129 1.2.2.2 pgoyette } 130 1.2.2.2 pgoyette 131 1.2.2.2 pgoyette PIDSFILE=./terminator.pids 132 1.2.2.2 pgoyette start_natt_terminator() 133 1.2.2.2 pgoyette { 134 1.2.2.2 pgoyette local sock=$1 135 1.2.2.2 pgoyette local ip=$2 136 1.2.2.2 pgoyette local port=$3 137 1.2.2.2 pgoyette local pidsfile=$4 138 1.2.2.2 pgoyette local backup=$RUMP_SERVER 139 1.2.2.2 pgoyette local pid= 140 1.2.2.2 pgoyette local terminator="$(atf_get_srcdir)/../ipsec/natt_terminator" 141 1.2.2.2 pgoyette 142 1.2.2.2 pgoyette export RUMP_SERVER=$sock 143 1.2.2.2 pgoyette 144 1.2.2.2 pgoyette env LD_PRELOAD=/usr/lib/librumphijack.so \ 145 1.2.2.2 pgoyette $terminator $ip $port & 146 1.2.2.2 pgoyette pid=$! 147 1.2.2.2 pgoyette if [ ! -f $PIDSFILE ]; then 148 1.2.2.2 pgoyette touch $PIDSFILE 149 1.2.2.2 pgoyette fi 150 1.2.2.2 pgoyette echo $pid >> $PIDSFILE 151 1.2.2.2 pgoyette 152 1.2.2.2 pgoyette $DEBUG && rump.netstat -a -f inet 153 1.2.2.2 pgoyette 154 1.2.2.2 pgoyette export RUMP_SERVER=$backup 155 1.2.2.2 pgoyette 156 1.2.2.2 pgoyette sleep 1 157 1.2.2.2 pgoyette } 158 1.2.2.2 pgoyette 159 1.2.2.2 pgoyette stop_natt_terminators() 160 1.2.2.2 pgoyette { 161 1.2.2.2 pgoyette local pid= 162 1.2.2.2 pgoyette 163 1.2.2.2 pgoyette if [ ! -f $PIDSFILE ]; then 164 1.2.2.2 pgoyette return 165 1.2.2.2 pgoyette fi 166 1.2.2.2 pgoyette 167 1.2.2.2 pgoyette for pid in $(cat $PIDSFILE); do 168 1.2.2.2 pgoyette kill -9 $pid 169 1.2.2.2 pgoyette done 170 1.2.2.2 pgoyette rm -f $PIDSFILE 171 1.2.2.2 pgoyette } 172 1.2.2.2 pgoyette 173 1.2.2.2 pgoyette check_ping_packets() 174 1.2.2.2 pgoyette { 175 1.2.2.2 pgoyette local sock=$1 176 1.2.2.2 pgoyette local bus=$2 177 1.2.2.2 pgoyette local from_ip=$3 178 1.2.2.2 pgoyette local to_ip=$4 179 1.2.2.2 pgoyette 180 1.2.2.2 pgoyette local outfile=./out.ping 181 1.2.2.2 pgoyette 182 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 183 1.2.2.2 pgoyette 184 1.2.2.2 pgoyette export RUMP_SERVER=$sock 185 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $to_ip 186 1.2.2.2 pgoyette 187 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 188 1.2.2.2 pgoyette $DEBUG && cat $outfile 189 1.2.2.2 pgoyette atf_check -s exit:0 \ 190 1.2.2.2 pgoyette -o match:"$from_ip > $to_ip: ICMP echo request" \ 191 1.2.2.2 pgoyette cat $outfile 192 1.2.2.2 pgoyette atf_check -s exit:0 \ 193 1.2.2.2 pgoyette -o match:"$to_ip > $from_ip: ICMP echo reply" \ 194 1.2.2.2 pgoyette cat $outfile 195 1.2.2.2 pgoyette } 196 1.2.2.2 pgoyette 197 1.2.2.2 pgoyette check_ping_packets_over_ipsecif() 198 1.2.2.2 pgoyette { 199 1.2.2.2 pgoyette local sock=$1 200 1.2.2.2 pgoyette local bus=$2 201 1.2.2.2 pgoyette local to_ip=$3 202 1.2.2.2 pgoyette local nat_from_ip=$4 203 1.2.2.2 pgoyette local nat_from_port=$5 204 1.2.2.2 pgoyette local nat_to_ip=$6 205 1.2.2.2 pgoyette local nat_to_port=$7 206 1.2.2.2 pgoyette 207 1.2.2.2 pgoyette local outfile=./out.ping_over_ipsecif 208 1.2.2.2 pgoyette 209 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 210 1.2.2.2 pgoyette 211 1.2.2.2 pgoyette export RUMP_SERVER=$sock 212 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 7 $to_ip 213 1.2.2.2 pgoyette 214 1.2.2.2 pgoyette # Check both ports and UDP encapsulation 215 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 216 1.2.2.2 pgoyette $DEBUG && cat $outfile 217 1.2.2.2 pgoyette atf_check -s exit:0 \ 218 1.2.2.2 pgoyette -o match:"${nat_from_ip}\.$nat_from_port > ${nat_to_ip}\.${nat_to_port}: UDP-encap" \ 219 1.2.2.2 pgoyette cat $outfile 220 1.2.2.2 pgoyette atf_check -s exit:0 \ 221 1.2.2.2 pgoyette -o match:"${nat_to_ip}\.${nat_to_port} > ${nat_from_ip}\.${nat_from_port}: UDP-encap" \ 222 1.2.2.2 pgoyette cat $outfile 223 1.2.2.2 pgoyette } 224 1.2.2.2 pgoyette 225 1.2.2.2 pgoyette check_tcp_com_prepare() 226 1.2.2.2 pgoyette { 227 1.2.2.2 pgoyette local server_sock=$1 228 1.2.2.2 pgoyette local client_sock=$2 229 1.2.2.2 pgoyette local bus=$3 230 1.2.2.2 pgoyette local to_ip=$4 231 1.2.2.2 pgoyette local nat_from_ip=$5 232 1.2.2.2 pgoyette local nat_to_ip=$6 233 1.2.2.2 pgoyette 234 1.2.2.2 pgoyette local outfile=./out.prepare 235 1.2.2.2 pgoyette local file_send=./file.send.prepare 236 1.2.2.2 pgoyette local file_recv=./file.recv.prepare 237 1.2.2.2 pgoyette 238 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 239 1.2.2.2 pgoyette 240 1.2.2.2 pgoyette start_nc_server $server_sock 4501 $file_recv ipv4 241 1.2.2.2 pgoyette 242 1.2.2.2 pgoyette prepare_file $file_send 243 1.2.2.2 pgoyette export RUMP_SERVER=$client_sock 244 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING nc -w 3 $to_ip 4501 < $file_send 245 1.2.2.2 pgoyette atf_check -s exit:0 diff -q $file_send $file_recv 246 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 247 1.2.2.2 pgoyette $DEBUG && cat $outfile 248 1.2.2.2 pgoyette atf_check -s exit:0 \ 249 1.2.2.2 pgoyette -o match:"${nat_from_ip}\.[0-9]+ > ${nat_to_ip}\.4501" \ 250 1.2.2.2 pgoyette cat $outfile 251 1.2.2.2 pgoyette atf_check -s exit:0 \ 252 1.2.2.2 pgoyette -o match:"${nat_to_ip}\.4501 > ${nat_from_ip}\.[0-9]+" \ 253 1.2.2.2 pgoyette cat $outfile 254 1.2.2.2 pgoyette 255 1.2.2.2 pgoyette stop_nc_server 256 1.2.2.2 pgoyette } 257 1.2.2.2 pgoyette 258 1.2.2.2 pgoyette check_tcp_com_over_ipsecif() 259 1.2.2.2 pgoyette { 260 1.2.2.2 pgoyette local server_sock=$1 261 1.2.2.2 pgoyette local client_sock=$2 262 1.2.2.2 pgoyette local bus=$3 263 1.2.2.2 pgoyette local to_ip=$4 264 1.2.2.2 pgoyette local nat_from_ip=$5 265 1.2.2.2 pgoyette local nat_from_port=$6 266 1.2.2.2 pgoyette local nat_to_ip=$7 267 1.2.2.2 pgoyette local nat_to_port=$8 268 1.2.2.2 pgoyette 269 1.2.2.2 pgoyette local outfile=./out.ipsecif 270 1.2.2.2 pgoyette local file_send=./file.send.ipsecif 271 1.2.2.2 pgoyette local file_recv=./file.recv.ipsecif 272 1.2.2.2 pgoyette 273 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 274 1.2.2.2 pgoyette 275 1.2.2.2 pgoyette start_nc_server $server_sock 4501 $file_recv ipv4 276 1.2.2.2 pgoyette prepare_file $file_send 277 1.2.2.2 pgoyette export RUMP_SERVER=$client_sock 278 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore $HIJACKING nc -w 7 $to_ip 4501 < $file_send 279 1.2.2.2 pgoyette atf_check -s exit:0 diff -q $file_send $file_recv 280 1.2.2.2 pgoyette stop_nc_server 281 1.2.2.2 pgoyette 282 1.2.2.2 pgoyette # Check both ports and UDP encapsulation 283 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 284 1.2.2.2 pgoyette $DEBUG && cat $outfile 285 1.2.2.2 pgoyette atf_check -s exit:0 \ 286 1.2.2.2 pgoyette -o match:"${nat_from_ip}\.$nat_from_port > ${nat_to_ip}\.${nat_to_port}: UDP-encap" \ 287 1.2.2.2 pgoyette cat $outfile 288 1.2.2.2 pgoyette atf_check -s exit:0 \ 289 1.2.2.2 pgoyette -o match:"${nat_to_ip}\.${nat_to_port} > ${nat_from_ip}\.${nat_from_port}: UDP-encap" \ 290 1.2.2.2 pgoyette cat $outfile 291 1.2.2.2 pgoyette } 292 1.2.2.2 pgoyette 293 1.2.2.2 pgoyette test_ipsecif_natt_transport() 294 1.2.2.2 pgoyette { 295 1.2.2.2 pgoyette local algo=$1 296 1.2.2.2 pgoyette local ip_local=192.168.0.2 297 1.2.2.2 pgoyette local ip_nat_local=192.168.0.1 298 1.2.2.2 pgoyette local ip_nat_remote=10.0.0.1 299 1.2.2.2 pgoyette local ip_remote=10.0.0.2 300 1.2.2.2 pgoyette local subnet_local=192.168.0.0 301 1.2.2.2 pgoyette local ip_local_ipsecif=172.16.100.1 302 1.2.2.2 pgoyette local ip_remote_ipsecif=172.16.10.1 303 1.2.2.2 pgoyette 304 1.2.2.2 pgoyette local npffile=./npf.conf 305 1.2.2.2 pgoyette local file_send=./file.send 306 1.2.2.2 pgoyette local algo_args="$(generate_algo_args esp-udp $algo)" 307 1.2.2.2 pgoyette local pid= port= 308 1.2.2.2 pgoyette 309 1.2.2.2 pgoyette setup_servers 310 1.2.2.2 pgoyette 311 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 312 1.2.2.2 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0 313 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24 314 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore \ 315 1.2.2.2 pgoyette rump.route -n add default $ip_nat_local 316 1.2.2.2 pgoyette 317 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_NAT 318 1.2.2.2 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0 319 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_nat_local/24 320 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif1 $ip_nat_remote/24 321 1.2.2.2 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1 322 1.2.2.2 pgoyette 323 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_REMOTE 324 1.2.2.2 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0 325 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24 326 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore \ 327 1.2.2.2 pgoyette rump.route -n add -net $subnet_local $ip_nat_remote 328 1.2.2.2 pgoyette 329 1.2.2.2 pgoyette # There is no NAT/NAPT. ping should just work. 330 1.2.2.2 pgoyette check_ping_packets $SOCK_LOCAL $BUS_NAT $ip_local $ip_remote 331 1.2.2.2 pgoyette 332 1.2.2.2 pgoyette # Setup an NAPT with npf 333 1.2.2.2 pgoyette build_npf_conf $npffile "$subnet_local/24" 334 1.2.2.2 pgoyette 335 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_NAT 336 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING_NPF npfctl reload $npffile 337 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING_NPF npfctl start 338 1.2.2.2 pgoyette $DEBUG && ${HIJACKING},"blanket=/dev/npf" npfctl show 339 1.2.2.2 pgoyette 340 1.2.2.2 pgoyette # There is an NAPT. ping works but source IP/port are translated 341 1.2.2.2 pgoyette check_ping_packets $SOCK_LOCAL $BUS_NAT $ip_nat_remote $ip_remote 342 1.2.2.2 pgoyette 343 1.2.2.2 pgoyette # Try TCP communications just in case 344 1.2.2.2 pgoyette check_tcp_com_prepare $SOCK_REMOTE $SOCK_LOCAL $BUS_NAT \ 345 1.2.2.2 pgoyette $ip_remote $ip_nat_remote $ip_remote 346 1.2.2.2 pgoyette 347 1.2.2.2 pgoyette # Launch a nc server as a terminator of NAT-T on outside the NAPT 348 1.2.2.2 pgoyette start_natt_terminator $SOCK_REMOTE $ip_remote 4500 349 1.2.2.2 pgoyette echo zzz > $file_send 350 1.2.2.2 pgoyette 351 1.2.2.2 pgoyette 352 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 353 1.2.2.2 pgoyette # Send a UDP packet to the remote server at port 4500 from the local 354 1.2.2.2 pgoyette # host of port 4500. This makes a mapping on the NAPT between them 355 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING \ 356 1.2.2.2 pgoyette nc -u -w 3 -p 4500 $ip_remote 4500 < $file_send 357 1.2.2.2 pgoyette # Launch a nc server as a terminator of NAT-T on inside the NAPT, 358 1.2.2.2 pgoyette # taking over port 4500 of the local host. 359 1.2.2.2 pgoyette start_natt_terminator $SOCK_LOCAL $ip_local 4500 360 1.2.2.2 pgoyette 361 1.2.2.2 pgoyette # We need to keep the servers for NAT-T 362 1.2.2.2 pgoyette 363 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 364 1.2.2.2 pgoyette $DEBUG && rump.netstat -na -f inet 365 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_REMOTE 366 1.2.2.2 pgoyette $DEBUG && rump.netstat -na -f inet 367 1.2.2.2 pgoyette 368 1.2.2.2 pgoyette # Get a translated port number from 4500 on the NAPT 369 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_NAT 370 1.2.2.2 pgoyette $DEBUG && $HIJACKING_NPF npfctl list 371 1.2.2.2 pgoyette # 192.168.0.2:4500 10.0.0.2:4500 via shmif1:65248 372 1.2.2.2 pgoyette port=$($HIJACKING_NPF npfctl list | grep $ip_local | awk -F 'shmif1:' '/4500/ {print $2;}') 373 1.2.2.2 pgoyette $DEBUG && echo port=$port 374 1.2.2.2 pgoyette if [ -z "$port" ]; then 375 1.2.2.2 pgoyette atf_fail "Failed to get a traslated port on NAPT" 376 1.2.2.2 pgoyette fi 377 1.2.2.2 pgoyette 378 1.2.2.2 pgoyette # Setup ESP-UDP ipsecif(4) for first client under NAPT 379 1.2.2.2 pgoyette setup_ipsecif $SOCK_LOCAL 0 $ip_local 4500 $ip_remote 4500 \ 380 1.2.2.2 pgoyette $ip_local_ipsecif $ip_remote_ipsecif 381 1.2.2.2 pgoyette setup_ipsecif $SOCK_REMOTE 0 $ip_remote 4500 $ip_nat_remote $port \ 382 1.2.2.2 pgoyette $ip_remote_ipsecif $ip_local_ipsecif 383 1.2.2.2 pgoyette 384 1.2.2.2 pgoyette add_sa $SOCK_LOCAL "esp-udp" "$algo_args" \ 385 1.2.2.2 pgoyette $ip_local 4500 $ip_remote 4500 10000 10001 386 1.2.2.2 pgoyette add_sa $SOCK_REMOTE "esp-udp" "$algo_args" \ 387 1.2.2.2 pgoyette $ip_remote 4500 $ip_nat_remote $port 10001 10000 388 1.2.2.2 pgoyette 389 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 390 1.2.2.2 pgoyette # ping should still work 391 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote 392 1.2.2.2 pgoyette 393 1.2.2.2 pgoyette # Try ping over the ESP-UDP ipsecif(4) 394 1.2.2.2 pgoyette check_ping_packets_over_ipsecif $SOCK_LOCAL $BUS_NAT \ 395 1.2.2.2 pgoyette $ip_remote_ipsecif $ip_nat_remote $port $ip_remote 4500 396 1.2.2.2 pgoyette 397 1.2.2.2 pgoyette # Try TCP communications over the ESP-UDP ipsecif(4) 398 1.2.2.2 pgoyette check_tcp_com_over_ipsecif $SOCK_REMOTE $SOCK_LOCAL $BUS_NAT \ 399 1.2.2.2 pgoyette $ip_remote_ipsecif $ip_nat_remote $port $ip_remote 4500 400 1.2.2.2 pgoyette 401 1.2.2.2 pgoyette # Kill the NAT-T terminator 402 1.2.2.2 pgoyette stop_natt_terminators 403 1.2.2.2 pgoyette } 404 1.2.2.2 pgoyette 405 1.2.2.2 pgoyette add_test_ipsecif_natt_transport() 406 1.2.2.2 pgoyette { 407 1.2.2.2 pgoyette local algo=$1 408 1.2.2.2 pgoyette local _algo=$(echo $algo | sed 's/-//g') 409 1.2.2.2 pgoyette local name= desc= 410 1.2.2.2 pgoyette 411 1.2.2.2 pgoyette desc="Test ipsecif(4) NAT-T ($algo)" 412 1.2.2.2 pgoyette name="ipsecif_natt_transport_${_algo}" 413 1.2.2.2 pgoyette 414 1.2.2.2 pgoyette atf_test_case ${name} cleanup 415 1.2.2.2 pgoyette eval " 416 1.2.2.2 pgoyette ${name}_head() { 417 1.2.2.2 pgoyette atf_set descr \"$desc\" 418 1.2.2.2 pgoyette atf_set require.progs rump_server setkey nc 419 1.2.2.2 pgoyette } 420 1.2.2.2 pgoyette ${name}_body() { 421 1.2.2.2 pgoyette test_ipsecif_natt_transport $algo 422 1.2.2.2 pgoyette rump_server_destroy_ifaces 423 1.2.2.2 pgoyette } 424 1.2.2.2 pgoyette ${name}_cleanup() { 425 1.2.2.2 pgoyette stop_nc_server 426 1.2.2.2 pgoyette stop_natt_terminators 427 1.2.2.2 pgoyette \$DEBUG && dump 428 1.2.2.2 pgoyette cleanup 429 1.2.2.2 pgoyette } 430 1.2.2.2 pgoyette " 431 1.2.2.2 pgoyette atf_add_test_case ${name} 432 1.2.2.2 pgoyette } 433 1.2.2.2 pgoyette 434 1.2.2.2 pgoyette atf_init_test_cases() 435 1.2.2.2 pgoyette { 436 1.2.2.2 pgoyette local algo= 437 1.2.2.2 pgoyette 438 1.2.2.2 pgoyette for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do 439 1.2.2.2 pgoyette add_test_ipsecif_natt_transport $algo 440 1.2.2.2 pgoyette done 441 1.2.2.2 pgoyette } 442
Indexes created Sat Oct 04 17:09:44 GMT 2025