t_ipsec_natt.sh revision 1.2.2.3
1 1.2.2.3 pgoyette # $NetBSD: t_ipsec_natt.sh,v 1.2.2.3 2019/01/18 08:51:00 pgoyette Exp $ 2 1.2.2.2 pgoyette # 3 1.2.2.2 pgoyette # Copyright (c) 2018 Internet Initiative Japan Inc. 4 1.2.2.2 pgoyette # All rights reserved. 5 1.2.2.2 pgoyette # 6 1.2.2.2 pgoyette # Redistribution and use in source and binary forms, with or without 7 1.2.2.2 pgoyette # modification, are permitted provided that the following conditions 8 1.2.2.2 pgoyette # are met: 9 1.2.2.2 pgoyette # 1. Redistributions of source code must retain the above copyright 10 1.2.2.2 pgoyette # notice, this list of conditions and the following disclaimer. 11 1.2.2.2 pgoyette # 2. Redistributions in binary form must reproduce the above copyright 12 1.2.2.2 pgoyette # notice, this list of conditions and the following disclaimer in the 13 1.2.2.2 pgoyette # documentation and/or other materials provided with the distribution. 14 1.2.2.2 pgoyette # 15 1.2.2.2 pgoyette # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 16 1.2.2.2 pgoyette # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 17 1.2.2.2 pgoyette # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 18 1.2.2.2 pgoyette # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 19 1.2.2.2 pgoyette # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 1.2.2.2 pgoyette # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 1.2.2.2 pgoyette # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 1.2.2.2 pgoyette # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 1.2.2.2 pgoyette # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 1.2.2.2 pgoyette # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 1.2.2.2 pgoyette # POSSIBILITY OF SUCH DAMAGE. 26 1.2.2.2 pgoyette # 27 1.2.2.2 pgoyette 28 1.2.2.3 pgoyette SOCK_LOCAL_A=unix://ipsec_natt_local_a 29 1.2.2.3 pgoyette SOCK_LOCAL_B=unix://ipsec_natt_local_b 30 1.2.2.2 pgoyette SOCK_NAT=unix://ipsec_natt_nat 31 1.2.2.2 pgoyette SOCK_REMOTE=unix://ipsec_natt_remote 32 1.2.2.2 pgoyette BUS_LOCAL=./bus_ipsec_natt_local 33 1.2.2.2 pgoyette BUS_NAT=./bus_ipsec_natt_nat 34 1.2.2.2 pgoyette 35 1.2.2.2 pgoyette DEBUG=${DEBUG:-false} 36 1.2.2.2 pgoyette HIJACKING_NPF="${HIJACKING},blanket=/dev/npf" 37 1.2.2.2 pgoyette 38 1.2.2.2 pgoyette setup_servers() 39 1.2.2.2 pgoyette { 40 1.2.2.2 pgoyette 41 1.2.2.3 pgoyette rump_server_crypto_start $SOCK_LOCAL_A netipsec ipsec 42 1.2.2.3 pgoyette rump_server_crypto_start $SOCK_LOCAL_B netipsec ipsec 43 1.2.2.2 pgoyette rump_server_npf_start $SOCK_NAT 44 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_REMOTE netipsec ipsec 45 1.2.2.3 pgoyette rump_server_add_iface $SOCK_LOCAL_A shmif0 $BUS_LOCAL 46 1.2.2.3 pgoyette rump_server_add_iface $SOCK_LOCAL_B shmif0 $BUS_LOCAL 47 1.2.2.2 pgoyette rump_server_add_iface $SOCK_NAT shmif0 $BUS_LOCAL 48 1.2.2.2 pgoyette rump_server_add_iface $SOCK_NAT shmif1 $BUS_NAT 49 1.2.2.2 pgoyette rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_NAT 50 1.2.2.2 pgoyette } 51 1.2.2.2 pgoyette 52 1.2.2.2 pgoyette setup_ipsecif() 53 1.2.2.2 pgoyette { 54 1.2.2.2 pgoyette local sock=$1 55 1.2.2.2 pgoyette local ifid=$2 56 1.2.2.2 pgoyette local src_ip=$3 57 1.2.2.2 pgoyette local src_port=$4 58 1.2.2.2 pgoyette local dst_ip=$5 59 1.2.2.2 pgoyette local dst_port=$6 60 1.2.2.2 pgoyette local ipsecif_ip=$7 61 1.2.2.2 pgoyette local peer_ip=$8 62 1.2.2.2 pgoyette 63 1.2.2.2 pgoyette export RUMP_SERVER=$sock 64 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig ipsec$ifid create 65 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig ipsec$ifid link0 # enable NAT-T 66 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig ipsec$ifid tunnel ${src_ip},${src_port} ${dst_ip},${dst_port} 67 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig ipsec$ifid ${ipsecif_ip}/32 68 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore \ 69 1.2.2.2 pgoyette rump.route -n add ${peer_ip}/32 $ipsecif_ip 70 1.2.2.2 pgoyette } 71 1.2.2.2 pgoyette 72 1.2.2.2 pgoyette add_sa() 73 1.2.2.2 pgoyette { 74 1.2.2.2 pgoyette local sock=$1 75 1.2.2.2 pgoyette local proto=$2 76 1.2.2.2 pgoyette local algo_args="$3" 77 1.2.2.2 pgoyette local src_ip=$4 78 1.2.2.2 pgoyette local src_port=$5 79 1.2.2.2 pgoyette local dst_ip=$6 80 1.2.2.2 pgoyette local dst_port=$7 81 1.2.2.2 pgoyette local out_spi=$8 82 1.2.2.2 pgoyette local in_spi=$9 83 1.2.2.2 pgoyette local tmpfile=./tmp 84 1.2.2.2 pgoyette 85 1.2.2.2 pgoyette export RUMP_SERVER=$sock 86 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 87 1.2.2.2 pgoyette add $src_ip [$src_port] $dst_ip [$dst_port] $proto $out_spi -m transport $algo_args; 88 1.2.2.2 pgoyette add $dst_ip [$dst_port] $src_ip [$src_port] $proto $in_spi -m transport $algo_args; 89 1.2.2.2 pgoyette EOF 90 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 91 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 92 1.2.2.2 pgoyette # XXX it can be expired if $lifetime is very short 93 1.2.2.2 pgoyette #check_sa_entries $SOCK_LOCAL $ip_local $ip_remote 94 1.2.2.2 pgoyette } 95 1.2.2.2 pgoyette 96 1.2.2.2 pgoyette prepare_file() 97 1.2.2.2 pgoyette { 98 1.2.2.2 pgoyette local file=$1 99 1.2.2.2 pgoyette local data="0123456789" 100 1.2.2.2 pgoyette 101 1.2.2.2 pgoyette touch $file 102 1.2.2.2 pgoyette for i in `seq 1 512` 103 1.2.2.2 pgoyette do 104 1.2.2.2 pgoyette echo $data >> $file 105 1.2.2.2 pgoyette done 106 1.2.2.2 pgoyette } 107 1.2.2.2 pgoyette 108 1.2.2.2 pgoyette build_npf_conf() 109 1.2.2.2 pgoyette { 110 1.2.2.2 pgoyette local outfile=$1 111 1.2.2.2 pgoyette local localnet=$2 112 1.2.2.2 pgoyette 113 1.2.2.2 pgoyette cat > $outfile <<-EOF 114 1.2.2.2 pgoyette set bpf.jit off 115 1.2.2.2 pgoyette \$int_if = inet4(shmif0) 116 1.2.2.2 pgoyette \$ext_if = inet4(shmif1) 117 1.2.2.2 pgoyette \$localnet = { $localnet } 118 1.2.2.2 pgoyette map \$ext_if dynamic \$localnet -> \$ext_if 119 1.2.2.2 pgoyette group "external" on \$ext_if { 120 1.2.2.2 pgoyette pass stateful out final all 121 1.2.2.2 pgoyette } 122 1.2.2.2 pgoyette group "internal" on \$int_if { 123 1.2.2.2 pgoyette block in all 124 1.2.2.2 pgoyette pass in final from \$localnet 125 1.2.2.2 pgoyette pass out final all 126 1.2.2.2 pgoyette } 127 1.2.2.2 pgoyette group default { 128 1.2.2.2 pgoyette pass final on lo0 all 129 1.2.2.2 pgoyette block all 130 1.2.2.2 pgoyette } 131 1.2.2.2 pgoyette EOF 132 1.2.2.2 pgoyette } 133 1.2.2.2 pgoyette 134 1.2.2.2 pgoyette PIDSFILE=./terminator.pids 135 1.2.2.2 pgoyette start_natt_terminator() 136 1.2.2.2 pgoyette { 137 1.2.2.2 pgoyette local sock=$1 138 1.2.2.2 pgoyette local ip=$2 139 1.2.2.2 pgoyette local port=$3 140 1.2.2.2 pgoyette local pidsfile=$4 141 1.2.2.2 pgoyette local backup=$RUMP_SERVER 142 1.2.2.2 pgoyette local pid= 143 1.2.2.2 pgoyette local terminator="$(atf_get_srcdir)/../ipsec/natt_terminator" 144 1.2.2.2 pgoyette 145 1.2.2.2 pgoyette export RUMP_SERVER=$sock 146 1.2.2.2 pgoyette 147 1.2.2.2 pgoyette env LD_PRELOAD=/usr/lib/librumphijack.so \ 148 1.2.2.2 pgoyette $terminator $ip $port & 149 1.2.2.2 pgoyette pid=$! 150 1.2.2.2 pgoyette if [ ! -f $PIDSFILE ]; then 151 1.2.2.2 pgoyette touch $PIDSFILE 152 1.2.2.2 pgoyette fi 153 1.2.2.2 pgoyette echo $pid >> $PIDSFILE 154 1.2.2.2 pgoyette 155 1.2.2.2 pgoyette $DEBUG && rump.netstat -a -f inet 156 1.2.2.2 pgoyette 157 1.2.2.2 pgoyette export RUMP_SERVER=$backup 158 1.2.2.2 pgoyette 159 1.2.2.2 pgoyette sleep 1 160 1.2.2.2 pgoyette } 161 1.2.2.2 pgoyette 162 1.2.2.2 pgoyette stop_natt_terminators() 163 1.2.2.2 pgoyette { 164 1.2.2.2 pgoyette local pid= 165 1.2.2.2 pgoyette 166 1.2.2.2 pgoyette if [ ! -f $PIDSFILE ]; then 167 1.2.2.2 pgoyette return 168 1.2.2.2 pgoyette fi 169 1.2.2.2 pgoyette 170 1.2.2.2 pgoyette for pid in $(cat $PIDSFILE); do 171 1.2.2.2 pgoyette kill -9 $pid 172 1.2.2.2 pgoyette done 173 1.2.2.2 pgoyette rm -f $PIDSFILE 174 1.2.2.2 pgoyette } 175 1.2.2.2 pgoyette 176 1.2.2.2 pgoyette check_ping_packets() 177 1.2.2.2 pgoyette { 178 1.2.2.2 pgoyette local sock=$1 179 1.2.2.2 pgoyette local bus=$2 180 1.2.2.2 pgoyette local from_ip=$3 181 1.2.2.2 pgoyette local to_ip=$4 182 1.2.2.2 pgoyette 183 1.2.2.2 pgoyette local outfile=./out.ping 184 1.2.2.2 pgoyette 185 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 186 1.2.2.2 pgoyette 187 1.2.2.2 pgoyette export RUMP_SERVER=$sock 188 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $to_ip 189 1.2.2.2 pgoyette 190 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 191 1.2.2.2 pgoyette $DEBUG && cat $outfile 192 1.2.2.2 pgoyette atf_check -s exit:0 \ 193 1.2.2.2 pgoyette -o match:"$from_ip > $to_ip: ICMP echo request" \ 194 1.2.2.2 pgoyette cat $outfile 195 1.2.2.2 pgoyette atf_check -s exit:0 \ 196 1.2.2.2 pgoyette -o match:"$to_ip > $from_ip: ICMP echo reply" \ 197 1.2.2.2 pgoyette cat $outfile 198 1.2.2.2 pgoyette } 199 1.2.2.2 pgoyette 200 1.2.2.2 pgoyette check_ping_packets_over_ipsecif() 201 1.2.2.2 pgoyette { 202 1.2.2.2 pgoyette local sock=$1 203 1.2.2.2 pgoyette local bus=$2 204 1.2.2.2 pgoyette local to_ip=$3 205 1.2.2.2 pgoyette local nat_from_ip=$4 206 1.2.2.2 pgoyette local nat_from_port=$5 207 1.2.2.2 pgoyette local nat_to_ip=$6 208 1.2.2.2 pgoyette local nat_to_port=$7 209 1.2.2.2 pgoyette 210 1.2.2.2 pgoyette local outfile=./out.ping_over_ipsecif 211 1.2.2.2 pgoyette 212 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 213 1.2.2.2 pgoyette 214 1.2.2.2 pgoyette export RUMP_SERVER=$sock 215 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 7 $to_ip 216 1.2.2.2 pgoyette 217 1.2.2.2 pgoyette # Check both ports and UDP encapsulation 218 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 219 1.2.2.2 pgoyette $DEBUG && cat $outfile 220 1.2.2.2 pgoyette atf_check -s exit:0 \ 221 1.2.2.2 pgoyette -o match:"${nat_from_ip}\.$nat_from_port > ${nat_to_ip}\.${nat_to_port}: UDP-encap" \ 222 1.2.2.2 pgoyette cat $outfile 223 1.2.2.2 pgoyette atf_check -s exit:0 \ 224 1.2.2.2 pgoyette -o match:"${nat_to_ip}\.${nat_to_port} > ${nat_from_ip}\.${nat_from_port}: UDP-encap" \ 225 1.2.2.2 pgoyette cat $outfile 226 1.2.2.2 pgoyette } 227 1.2.2.2 pgoyette 228 1.2.2.2 pgoyette check_tcp_com_prepare() 229 1.2.2.2 pgoyette { 230 1.2.2.2 pgoyette local server_sock=$1 231 1.2.2.2 pgoyette local client_sock=$2 232 1.2.2.2 pgoyette local bus=$3 233 1.2.2.2 pgoyette local to_ip=$4 234 1.2.2.2 pgoyette local nat_from_ip=$5 235 1.2.2.2 pgoyette local nat_to_ip=$6 236 1.2.2.2 pgoyette 237 1.2.2.2 pgoyette local outfile=./out.prepare 238 1.2.2.2 pgoyette local file_send=./file.send.prepare 239 1.2.2.2 pgoyette local file_recv=./file.recv.prepare 240 1.2.2.2 pgoyette 241 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 242 1.2.2.2 pgoyette 243 1.2.2.2 pgoyette start_nc_server $server_sock 4501 $file_recv ipv4 244 1.2.2.2 pgoyette 245 1.2.2.2 pgoyette prepare_file $file_send 246 1.2.2.2 pgoyette export RUMP_SERVER=$client_sock 247 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING nc -w 3 $to_ip 4501 < $file_send 248 1.2.2.2 pgoyette atf_check -s exit:0 diff -q $file_send $file_recv 249 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 250 1.2.2.2 pgoyette $DEBUG && cat $outfile 251 1.2.2.2 pgoyette atf_check -s exit:0 \ 252 1.2.2.2 pgoyette -o match:"${nat_from_ip}\.[0-9]+ > ${nat_to_ip}\.4501" \ 253 1.2.2.2 pgoyette cat $outfile 254 1.2.2.2 pgoyette atf_check -s exit:0 \ 255 1.2.2.2 pgoyette -o match:"${nat_to_ip}\.4501 > ${nat_from_ip}\.[0-9]+" \ 256 1.2.2.2 pgoyette cat $outfile 257 1.2.2.2 pgoyette 258 1.2.2.2 pgoyette stop_nc_server 259 1.2.2.2 pgoyette } 260 1.2.2.2 pgoyette 261 1.2.2.2 pgoyette check_tcp_com_over_ipsecif() 262 1.2.2.2 pgoyette { 263 1.2.2.2 pgoyette local server_sock=$1 264 1.2.2.2 pgoyette local client_sock=$2 265 1.2.2.2 pgoyette local bus=$3 266 1.2.2.2 pgoyette local to_ip=$4 267 1.2.2.2 pgoyette local nat_from_ip=$5 268 1.2.2.2 pgoyette local nat_from_port=$6 269 1.2.2.2 pgoyette local nat_to_ip=$7 270 1.2.2.2 pgoyette local nat_to_port=$8 271 1.2.2.2 pgoyette 272 1.2.2.2 pgoyette local outfile=./out.ipsecif 273 1.2.2.2 pgoyette local file_send=./file.send.ipsecif 274 1.2.2.2 pgoyette local file_recv=./file.recv.ipsecif 275 1.2.2.2 pgoyette 276 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 277 1.2.2.2 pgoyette 278 1.2.2.2 pgoyette start_nc_server $server_sock 4501 $file_recv ipv4 279 1.2.2.2 pgoyette prepare_file $file_send 280 1.2.2.2 pgoyette export RUMP_SERVER=$client_sock 281 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore $HIJACKING nc -w 7 $to_ip 4501 < $file_send 282 1.2.2.2 pgoyette atf_check -s exit:0 diff -q $file_send $file_recv 283 1.2.2.2 pgoyette stop_nc_server 284 1.2.2.2 pgoyette 285 1.2.2.2 pgoyette # Check both ports and UDP encapsulation 286 1.2.2.2 pgoyette extract_new_packets $bus > $outfile 287 1.2.2.2 pgoyette $DEBUG && cat $outfile 288 1.2.2.2 pgoyette atf_check -s exit:0 \ 289 1.2.2.2 pgoyette -o match:"${nat_from_ip}\.$nat_from_port > ${nat_to_ip}\.${nat_to_port}: UDP-encap" \ 290 1.2.2.2 pgoyette cat $outfile 291 1.2.2.2 pgoyette atf_check -s exit:0 \ 292 1.2.2.2 pgoyette -o match:"${nat_to_ip}\.${nat_to_port} > ${nat_from_ip}\.${nat_from_port}: UDP-encap" \ 293 1.2.2.2 pgoyette cat $outfile 294 1.2.2.2 pgoyette } 295 1.2.2.2 pgoyette 296 1.2.2.2 pgoyette test_ipsecif_natt_transport() 297 1.2.2.2 pgoyette { 298 1.2.2.2 pgoyette local algo=$1 299 1.2.2.3 pgoyette local ip_local_a=192.168.0.2 300 1.2.2.3 pgoyette local ip_local_b=192.168.0.3 301 1.2.2.2 pgoyette local ip_nat_local=192.168.0.1 302 1.2.2.2 pgoyette local ip_nat_remote=10.0.0.1 303 1.2.2.2 pgoyette local ip_remote=10.0.0.2 304 1.2.2.2 pgoyette local subnet_local=192.168.0.0 305 1.2.2.3 pgoyette local ip_local_ipsecif_a=172.16.100.1 306 1.2.2.3 pgoyette local ip_local_ipsecif_b=172.16.110.1 307 1.2.2.3 pgoyette local ip_remote_ipsecif_a=172.16.10.1 308 1.2.2.3 pgoyette local ip_remote_ipsecif_b=172.16.11.1 309 1.2.2.2 pgoyette 310 1.2.2.2 pgoyette local npffile=./npf.conf 311 1.2.2.2 pgoyette local file_send=./file.send 312 1.2.2.2 pgoyette local algo_args="$(generate_algo_args esp-udp $algo)" 313 1.2.2.3 pgoyette local pid= port_a= port_b= 314 1.2.2.2 pgoyette 315 1.2.2.2 pgoyette setup_servers 316 1.2.2.2 pgoyette 317 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_LOCAL_A 318 1.2.2.2 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0 319 1.2.2.3 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_local_a/24 320 1.2.2.3 pgoyette atf_check -s exit:0 -o ignore \ 321 1.2.2.3 pgoyette rump.route -n add default $ip_nat_local 322 1.2.2.3 pgoyette 323 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_LOCAL_B 324 1.2.2.3 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0 325 1.2.2.3 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_local_b/24 326 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore \ 327 1.2.2.2 pgoyette rump.route -n add default $ip_nat_local 328 1.2.2.2 pgoyette 329 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_NAT 330 1.2.2.2 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0 331 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_nat_local/24 332 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif1 $ip_nat_remote/24 333 1.2.2.2 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1 334 1.2.2.2 pgoyette 335 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_REMOTE 336 1.2.2.2 pgoyette atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0 337 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24 338 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore \ 339 1.2.2.2 pgoyette rump.route -n add -net $subnet_local $ip_nat_remote 340 1.2.2.2 pgoyette 341 1.2.2.2 pgoyette # There is no NAT/NAPT. ping should just work. 342 1.2.2.3 pgoyette check_ping_packets $SOCK_LOCAL_A $BUS_NAT $ip_local_a $ip_remote 343 1.2.2.3 pgoyette check_ping_packets $SOCK_LOCAL_B $BUS_NAT $ip_local_b $ip_remote 344 1.2.2.2 pgoyette 345 1.2.2.2 pgoyette # Setup an NAPT with npf 346 1.2.2.2 pgoyette build_npf_conf $npffile "$subnet_local/24" 347 1.2.2.2 pgoyette 348 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_NAT 349 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING_NPF npfctl reload $npffile 350 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING_NPF npfctl start 351 1.2.2.2 pgoyette $DEBUG && ${HIJACKING},"blanket=/dev/npf" npfctl show 352 1.2.2.2 pgoyette 353 1.2.2.2 pgoyette # There is an NAPT. ping works but source IP/port are translated 354 1.2.2.3 pgoyette check_ping_packets $SOCK_LOCAL_A $BUS_NAT $ip_nat_remote $ip_remote 355 1.2.2.3 pgoyette check_ping_packets $SOCK_LOCAL_B $BUS_NAT $ip_nat_remote $ip_remote 356 1.2.2.2 pgoyette 357 1.2.2.2 pgoyette # Try TCP communications just in case 358 1.2.2.3 pgoyette check_tcp_com_prepare $SOCK_REMOTE $SOCK_LOCAL_A $BUS_NAT \ 359 1.2.2.3 pgoyette $ip_remote $ip_nat_remote $ip_remote 360 1.2.2.3 pgoyette check_tcp_com_prepare $SOCK_REMOTE $SOCK_LOCAL_B $BUS_NAT \ 361 1.2.2.2 pgoyette $ip_remote $ip_nat_remote $ip_remote 362 1.2.2.2 pgoyette 363 1.2.2.2 pgoyette # Launch a nc server as a terminator of NAT-T on outside the NAPT 364 1.2.2.2 pgoyette start_natt_terminator $SOCK_REMOTE $ip_remote 4500 365 1.2.2.2 pgoyette echo zzz > $file_send 366 1.2.2.2 pgoyette 367 1.2.2.3 pgoyette #################### Test for primary ipsecif(4) NAT-T. 368 1.2.2.3 pgoyette 369 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_LOCAL_A 370 1.2.2.3 pgoyette # Send a UDP packet to the remote server at port 4500 from the local 371 1.2.2.3 pgoyette # host of port 4500. This makes a mapping on the NAPT between them 372 1.2.2.3 pgoyette atf_check -s exit:0 $HIJACKING \ 373 1.2.2.3 pgoyette nc -u -w 3 -p 4500 $ip_remote 4500 < $file_send 374 1.2.2.3 pgoyette # Launch a nc server as a terminator of NAT-T on inside the NAPT, 375 1.2.2.3 pgoyette # taking over port 4500 of the local host. 376 1.2.2.3 pgoyette start_natt_terminator $SOCK_LOCAL_A $ip_local_a 4500 377 1.2.2.3 pgoyette 378 1.2.2.3 pgoyette # We need to keep the servers for NAT-T 379 1.2.2.3 pgoyette 380 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_LOCAL_A 381 1.2.2.3 pgoyette $DEBUG && rump.netstat -na -f inet 382 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_REMOTE 383 1.2.2.3 pgoyette $DEBUG && rump.netstat -na -f inet 384 1.2.2.3 pgoyette 385 1.2.2.3 pgoyette # Get a translated port number from 4500 on the NAPT 386 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_NAT 387 1.2.2.3 pgoyette $DEBUG && $HIJACKING_NPF npfctl list 388 1.2.2.3 pgoyette # 192.168.0.2:4500 10.0.0.2:4500 via shmif1:65248 389 1.2.2.3 pgoyette port_a=$($HIJACKING_NPF npfctl list | grep $ip_local_a | awk -F 'shmif1:' '/4500/ {print $2;}') 390 1.2.2.3 pgoyette $DEBUG && echo port_a=$port_a 391 1.2.2.3 pgoyette if [ -z "$port_a" ]; then 392 1.2.2.3 pgoyette atf_fail "Failed to get a traslated port on NAPT" 393 1.2.2.3 pgoyette fi 394 1.2.2.3 pgoyette 395 1.2.2.3 pgoyette # Setup ESP-UDP ipsecif(4) for first client under NAPT 396 1.2.2.3 pgoyette setup_ipsecif $SOCK_LOCAL_A 0 $ip_local_a 4500 $ip_remote 4500 \ 397 1.2.2.3 pgoyette $ip_local_ipsecif_a $ip_remote_ipsecif_a 398 1.2.2.3 pgoyette setup_ipsecif $SOCK_REMOTE 0 $ip_remote 4500 $ip_nat_remote $port_a \ 399 1.2.2.3 pgoyette $ip_remote_ipsecif_a $ip_local_ipsecif_a 400 1.2.2.3 pgoyette 401 1.2.2.3 pgoyette add_sa $SOCK_LOCAL_A "esp-udp" "$algo_args" \ 402 1.2.2.3 pgoyette $ip_local_a 4500 $ip_remote 4500 10000 10001 403 1.2.2.3 pgoyette add_sa $SOCK_REMOTE "esp-udp" "$algo_args" \ 404 1.2.2.3 pgoyette $ip_remote 4500 $ip_nat_remote $port_a 10001 10000 405 1.2.2.3 pgoyette 406 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_LOCAL_A 407 1.2.2.3 pgoyette # ping should still work 408 1.2.2.3 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote 409 1.2.2.2 pgoyette 410 1.2.2.3 pgoyette # Try ping over the ESP-UDP ipsecif(4) 411 1.2.2.3 pgoyette check_ping_packets_over_ipsecif $SOCK_LOCAL_A $BUS_NAT \ 412 1.2.2.3 pgoyette $ip_remote_ipsecif_a $ip_nat_remote $port_a $ip_remote 4500 413 1.2.2.3 pgoyette 414 1.2.2.3 pgoyette # Try TCP communications over the ESP-UDP ipsecif(4) 415 1.2.2.3 pgoyette check_tcp_com_over_ipsecif $SOCK_REMOTE $SOCK_LOCAL_A $BUS_NAT \ 416 1.2.2.3 pgoyette $ip_remote_ipsecif_a $ip_nat_remote $port_a $ip_remote 4500 417 1.2.2.3 pgoyette 418 1.2.2.3 pgoyette #################### Test for secondary ipsecif(4) NAT-T. 419 1.2.2.3 pgoyette 420 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_REMOTE 421 1.2.2.3 pgoyette $HIJACKING setkey -D 422 1.2.2.3 pgoyette $HIJACKING setkey -DP 423 1.2.2.3 pgoyette 424 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_LOCAL_B 425 1.2.2.2 pgoyette # Send a UDP packet to the remote server at port 4500 from the local 426 1.2.2.2 pgoyette # host of port 4500. This makes a mapping on the NAPT between them 427 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING \ 428 1.2.2.2 pgoyette nc -u -w 3 -p 4500 $ip_remote 4500 < $file_send 429 1.2.2.2 pgoyette # Launch a nc server as a terminator of NAT-T on inside the NAPT, 430 1.2.2.2 pgoyette # taking over port 4500 of the local host. 431 1.2.2.3 pgoyette start_natt_terminator $SOCK_LOCAL_B $ip_local_b 4500 432 1.2.2.2 pgoyette 433 1.2.2.2 pgoyette # We need to keep the servers for NAT-T 434 1.2.2.2 pgoyette 435 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_LOCAL_B 436 1.2.2.2 pgoyette $DEBUG && rump.netstat -na -f inet 437 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_REMOTE 438 1.2.2.2 pgoyette $DEBUG && rump.netstat -na -f inet 439 1.2.2.2 pgoyette 440 1.2.2.2 pgoyette # Get a translated port number from 4500 on the NAPT 441 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_NAT 442 1.2.2.2 pgoyette $DEBUG && $HIJACKING_NPF npfctl list 443 1.2.2.2 pgoyette # 192.168.0.2:4500 10.0.0.2:4500 via shmif1:65248 444 1.2.2.3 pgoyette port_b=$($HIJACKING_NPF npfctl list | grep $ip_local_b | awk -F 'shmif1:' '/4500/ {print $2;}') 445 1.2.2.3 pgoyette $DEBUG && echo port_b=$port_b 446 1.2.2.3 pgoyette if [ -z "$port_b" ]; then 447 1.2.2.2 pgoyette atf_fail "Failed to get a traslated port on NAPT" 448 1.2.2.2 pgoyette fi 449 1.2.2.2 pgoyette 450 1.2.2.2 pgoyette # Setup ESP-UDP ipsecif(4) for first client under NAPT 451 1.2.2.3 pgoyette setup_ipsecif $SOCK_LOCAL_B 0 $ip_local_b 4500 $ip_remote 4500 \ 452 1.2.2.3 pgoyette $ip_local_ipsecif_b $ip_remote_ipsecif_b 453 1.2.2.3 pgoyette setup_ipsecif $SOCK_REMOTE 1 $ip_remote 4500 $ip_nat_remote $port_b \ 454 1.2.2.3 pgoyette $ip_remote_ipsecif_b $ip_local_ipsecif_b 455 1.2.2.3 pgoyette 456 1.2.2.3 pgoyette check_ping_packets_over_ipsecif $SOCK_LOCAL_A $BUS_NAT \ 457 1.2.2.3 pgoyette $ip_remote_ipsecif_a $ip_nat_remote $port_a $ip_remote 4500 458 1.2.2.2 pgoyette 459 1.2.2.3 pgoyette add_sa $SOCK_LOCAL_B "esp-udp" "$algo_args" \ 460 1.2.2.3 pgoyette $ip_local_b 4500 $ip_remote 4500 11000 11001 461 1.2.2.2 pgoyette add_sa $SOCK_REMOTE "esp-udp" "$algo_args" \ 462 1.2.2.3 pgoyette $ip_remote 4500 $ip_nat_remote $port_b 11001 11000 463 1.2.2.2 pgoyette 464 1.2.2.3 pgoyette export RUMP_SERVER=$SOCK_LOCAL_B 465 1.2.2.2 pgoyette # ping should still work 466 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote 467 1.2.2.2 pgoyette 468 1.2.2.2 pgoyette # Try ping over the ESP-UDP ipsecif(4) 469 1.2.2.3 pgoyette check_ping_packets_over_ipsecif $SOCK_LOCAL_B $BUS_NAT \ 470 1.2.2.3 pgoyette $ip_remote_ipsecif_b $ip_nat_remote $port_b $ip_remote 4500 471 1.2.2.3 pgoyette 472 1.2.2.2 pgoyette 473 1.2.2.2 pgoyette # Try TCP communications over the ESP-UDP ipsecif(4) 474 1.2.2.3 pgoyette check_tcp_com_over_ipsecif $SOCK_REMOTE $SOCK_LOCAL_B $BUS_NAT \ 475 1.2.2.3 pgoyette $ip_remote_ipsecif_b $ip_nat_remote $port_b $ip_remote 4500 476 1.2.2.3 pgoyette 477 1.2.2.3 pgoyette # Try ping over the ESP-UDP ipsecif(4) for primary again 478 1.2.2.3 pgoyette check_ping_packets_over_ipsecif $SOCK_LOCAL_A $BUS_NAT \ 479 1.2.2.3 pgoyette $ip_remote_ipsecif_a $ip_nat_remote $port_a $ip_remote 4500 480 1.2.2.3 pgoyette 481 1.2.2.3 pgoyette # Try TCP communications over the ESP-UDP ipsecif(4) for primary again 482 1.2.2.3 pgoyette check_tcp_com_over_ipsecif $SOCK_REMOTE $SOCK_LOCAL_A $BUS_NAT \ 483 1.2.2.3 pgoyette $ip_remote_ipsecif_a $ip_nat_remote $port_a $ip_remote 4500 484 1.2.2.2 pgoyette 485 1.2.2.2 pgoyette # Kill the NAT-T terminator 486 1.2.2.2 pgoyette stop_natt_terminators 487 1.2.2.2 pgoyette } 488 1.2.2.2 pgoyette 489 1.2.2.2 pgoyette add_test_ipsecif_natt_transport() 490 1.2.2.2 pgoyette { 491 1.2.2.2 pgoyette local algo=$1 492 1.2.2.2 pgoyette local _algo=$(echo $algo | sed 's/-//g') 493 1.2.2.2 pgoyette local name= desc= 494 1.2.2.2 pgoyette 495 1.2.2.2 pgoyette desc="Test ipsecif(4) NAT-T ($algo)" 496 1.2.2.2 pgoyette name="ipsecif_natt_transport_${_algo}" 497 1.2.2.2 pgoyette 498 1.2.2.2 pgoyette atf_test_case ${name} cleanup 499 1.2.2.2 pgoyette eval " 500 1.2.2.2 pgoyette ${name}_head() { 501 1.2.2.2 pgoyette atf_set descr \"$desc\" 502 1.2.2.2 pgoyette atf_set require.progs rump_server setkey nc 503 1.2.2.2 pgoyette } 504 1.2.2.2 pgoyette ${name}_body() { 505 1.2.2.2 pgoyette test_ipsecif_natt_transport $algo 506 1.2.2.2 pgoyette rump_server_destroy_ifaces 507 1.2.2.2 pgoyette } 508 1.2.2.2 pgoyette ${name}_cleanup() { 509 1.2.2.2 pgoyette stop_nc_server 510 1.2.2.2 pgoyette stop_natt_terminators 511 1.2.2.2 pgoyette \$DEBUG && dump 512 1.2.2.2 pgoyette cleanup 513 1.2.2.2 pgoyette } 514 1.2.2.2 pgoyette " 515 1.2.2.2 pgoyette atf_add_test_case ${name} 516 1.2.2.2 pgoyette } 517 1.2.2.2 pgoyette 518 1.2.2.2 pgoyette atf_init_test_cases() 519 1.2.2.2 pgoyette { 520 1.2.2.2 pgoyette local algo= 521 1.2.2.2 pgoyette 522 1.2.2.2 pgoyette for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do 523 1.2.2.2 pgoyette add_test_ipsecif_natt_transport $algo 524 1.2.2.2 pgoyette done 525 1.2.2.2 pgoyette } 526
Indexes created Sat Oct 04 05:10:05 GMT 2025