Home | History | Annotate | Line # | Download | only in ipsec
t_ipsec_gif.sh revision 1.2.2.3 
      1  1.2.2.3  pgoyette #	$NetBSD: t_ipsec_gif.sh,v 1.2.2.3 2017/05/11 02:58:42 pgoyette Exp $
      2  1.2.2.2  pgoyette #
      3  1.2.2.2  pgoyette # Copyright (c) 2017 Internet Initiative Japan Inc.
      4  1.2.2.2  pgoyette # All rights reserved.
      5  1.2.2.2  pgoyette #
      6  1.2.2.2  pgoyette # Redistribution and use in source and binary forms, with or without
      7  1.2.2.2  pgoyette # modification, are permitted provided that the following conditions
      8  1.2.2.2  pgoyette # are met:
      9  1.2.2.2  pgoyette # 1. Redistributions of source code must retain the above copyright
     10  1.2.2.2  pgoyette #    notice, this list of conditions and the following disclaimer.
     11  1.2.2.2  pgoyette # 2. Redistributions in binary form must reproduce the above copyright
     12  1.2.2.2  pgoyette #    notice, this list of conditions and the following disclaimer in the
     13  1.2.2.2  pgoyette #    documentation and/or other materials provided with the distribution.
     14  1.2.2.2  pgoyette #
     15  1.2.2.2  pgoyette # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     16  1.2.2.2  pgoyette # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     17  1.2.2.2  pgoyette # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     18  1.2.2.2  pgoyette # PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     19  1.2.2.2  pgoyette # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     20  1.2.2.2  pgoyette # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     21  1.2.2.2  pgoyette # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     22  1.2.2.2  pgoyette # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     23  1.2.2.2  pgoyette # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     24  1.2.2.2  pgoyette # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     25  1.2.2.2  pgoyette # POSSIBILITY OF SUCH DAMAGE.
     26  1.2.2.2  pgoyette #
     27  1.2.2.2  pgoyette 
     28  1.2.2.2  pgoyette SOCK_LOCAL=unix://ipsec_gif_local
     29  1.2.2.2  pgoyette SOCK_TUN_LOCAL=unix://ipsec_gif_tunel_local
     30  1.2.2.2  pgoyette SOCK_TUN_REMOTE=unix://ipsec_gif_tunnel_remote
     31  1.2.2.2  pgoyette SOCK_REMOTE=unix://ipsec_gif_remote
     32  1.2.2.2  pgoyette BUS_LOCAL=./bus_ipsec_local
     33  1.2.2.2  pgoyette BUS_TUNNEL=./bus_ipsec_tunnel
     34  1.2.2.2  pgoyette BUS_REMOTE=./bus_ipsec_remote
     35  1.2.2.2  pgoyette 
     36  1.2.2.2  pgoyette DEBUG=${DEBUG:-false}
     37  1.2.2.2  pgoyette 
     38  1.2.2.2  pgoyette make_gif_pktstr()
     39  1.2.2.2  pgoyette {
     40  1.2.2.2  pgoyette 	local src=$1
     41  1.2.2.2  pgoyette 	local dst=$2
     42  1.2.2.2  pgoyette 	local src_inner=$3
     43  1.2.2.2  pgoyette 	local dst_inner=$4
     44  1.2.2.2  pgoyette 	local proto=$5
     45  1.2.2.2  pgoyette 	local ipproto=$6
     46  1.2.2.2  pgoyette 	local proto_cap= inner_str=
     47  1.2.2.2  pgoyette 
     48  1.2.2.2  pgoyette 	if [ $proto = esp ]; then
     49  1.2.2.2  pgoyette 		proto_cap=ESP
     50  1.2.2.2  pgoyette 	else
     51  1.2.2.2  pgoyette 		proto_cap=AH
     52  1.2.2.2  pgoyette 		if [ $ipproto = ipv4 ]; then
     53  1.2.2.2  pgoyette 			inner_str="$src_inner > $dst_inner:.+\(ipip-proto-4\)"
     54  1.2.2.2  pgoyette 		else
     55  1.2.2.2  pgoyette 			inner_str="$src_inner > $dst_inner"
     56  1.2.2.2  pgoyette 		fi
     57  1.2.2.2  pgoyette 	fi
     58  1.2.2.2  pgoyette 
     59  1.2.2.2  pgoyette 	echo "$src > $dst: $proto_cap.+$inner_str"
     60  1.2.2.2  pgoyette }
     61  1.2.2.2  pgoyette 
     62  1.2.2.2  pgoyette test_ipsec4_gif()
     63  1.2.2.2  pgoyette {
     64  1.2.2.2  pgoyette 	local mode=$1
     65  1.2.2.2  pgoyette 	local proto=$2
     66  1.2.2.2  pgoyette 	local algo=$3
     67  1.2.2.2  pgoyette 	local ip_local=10.0.1.2
     68  1.2.2.2  pgoyette 	local ip_gw_local=10.0.1.1
     69  1.2.2.2  pgoyette 	local ip_gwlo_tun=20.0.0.1
     70  1.2.2.2  pgoyette 	local ip_gwlo_gif=20.1.0.1
     71  1.2.2.2  pgoyette 	local ip_gwre_gif=20.1.0.2
     72  1.2.2.2  pgoyette 	local ip_gwre_tun=20.0.0.2
     73  1.2.2.2  pgoyette 	local ip_gw_remote=10.0.2.1
     74  1.2.2.2  pgoyette 	local ip_remote=10.0.2.2
     75  1.2.2.2  pgoyette 	local subnet_local=10.0.1.0
     76  1.2.2.2  pgoyette 	local subnet_remote=10.0.2.0
     77  1.2.2.2  pgoyette 	local keylen=$(get_one_valid_keylen $algo)
     78  1.2.2.2  pgoyette 	local key=$(generate_key $keylen)
     79  1.2.2.2  pgoyette 	local tmpfile=./tmp
     80  1.2.2.2  pgoyette 	local outfile=./out
     81  1.2.2.2  pgoyette 	local opt= str=
     82  1.2.2.2  pgoyette 
     83  1.2.2.2  pgoyette 	if [ $proto = esp ]; then
     84  1.2.2.2  pgoyette 		opt=-E
     85  1.2.2.2  pgoyette 	else
     86  1.2.2.2  pgoyette 		opt=-A
     87  1.2.2.2  pgoyette 	fi
     88  1.2.2.2  pgoyette 
     89  1.2.2.2  pgoyette 	rump_server_crypto_start $SOCK_LOCAL
     90  1.2.2.2  pgoyette 	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec gif
     91  1.2.2.2  pgoyette 	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec gif
     92  1.2.2.2  pgoyette 	rump_server_crypto_start $SOCK_REMOTE
     93  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
     94  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
     95  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
     96  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
     97  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
     98  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
     99  1.2.2.2  pgoyette 
    100  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_LOCAL
    101  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
    102  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore \
    103  1.2.2.2  pgoyette 	    rump.route -n add -net $subnet_remote $ip_gw_local
    104  1.2.2.2  pgoyette 
    105  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    106  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_local/24
    107  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwlo_tun/24
    108  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 create
    109  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 \
    110  1.2.2.2  pgoyette 	    tunnel $ip_gwlo_tun $ip_gwre_tun
    111  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 \
    112  1.2.2.2  pgoyette 	    inet $ip_gwlo_gif/32 $ip_gwre_gif
    113  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1
    114  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore \
    115  1.2.2.2  pgoyette 	    rump.route -n add -net $subnet_remote $ip_gwre_gif
    116  1.2.2.2  pgoyette 
    117  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    118  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_remote/24
    119  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwre_tun/24
    120  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 create
    121  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 \
    122  1.2.2.2  pgoyette 	    tunnel $ip_gwre_tun $ip_gwlo_tun
    123  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 \
    124  1.2.2.2  pgoyette 	    inet $ip_gwre_gif/32 $ip_gwlo_gif
    125  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1
    126  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore \
    127  1.2.2.2  pgoyette 	    rump.route -n add -net $subnet_local $ip_gwlo_gif
    128  1.2.2.2  pgoyette 
    129  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_REMOTE
    130  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24
    131  1.2.2.2  pgoyette 	# Run ifconfig -w 10 just once for optimization
    132  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig -w 10
    133  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore \
    134  1.2.2.2  pgoyette 	    rump.route -n add -net $subnet_local $ip_gw_remote
    135  1.2.2.2  pgoyette 
    136  1.2.2.2  pgoyette 	extract_new_packets $BUS_TUNNEL > $outfile
    137  1.2.2.2  pgoyette 
    138  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_LOCAL
    139  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    140  1.2.2.2  pgoyette 
    141  1.2.2.2  pgoyette 	extract_new_packets $BUS_TUNNEL > $outfile
    142  1.2.2.2  pgoyette 	str="$ip_gwlo_tun > $ip_gwre_tun:"
    143  1.2.2.2  pgoyette 	str="$str $ip_local > $ip_remote: ICMP echo request,"
    144  1.2.2.2  pgoyette 	str="$str .+ \(ipip-proto-4\)"
    145  1.2.2.2  pgoyette 	atf_check -s exit:0 -o match:"$str" cat $outfile
    146  1.2.2.2  pgoyette 	str="$ip_gwre_tun > $ip_gwlo_tun:"
    147  1.2.2.2  pgoyette 	str="$str $ip_remote > $ip_local: ICMP echo reply,"
    148  1.2.2.2  pgoyette 	str="$str .+ \(ipip-proto-4\)"
    149  1.2.2.2  pgoyette 	atf_check -s exit:0 -o match:"$str" cat $outfile
    150  1.2.2.2  pgoyette 
    151  1.2.2.2  pgoyette 	if [ $mode = tunnel ]; then
    152  1.2.2.2  pgoyette 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    153  1.2.2.2  pgoyette 		# from https://www.netbsd.org/docs/network/ipsec/
    154  1.2.2.2  pgoyette 		cat > $tmpfile <<-EOF
    155  1.2.2.2  pgoyette 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    156  1.2.2.2  pgoyette 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    157  1.2.2.2  pgoyette 		spdadd $subnet_local/24 $subnet_remote/24 any -P out ipsec
    158  1.2.2.2  pgoyette 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    159  1.2.2.2  pgoyette 		spdadd $subnet_remote/24 $subnet_local/24 any -P in ipsec
    160  1.2.2.2  pgoyette 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    161  1.2.2.2  pgoyette 		EOF
    162  1.2.2.2  pgoyette 		$DEBUG && cat $tmpfile
    163  1.2.2.2  pgoyette 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    164  1.2.2.2  pgoyette 
    165  1.2.2.2  pgoyette 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    166  1.2.2.2  pgoyette 		cat > $tmpfile <<-EOF
    167  1.2.2.2  pgoyette 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    168  1.2.2.2  pgoyette 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    169  1.2.2.2  pgoyette 		spdadd $subnet_remote/24 $subnet_local/24 any -P out ipsec
    170  1.2.2.2  pgoyette 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    171  1.2.2.2  pgoyette 		spdadd $subnet_local/24 $subnet_remote/24 any -P in ipsec
    172  1.2.2.2  pgoyette 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    173  1.2.2.2  pgoyette 		EOF
    174  1.2.2.2  pgoyette 		$DEBUG && cat $tmpfile
    175  1.2.2.2  pgoyette 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    176  1.2.2.2  pgoyette 	else # transport mode
    177  1.2.2.2  pgoyette 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    178  1.2.2.2  pgoyette 		# from https://www.netbsd.org/docs/network/ipsec/
    179  1.2.2.2  pgoyette 		cat > $tmpfile <<-EOF
    180  1.2.2.2  pgoyette 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    181  1.2.2.2  pgoyette 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    182  1.2.2.2  pgoyette 		spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P out ipsec
    183  1.2.2.2  pgoyette 		    $proto/transport//require;
    184  1.2.2.2  pgoyette 		spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P in ipsec
    185  1.2.2.2  pgoyette 		    $proto/transport//require;
    186  1.2.2.2  pgoyette 		EOF
    187  1.2.2.2  pgoyette 		$DEBUG && cat $tmpfile
    188  1.2.2.2  pgoyette 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    189  1.2.2.2  pgoyette 
    190  1.2.2.2  pgoyette 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    191  1.2.2.2  pgoyette 		cat > $tmpfile <<-EOF
    192  1.2.2.2  pgoyette 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    193  1.2.2.2  pgoyette 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    194  1.2.2.2  pgoyette 		spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P out ipsec
    195  1.2.2.2  pgoyette 		    $proto/transport//require;
    196  1.2.2.2  pgoyette 		spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P in ipsec
    197  1.2.2.2  pgoyette 		    $proto/transport//require;
    198  1.2.2.2  pgoyette 		EOF
    199  1.2.2.2  pgoyette 		$DEBUG && cat $tmpfile
    200  1.2.2.2  pgoyette 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    201  1.2.2.2  pgoyette 	fi
    202  1.2.2.2  pgoyette 
    203  1.2.2.3  pgoyette 	check_sa_entries $SOCK_TUN_LOCAL $ip_gwlo_tun $ip_gwre_tun
    204  1.2.2.3  pgoyette 	check_sa_entries $SOCK_TUN_REMOTE $ip_gwlo_tun $ip_gwre_tun
    205  1.2.2.3  pgoyette 
    206  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_LOCAL
    207  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    208  1.2.2.2  pgoyette 
    209  1.2.2.2  pgoyette 	extract_new_packets $BUS_TUNNEL > $outfile
    210  1.2.2.2  pgoyette 	str=$(make_gif_pktstr $ip_gwlo_tun $ip_gwre_tun \
    211  1.2.2.2  pgoyette 	    $ip_local $ip_remote $proto ipv4)
    212  1.2.2.2  pgoyette 	atf_check -s exit:0 -o match:"$str" cat $outfile
    213  1.2.2.2  pgoyette 	str=$(make_gif_pktstr $ip_gwre_tun $ip_gwlo_tun \
    214  1.2.2.2  pgoyette 	    $ip_remote $ip_local $proto ipv4)
    215  1.2.2.2  pgoyette 	atf_check -s exit:0 -o match:"$str" cat $outfile
    216  1.2.2.3  pgoyette 
    217  1.2.2.3  pgoyette 	test_flush_entries $SOCK_TUN_LOCAL
    218  1.2.2.3  pgoyette 	test_flush_entries $SOCK_TUN_REMOTE
    219  1.2.2.2  pgoyette }
    220  1.2.2.2  pgoyette 
    221  1.2.2.2  pgoyette test_ipsec6_gif()
    222  1.2.2.2  pgoyette {
    223  1.2.2.2  pgoyette 	local mode=$1
    224  1.2.2.2  pgoyette 	local proto=$2
    225  1.2.2.2  pgoyette 	local algo=$3
    226  1.2.2.2  pgoyette 	local ip_local=fd00:1::2
    227  1.2.2.2  pgoyette 	local ip_gw_local=fd00:1::1
    228  1.2.2.2  pgoyette 	local ip_gwlo_tun=fc00::1
    229  1.2.2.2  pgoyette 	local ip_gwlo_gif=fc01::1
    230  1.2.2.2  pgoyette 	local ip_gwre_gif=fc01::2
    231  1.2.2.2  pgoyette 	local ip_gwre_tun=fc00::2
    232  1.2.2.2  pgoyette 	local ip_gw_remote=fd00:2::1
    233  1.2.2.2  pgoyette 	local ip_remote=fd00:2::2
    234  1.2.2.2  pgoyette 	local subnet_local=fd00:1::
    235  1.2.2.2  pgoyette 	local subnet_remote=fd00:2::
    236  1.2.2.2  pgoyette 	local keylen=$(get_one_valid_keylen $algo)
    237  1.2.2.2  pgoyette 	local key=$(generate_key $keylen)
    238  1.2.2.2  pgoyette 	local tmpfile=./tmp
    239  1.2.2.2  pgoyette 	local outfile=./out
    240  1.2.2.2  pgoyette 	local opt= str=
    241  1.2.2.2  pgoyette 
    242  1.2.2.2  pgoyette 	if [ $proto = esp ]; then
    243  1.2.2.2  pgoyette 		opt=-E
    244  1.2.2.2  pgoyette 	else
    245  1.2.2.2  pgoyette 		opt=-A
    246  1.2.2.2  pgoyette 	fi
    247  1.2.2.2  pgoyette 
    248  1.2.2.2  pgoyette 	rump_server_crypto_start $SOCK_LOCAL netinet6
    249  1.2.2.2  pgoyette 	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec netinet6 gif
    250  1.2.2.2  pgoyette 	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec netinet6 gif
    251  1.2.2.2  pgoyette 	rump_server_crypto_start $SOCK_REMOTE netinet6
    252  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
    253  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
    254  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
    255  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
    256  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
    257  1.2.2.2  pgoyette 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
    258  1.2.2.2  pgoyette 
    259  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_LOCAL
    260  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local/64
    261  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore \
    262  1.2.2.2  pgoyette 	    rump.route -n add -inet6 -net $subnet_remote/64 $ip_gw_local
    263  1.2.2.2  pgoyette 
    264  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    265  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_local/64
    266  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwlo_tun/64
    267  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 create
    268  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 \
    269  1.2.2.2  pgoyette 	    tunnel $ip_gwlo_tun $ip_gwre_tun
    270  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 \
    271  1.2.2.2  pgoyette 	    inet6 $ip_gwlo_gif/128 $ip_gwre_gif
    272  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1
    273  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore \
    274  1.2.2.2  pgoyette 	    rump.route -n add -inet6 -net $subnet_remote/64 $ip_gwlo_gif
    275  1.2.2.2  pgoyette 
    276  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    277  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_remote/64
    278  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwre_tun/64
    279  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 create
    280  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 \
    281  1.2.2.2  pgoyette 	    tunnel $ip_gwre_tun $ip_gwlo_tun
    282  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig gif0 \
    283  1.2.2.2  pgoyette 	    inet6 $ip_gwre_gif/128 $ip_gwlo_gif
    284  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1
    285  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore \
    286  1.2.2.2  pgoyette 	    rump.route -n add -inet6 -net $subnet_local/64 $ip_gwre_gif
    287  1.2.2.2  pgoyette 
    288  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_REMOTE
    289  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_remote
    290  1.2.2.2  pgoyette 	# Run ifconfig -w 10 just once for optimization
    291  1.2.2.2  pgoyette 	atf_check -s exit:0 rump.ifconfig -w 10
    292  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore \
    293  1.2.2.2  pgoyette 	    rump.route -n add -inet6 -net $subnet_local/64 $ip_gw_remote
    294  1.2.2.2  pgoyette 
    295  1.2.2.2  pgoyette 	extract_new_packets $BUS_TUNNEL > $outfile
    296  1.2.2.2  pgoyette 
    297  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_LOCAL
    298  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    299  1.2.2.2  pgoyette 
    300  1.2.2.2  pgoyette 	extract_new_packets $BUS_TUNNEL > $outfile
    301  1.2.2.2  pgoyette 	str="$ip_gwlo_tun > $ip_gwre_tun:"
    302  1.2.2.2  pgoyette 	str="$str $ip_local > $ip_remote: ICMP6, echo request"
    303  1.2.2.2  pgoyette 	atf_check -s exit:0 -o match:"$str" cat $outfile
    304  1.2.2.2  pgoyette 	str="$ip_gwre_tun > $ip_gwlo_tun:"
    305  1.2.2.2  pgoyette 	str="$str $ip_remote > $ip_local: ICMP6, echo reply,"
    306  1.2.2.2  pgoyette 	atf_check -s exit:0 -o match:"$str" cat $outfile
    307  1.2.2.2  pgoyette 
    308  1.2.2.2  pgoyette 	if [ $mode = tunnel ]; then
    309  1.2.2.2  pgoyette 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    310  1.2.2.2  pgoyette 		# from https://www.netbsd.org/docs/network/ipsec/
    311  1.2.2.2  pgoyette 		cat > $tmpfile <<-EOF
    312  1.2.2.2  pgoyette 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    313  1.2.2.2  pgoyette 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    314  1.2.2.2  pgoyette 		spdadd $subnet_local/64 $subnet_remote/64 any -P out ipsec
    315  1.2.2.2  pgoyette 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    316  1.2.2.2  pgoyette 		spdadd $subnet_remote/64 $subnet_local/64 any -P in ipsec
    317  1.2.2.2  pgoyette 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    318  1.2.2.2  pgoyette 		EOF
    319  1.2.2.2  pgoyette 		$DEBUG && cat $tmpfile
    320  1.2.2.2  pgoyette 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    321  1.2.2.2  pgoyette 
    322  1.2.2.2  pgoyette 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    323  1.2.2.2  pgoyette 		cat > $tmpfile <<-EOF
    324  1.2.2.2  pgoyette 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    325  1.2.2.2  pgoyette 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    326  1.2.2.2  pgoyette 		spdadd $subnet_remote/64 $subnet_local/64 any -P out ipsec
    327  1.2.2.2  pgoyette 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    328  1.2.2.2  pgoyette 		spdadd $subnet_local/64 $subnet_remote/64 any -P in ipsec
    329  1.2.2.2  pgoyette 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    330  1.2.2.2  pgoyette 		EOF
    331  1.2.2.2  pgoyette 		$DEBUG && cat $tmpfile
    332  1.2.2.2  pgoyette 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    333  1.2.2.2  pgoyette 	else # transport mode
    334  1.2.2.2  pgoyette 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    335  1.2.2.2  pgoyette 		# from https://www.netbsd.org/docs/network/ipsec/
    336  1.2.2.2  pgoyette 		cat > $tmpfile <<-EOF
    337  1.2.2.2  pgoyette 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    338  1.2.2.2  pgoyette 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    339  1.2.2.2  pgoyette 		spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P out ipsec
    340  1.2.2.2  pgoyette 		    $proto/transport//require;
    341  1.2.2.2  pgoyette 		spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P in ipsec
    342  1.2.2.2  pgoyette 		    $proto/transport//require;
    343  1.2.2.2  pgoyette 		EOF
    344  1.2.2.2  pgoyette 		$DEBUG && cat $tmpfile
    345  1.2.2.2  pgoyette 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    346  1.2.2.2  pgoyette 
    347  1.2.2.2  pgoyette 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    348  1.2.2.2  pgoyette 		cat > $tmpfile <<-EOF
    349  1.2.2.2  pgoyette 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    350  1.2.2.2  pgoyette 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    351  1.2.2.2  pgoyette 		spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P out ipsec
    352  1.2.2.2  pgoyette 		    $proto/transport//require;
    353  1.2.2.2  pgoyette 		spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P in ipsec
    354  1.2.2.2  pgoyette 		    $proto/transport//require;
    355  1.2.2.2  pgoyette 		EOF
    356  1.2.2.2  pgoyette 		$DEBUG && cat $tmpfile
    357  1.2.2.2  pgoyette 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    358  1.2.2.2  pgoyette 	fi
    359  1.2.2.2  pgoyette 
    360  1.2.2.3  pgoyette 	check_sa_entries $SOCK_TUN_LOCAL $ip_gwlo_tun $ip_gwre_tun
    361  1.2.2.3  pgoyette 	check_sa_entries $SOCK_TUN_REMOTE $ip_gwlo_tun $ip_gwre_tun
    362  1.2.2.2  pgoyette 
    363  1.2.2.2  pgoyette 	export RUMP_SERVER=$SOCK_LOCAL
    364  1.2.2.2  pgoyette 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    365  1.2.2.2  pgoyette 
    366  1.2.2.2  pgoyette 	extract_new_packets $BUS_TUNNEL > $outfile
    367  1.2.2.2  pgoyette 	str=$(make_gif_pktstr $ip_gwlo_tun $ip_gwre_tun \
    368  1.2.2.2  pgoyette 	    $ip_local $ip_remote $proto ipv6)
    369  1.2.2.2  pgoyette 	atf_check -s exit:0 -o match:"$str" cat $outfile
    370  1.2.2.2  pgoyette 	str=$(make_gif_pktstr $ip_gwre_tun $ip_gwlo_tun \
    371  1.2.2.2  pgoyette 	    $ip_remote $ip_local $proto ipv6)
    372  1.2.2.2  pgoyette 	atf_check -s exit:0 -o match:"$str" cat $outfile
    373  1.2.2.3  pgoyette 
    374  1.2.2.3  pgoyette 	test_flush_entries $SOCK_TUN_LOCAL
    375  1.2.2.3  pgoyette 	test_flush_entries $SOCK_TUN_REMOTE
    376  1.2.2.2  pgoyette }
    377  1.2.2.2  pgoyette 
    378  1.2.2.2  pgoyette test_ipsec_gif_common()
    379  1.2.2.2  pgoyette {
    380  1.2.2.2  pgoyette 	local ipproto=$1
    381  1.2.2.2  pgoyette 	local mode=$2
    382  1.2.2.2  pgoyette 	local proto=$3
    383  1.2.2.2  pgoyette 	local algo=$4
    384  1.2.2.2  pgoyette 
    385  1.2.2.2  pgoyette 	if [ $ipproto = ipv4 ]; then
    386  1.2.2.2  pgoyette 		test_ipsec4_gif $mode $proto $algo
    387  1.2.2.2  pgoyette 	else
    388  1.2.2.2  pgoyette 		test_ipsec6_gif $mode $proto $algo
    389  1.2.2.2  pgoyette 	fi
    390  1.2.2.2  pgoyette }
    391  1.2.2.2  pgoyette 
    392  1.2.2.2  pgoyette add_test_ipsec_gif()
    393  1.2.2.2  pgoyette {
    394  1.2.2.2  pgoyette 	local ipproto=$1
    395  1.2.2.2  pgoyette 	local mode=$2
    396  1.2.2.2  pgoyette 	local proto=$3
    397  1.2.2.2  pgoyette 	local algo=$4
    398  1.2.2.2  pgoyette 	local _algo=$(echo $algo | sed 's/-//g')
    399  1.2.2.2  pgoyette 	local name= desc=
    400  1.2.2.2  pgoyette 
    401  1.2.2.2  pgoyette 	name="ipsec_gif_${ipproto}_${mode}_${proto}_${_algo}"
    402  1.2.2.2  pgoyette 	desc="Tests of gif/IPsec ($ipproto) ${mode} mode with $proto ($algo)"
    403  1.2.2.2  pgoyette 
    404  1.2.2.2  pgoyette 	atf_test_case ${name} cleanup
    405  1.2.2.2  pgoyette 	eval "								\
    406  1.2.2.2  pgoyette 	    ${name}_head() {						\
    407  1.2.2.2  pgoyette 	        atf_set \"descr\" \"$desc\";				\
    408  1.2.2.2  pgoyette 	        atf_set \"require.progs\" \"rump_server\" \"setkey\";	\
    409  1.2.2.2  pgoyette 	    };								\
    410  1.2.2.2  pgoyette 	    ${name}_body() {						\
    411  1.2.2.2  pgoyette 	        test_ipsec_gif_common $ipproto $mode $proto $algo;	\
    412  1.2.2.2  pgoyette 	        rump_server_destroy_ifaces;				\
    413  1.2.2.2  pgoyette 	    };								\
    414  1.2.2.2  pgoyette 	    ${name}_cleanup() {						\
    415  1.2.2.2  pgoyette 	        $DEBUG && dump;						\
    416  1.2.2.2  pgoyette 	        cleanup;						\
    417  1.2.2.2  pgoyette 	    }								\
    418  1.2.2.2  pgoyette 	"
    419  1.2.2.2  pgoyette 	atf_add_test_case ${name}
    420  1.2.2.2  pgoyette }
    421  1.2.2.2  pgoyette 
    422  1.2.2.2  pgoyette atf_init_test_cases()
    423  1.2.2.2  pgoyette {
    424  1.2.2.2  pgoyette 	local algo=
    425  1.2.2.2  pgoyette 
    426  1.2.2.2  pgoyette 	for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
    427  1.2.2.2  pgoyette 		add_test_ipsec_gif ipv4 tunnel esp $algo
    428  1.2.2.2  pgoyette 		add_test_ipsec_gif ipv6 tunnel esp $algo
    429  1.2.2.2  pgoyette 		add_test_ipsec_gif ipv4 transport esp $algo
    430  1.2.2.2  pgoyette 		add_test_ipsec_gif ipv6 transport esp $algo
    431  1.2.2.2  pgoyette 	done
    432  1.2.2.2  pgoyette 
    433  1.2.2.2  pgoyette 	for algo in $AH_AUTHENTICATION_ALGORITHMS_MINIMUM; do
    434  1.2.2.2  pgoyette 		add_test_ipsec_gif ipv4 tunnel ah $algo
    435  1.2.2.2  pgoyette 		add_test_ipsec_gif ipv6 tunnel ah $algo
    436  1.2.2.2  pgoyette 		add_test_ipsec_gif ipv4 transport ah $algo
    437  1.2.2.2  pgoyette 		add_test_ipsec_gif ipv6 transport ah $algo
    438  1.2.2.2  pgoyette 	done
    439  1.2.2.2  pgoyette }
    440