Home | History | Annotate | Line # | Download | only in ipsec
t_ipsec_gif.sh revision 1.1 
      1 #	$NetBSD: t_ipsec_gif.sh,v 1.1 2017/04/27 06:52:45 ozaki-r Exp $
      2 #
      3 # Copyright (c) 2017 Internet Initiative Japan Inc.
      4 # All rights reserved.
      5 #
      6 # Redistribution and use in source and binary forms, with or without
      7 # modification, are permitted provided that the following conditions
      8 # are met:
      9 # 1. Redistributions of source code must retain the above copyright
     10 #    notice, this list of conditions and the following disclaimer.
     11 # 2. Redistributions in binary form must reproduce the above copyright
     12 #    notice, this list of conditions and the following disclaimer in the
     13 #    documentation and/or other materials provided with the distribution.
     14 #
     15 # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     16 # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     17 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     18 # PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     19 # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     20 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     21 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     22 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     23 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     24 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     25 # POSSIBILITY OF SUCH DAMAGE.
     26 #
     27 
     28 SOCK_LOCAL=unix://ipsec_gif_local
     29 SOCK_TUN_LOCAL=unix://ipsec_gif_tunel_local
     30 SOCK_TUN_REMOTE=unix://ipsec_gif_tunnel_remote
     31 SOCK_REMOTE=unix://ipsec_gif_remote
     32 BUS_LOCAL=./bus_ipsec_local
     33 BUS_TUNNEL=./bus_ipsec_tunnel
     34 BUS_REMOTE=./bus_ipsec_remote
     35 
     36 DEBUG=${DEBUG:-false}
     37 
     38 make_gif_pktstr()
     39 {
     40 	local src=$1
     41 	local dst=$2
     42 	local src_inner=$3
     43 	local dst_inner=$4
     44 	local proto=$5
     45 	local ipproto=$6
     46 	local proto_cap= inner_str=
     47 
     48 	if [ $proto = esp ]; then
     49 		proto_cap=ESP
     50 	else
     51 		proto_cap=AH
     52 		if [ $ipproto = ipv4 ]; then
     53 			inner_str="$src_inner > $dst_inner:.+\(ipip-proto-4\)"
     54 		else
     55 			inner_str="$src_inner > $dst_inner"
     56 		fi
     57 	fi
     58 
     59 	echo "$src > $dst: $proto_cap.+$inner_str"
     60 }
     61 
     62 test_ipsec4_gif()
     63 {
     64 	local proto=$1
     65 	local algo=$2
     66 	local ip_local=10.0.1.2
     67 	local ip_gw_local=10.0.1.1
     68 	local ip_gw_local_tun=20.0.0.1
     69 	local ip_gw_local_gif=20.1.0.1
     70 	local ip_gw_remote_gif=20.1.0.2
     71 	local ip_gw_remote_tun=20.0.0.2
     72 	local ip_gw_remote=10.0.2.1
     73 	local ip_remote=10.0.2.2
     74 	local subnet_local=10.0.1.0
     75 	local subnet_remote=10.0.2.0
     76 	local keylen=$(get_one_valid_keylen $algo)
     77 	local key=$(generate_key $keylen)
     78 	local tmpfile=./tmp
     79 	local outfile=./out
     80 	local opt= str=
     81 
     82 	if [ $proto = esp ]; then
     83 		opt=-E
     84 	else
     85 		opt=-A
     86 	fi
     87 
     88 	rump_server_crypto_start $SOCK_LOCAL
     89 	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec gif
     90 	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec gif
     91 	rump_server_crypto_start $SOCK_REMOTE
     92 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
     93 	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
     94 	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
     95 	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
     96 	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
     97 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
     98 
     99 	export RUMP_SERVER=$SOCK_LOCAL
    100 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
    101 	atf_check -s exit:0 -o ignore \
    102 	    rump.route -n add -net $subnet_remote $ip_gw_local
    103 
    104 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    105 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_local/24
    106 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gw_local_tun/24
    107 	atf_check -s exit:0 rump.ifconfig gif0 create
    108 	atf_check -s exit:0 rump.ifconfig gif0 \
    109 	    tunnel $ip_gw_local_tun $ip_gw_remote_tun
    110 	atf_check -s exit:0 rump.ifconfig gif0 \
    111 	    inet $ip_gw_local_gif/32 $ip_gw_remote_gif
    112 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1
    113 	atf_check -s exit:0 -o ignore \
    114 	    rump.route -n add -net $subnet_remote $ip_gw_remote_gif
    115 
    116 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    117 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_remote/24
    118 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gw_remote_tun/24
    119 	atf_check -s exit:0 rump.ifconfig gif0 create
    120 	atf_check -s exit:0 rump.ifconfig gif0 \
    121 	    tunnel $ip_gw_remote_tun $ip_gw_local_tun
    122 	atf_check -s exit:0 rump.ifconfig gif0 \
    123 	    inet $ip_gw_remote_gif/32 $ip_gw_local_gif
    124 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1
    125 	atf_check -s exit:0 -o ignore \
    126 	    rump.route -n add -net $subnet_local $ip_gw_local_gif
    127 
    128 	export RUMP_SERVER=$SOCK_REMOTE
    129 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24
    130 	# Run ifconfig -w 10 just once for optimization
    131 	atf_check -s exit:0 rump.ifconfig -w 10
    132 	atf_check -s exit:0 -o ignore \
    133 	    rump.route -n add -net $subnet_local $ip_gw_remote
    134 
    135 	extract_new_packets $BUS_TUNNEL > $outfile
    136 
    137 	export RUMP_SERVER=$SOCK_LOCAL
    138 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    139 
    140 	extract_new_packets $BUS_TUNNEL > $outfile
    141 	str="$ip_gw_local_tun > $ip_gw_remote_tun:"
    142 	str="$str $ip_local > $ip_remote: ICMP echo request,"
    143 	str="$str .+ \(ipip-proto-4\)"
    144 	atf_check -s exit:0 -o match:"$str" cat $outfile
    145 	str="$ip_gw_remote_tun > $ip_gw_local_tun:"
    146 	str="$str $ip_remote > $ip_local: ICMP echo reply,"
    147 	str="$str .+ \(ipip-proto-4\)"
    148 	atf_check -s exit:0 -o match:"$str" cat $outfile
    149 
    150 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    151 	# from https://www.netbsd.org/docs/network/ipsec/
    152 	cat > $tmpfile <<-EOF
    153 	add $ip_gw_local_tun $ip_gw_remote_tun $proto 10000 $opt $algo $key;
    154 	add $ip_gw_remote_tun $ip_gw_local_tun $proto 10001 $opt $algo $key;
    155 	spdadd $subnet_local/24 $subnet_remote/24 any -P out ipsec
    156 	    $proto/tunnel/$ip_gw_local_tun-$ip_gw_remote_tun/require;
    157 	spdadd $subnet_remote/24 $subnet_local/24 any -P in ipsec
    158 	    $proto/tunnel/$ip_gw_remote_tun-$ip_gw_local_tun/require;
    159 	EOF
    160 	$DEBUG && cat $tmpfile
    161 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    162 	$DEBUG && $HIJACKING setkey -D
    163 	atf_check -s exit:0 -o match:"$ip_gw_local_tun $ip_gw_remote_tun" \
    164 	    $HIJACKING setkey -D
    165 	atf_check -s exit:0 -o match:"$ip_gw_remote_tun $ip_gw_local_tun" \
    166 	    $HIJACKING setkey -D
    167 	# TODO: more detail checks
    168 
    169 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    170 	cat > $tmpfile <<-EOF
    171 	add $ip_gw_local_tun $ip_gw_remote_tun $proto 10000 $opt $algo $key;
    172 	add $ip_gw_remote_tun $ip_gw_local_tun $proto 10001 $opt $algo $key;
    173 	spdadd $subnet_remote/24 $subnet_local/24 any -P out ipsec
    174 	    $proto/tunnel/$ip_gw_remote_tun-$ip_gw_local_tun/require;
    175 	spdadd $subnet_local/24 $subnet_remote/24 any -P in ipsec
    176 	    $proto/tunnel/$ip_gw_local_tun-$ip_gw_remote_tun/require;
    177 	EOF
    178 	$DEBUG && cat $tmpfile
    179 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    180 	$DEBUG && $HIJACKING setkey -D
    181 	atf_check -s exit:0 -o match:"$ip_gw_local_tun $ip_gw_remote_tun" \
    182 	    $HIJACKING setkey -D
    183 	atf_check -s exit:0 -o match:"$ip_gw_remote_tun $ip_gw_local_tun" \
    184 	    $HIJACKING setkey -D
    185 	# TODO: more detail checks
    186 
    187 	export RUMP_SERVER=$SOCK_LOCAL
    188 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    189 
    190 	extract_new_packets $BUS_TUNNEL > $outfile
    191 	str=$(make_gif_pktstr $ip_gw_local_tun $ip_gw_remote_tun \
    192 	    $ip_local $ip_remote $proto ipv4)
    193 	atf_check -s exit:0 -o match:"$str" cat $outfile
    194 	str=$(make_gif_pktstr $ip_gw_remote_tun $ip_gw_local_tun \
    195 	    $ip_remote $ip_local $proto ipv4)
    196 	atf_check -s exit:0 -o match:"$str" cat $outfile
    197 }
    198 
    199 test_ipsec6_gif()
    200 {
    201 	local proto=$1
    202 	local algo=$2
    203 	local ip_local=fd00:1::2
    204 	local ip_gw_local=fd00:1::1
    205 	local ip_gw_local_tun=fc00::1
    206 	local ip_gw_local_gif=fc01::1
    207 	local ip_gw_remote_gif=fc01::2
    208 	local ip_gw_remote_tun=fc00::2
    209 	local ip_gw_remote=fd00:2::1
    210 	local ip_remote=fd00:2::2
    211 	local subnet_local=fd00:1::
    212 	local subnet_remote=fd00:2::
    213 	local keylen=$(get_one_valid_keylen $algo)
    214 	local key=$(generate_key $keylen)
    215 	local tmpfile=./tmp
    216 	local outfile=./out
    217 	local opt= str=
    218 
    219 	if [ $proto = esp ]; then
    220 		opt=-E
    221 	else
    222 		opt=-A
    223 	fi
    224 
    225 	rump_server_crypto_start $SOCK_LOCAL netinet6
    226 	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec netinet6 gif
    227 	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec netinet6 gif
    228 	rump_server_crypto_start $SOCK_REMOTE netinet6
    229 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
    230 	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
    231 	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
    232 	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
    233 	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
    234 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
    235 
    236 	export RUMP_SERVER=$SOCK_LOCAL
    237 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local/64
    238 	atf_check -s exit:0 -o ignore \
    239 	    rump.route -n add -inet6 -net $subnet_remote/64 $ip_gw_local
    240 
    241 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    242 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_local/64
    243 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gw_local_tun/64
    244 	atf_check -s exit:0 rump.ifconfig gif0 create
    245 	atf_check -s exit:0 rump.ifconfig gif0 \
    246 	    tunnel $ip_gw_local_tun $ip_gw_remote_tun
    247 	atf_check -s exit:0 rump.ifconfig gif0 \
    248 	    inet6 $ip_gw_local_gif/128 $ip_gw_remote_gif
    249 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1
    250 	atf_check -s exit:0 -o ignore \
    251 	    rump.route -n add -inet6 -net $subnet_remote/64 $ip_gw_local_gif
    252 
    253 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    254 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_remote/64
    255 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gw_remote_tun/64
    256 	atf_check -s exit:0 rump.ifconfig gif0 create
    257 	atf_check -s exit:0 rump.ifconfig gif0 \
    258 	    tunnel $ip_gw_remote_tun $ip_gw_local_tun
    259 	atf_check -s exit:0 rump.ifconfig gif0 \
    260 	    inet6 $ip_gw_remote_gif/128 $ip_gw_local_gif
    261 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1
    262 	atf_check -s exit:0 -o ignore \
    263 	    rump.route -n add -inet6 -net $subnet_local/64 $ip_gw_remote_gif
    264 
    265 	export RUMP_SERVER=$SOCK_REMOTE
    266 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_remote
    267 	# Run ifconfig -w 10 just once for optimization
    268 	atf_check -s exit:0 rump.ifconfig -w 10
    269 	atf_check -s exit:0 -o ignore \
    270 	    rump.route -n add -inet6 -net $subnet_local/64 $ip_gw_remote
    271 
    272 	extract_new_packets $BUS_TUNNEL > $outfile
    273 
    274 	export RUMP_SERVER=$SOCK_LOCAL
    275 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    276 
    277 	extract_new_packets $BUS_TUNNEL > $outfile
    278 	str="$ip_gw_local_tun > $ip_gw_remote_tun:"
    279 	str="$str $ip_local > $ip_remote: ICMP6, echo request"
    280 	atf_check -s exit:0 -o match:"$str" cat $outfile
    281 	str="$ip_gw_remote_tun > $ip_gw_local_tun:"
    282 	str="$str $ip_remote > $ip_local: ICMP6, echo reply,"
    283 	atf_check -s exit:0 -o match:"$str" cat $outfile
    284 
    285 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    286 	# from https://www.netbsd.org/docs/network/ipsec/
    287 	cat > $tmpfile <<-EOF
    288 	add $ip_gw_local_tun $ip_gw_remote_tun $proto 10000 $opt $algo $key;
    289 	add $ip_gw_remote_tun $ip_gw_local_tun $proto 10001 $opt $algo $key;
    290 	spdadd $subnet_local/64 $subnet_remote/64 any -P out ipsec
    291 	    $proto/tunnel/$ip_gw_local_tun-$ip_gw_remote_tun/require;
    292 	spdadd $subnet_remote/64 $subnet_local/64 any -P in ipsec
    293 	    $proto/tunnel/$ip_gw_remote_tun-$ip_gw_local_tun/require;
    294 	EOF
    295 	$DEBUG && cat $tmpfile
    296 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    297 	$DEBUG && $HIJACKING setkey -D
    298 	atf_check -s exit:0 -o match:"$ip_gw_local_tun $ip_gw_remote_tun" \
    299 	    $HIJACKING setkey -D
    300 	atf_check -s exit:0 -o match:"$ip_gw_remote_tun $ip_gw_local_tun" \
    301 	    $HIJACKING setkey -D
    302 	# TODO: more detail checks
    303 
    304 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    305 	cat > $tmpfile <<-EOF
    306 	add $ip_gw_local_tun $ip_gw_remote_tun $proto 10000 $opt $algo $key;
    307 	add $ip_gw_remote_tun $ip_gw_local_tun $proto 10001 $opt $algo $key;
    308 	spdadd $subnet_remote/64 $subnet_local/64 any -P out ipsec
    309 	    $proto/tunnel/$ip_gw_remote_tun-$ip_gw_local_tun/require;
    310 	spdadd $subnet_local/64 $subnet_remote/64 any -P in ipsec
    311 	    $proto/tunnel/$ip_gw_local_tun-$ip_gw_remote_tun/require;
    312 	EOF
    313 	$DEBUG && cat $tmpfile
    314 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    315 	$DEBUG && $HIJACKING setkey -D
    316 	atf_check -s exit:0 -o match:"$ip_gw_local_tun $ip_gw_remote_tun" \
    317 	    $HIJACKING setkey -D
    318 	atf_check -s exit:0 -o match:"$ip_gw_remote_tun $ip_gw_local_tun" \
    319 	    $HIJACKING setkey -D
    320 	# TODO: more detail checks
    321 
    322 	export RUMP_SERVER=$SOCK_LOCAL
    323 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    324 
    325 	extract_new_packets $BUS_TUNNEL > $outfile
    326 	str=$(make_gif_pktstr $ip_gw_local_tun $ip_gw_remote_tun \
    327 	    $ip_local $ip_remote $proto ipv6)
    328 	atf_check -s exit:0 -o match:"$str" cat $outfile
    329 	str=$(make_gif_pktstr $ip_gw_remote_tun $ip_gw_local_tun \
    330 	    $ip_remote $ip_local $proto ipv6)
    331 	atf_check -s exit:0 -o match:"$str" cat $outfile
    332 }
    333 
    334 test_ipsec_gif_common()
    335 {
    336 	local ipproto=$1
    337 	local proto=$2
    338 	local algo=$3
    339 
    340 	if [ $ipproto = ipv4 ]; then
    341 		test_ipsec4_gif $proto $algo
    342 	else
    343 		test_ipsec6_gif $proto $algo
    344 	fi
    345 }
    346 
    347 add_test_ipsec_gif()
    348 {
    349 	local ipproto=$1
    350 	local proto=$2
    351 	local algo=$3
    352 	local _algo=$(echo $algo | sed 's/-//g')
    353 	local name= desc=
    354 
    355 	name="ipsec_gif_${ipproto}_${proto}_${_algo}"
    356 	desc="Tests of IPsec ($ipproto) tunnel mode (gif) with $proto ($algo)"
    357 
    358 	atf_test_case ${name} cleanup
    359 	eval "								\
    360 	    ${name}_head() {						\
    361 	        atf_set \"descr\" \"$desc\";				\
    362 	        atf_set \"require.progs\" \"rump_server\" \"setkey\";	\
    363 	    };								\
    364 	    ${name}_body() {						\
    365 	        test_ipsec_gif_common $ipproto $proto $algo;		\
    366 	        rump_server_destroy_ifaces;				\
    367 	    };								\
    368 	    ${name}_cleanup() {						\
    369 	        $DEBUG && dump;						\
    370 	        cleanup;						\
    371 	    }								\
    372 	"
    373 	atf_add_test_case ${name}
    374 }
    375 
    376 atf_init_test_cases()
    377 {
    378 	local algo=
    379 
    380 	for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
    381 		add_test_ipsec_gif ipv4 esp $algo
    382 		add_test_ipsec_gif ipv6 esp $algo
    383 	done
    384 
    385 	for algo in $AH_AUTHENTICATION_ALGORITHMS_MINIMUM; do
    386 		add_test_ipsec_gif ipv4 ah $algo
    387 		add_test_ipsec_gif ipv6 ah $algo
    388 	done
    389 }
    390