Home | History | Annotate | Line # | Download | only in ipsec
t_ipsec_gif.sh revision 1.2 
      1 #	$NetBSD: t_ipsec_gif.sh,v 1.2 2017/04/27 10:17:12 ozaki-r Exp $
      2 #
      3 # Copyright (c) 2017 Internet Initiative Japan Inc.
      4 # All rights reserved.
      5 #
      6 # Redistribution and use in source and binary forms, with or without
      7 # modification, are permitted provided that the following conditions
      8 # are met:
      9 # 1. Redistributions of source code must retain the above copyright
     10 #    notice, this list of conditions and the following disclaimer.
     11 # 2. Redistributions in binary form must reproduce the above copyright
     12 #    notice, this list of conditions and the following disclaimer in the
     13 #    documentation and/or other materials provided with the distribution.
     14 #
     15 # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     16 # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     17 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     18 # PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     19 # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     20 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     21 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     22 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     23 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     24 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     25 # POSSIBILITY OF SUCH DAMAGE.
     26 #
     27 
     28 SOCK_LOCAL=unix://ipsec_gif_local
     29 SOCK_TUN_LOCAL=unix://ipsec_gif_tunel_local
     30 SOCK_TUN_REMOTE=unix://ipsec_gif_tunnel_remote
     31 SOCK_REMOTE=unix://ipsec_gif_remote
     32 BUS_LOCAL=./bus_ipsec_local
     33 BUS_TUNNEL=./bus_ipsec_tunnel
     34 BUS_REMOTE=./bus_ipsec_remote
     35 
     36 DEBUG=${DEBUG:-false}
     37 
     38 make_gif_pktstr()
     39 {
     40 	local src=$1
     41 	local dst=$2
     42 	local src_inner=$3
     43 	local dst_inner=$4
     44 	local proto=$5
     45 	local ipproto=$6
     46 	local proto_cap= inner_str=
     47 
     48 	if [ $proto = esp ]; then
     49 		proto_cap=ESP
     50 	else
     51 		proto_cap=AH
     52 		if [ $ipproto = ipv4 ]; then
     53 			inner_str="$src_inner > $dst_inner:.+\(ipip-proto-4\)"
     54 		else
     55 			inner_str="$src_inner > $dst_inner"
     56 		fi
     57 	fi
     58 
     59 	echo "$src > $dst: $proto_cap.+$inner_str"
     60 }
     61 
     62 test_ipsec4_gif()
     63 {
     64 	local mode=$1
     65 	local proto=$2
     66 	local algo=$3
     67 	local ip_local=10.0.1.2
     68 	local ip_gw_local=10.0.1.1
     69 	local ip_gwlo_tun=20.0.0.1
     70 	local ip_gwlo_gif=20.1.0.1
     71 	local ip_gwre_gif=20.1.0.2
     72 	local ip_gwre_tun=20.0.0.2
     73 	local ip_gw_remote=10.0.2.1
     74 	local ip_remote=10.0.2.2
     75 	local subnet_local=10.0.1.0
     76 	local subnet_remote=10.0.2.0
     77 	local keylen=$(get_one_valid_keylen $algo)
     78 	local key=$(generate_key $keylen)
     79 	local tmpfile=./tmp
     80 	local outfile=./out
     81 	local opt= str=
     82 
     83 	if [ $proto = esp ]; then
     84 		opt=-E
     85 	else
     86 		opt=-A
     87 	fi
     88 
     89 	rump_server_crypto_start $SOCK_LOCAL
     90 	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec gif
     91 	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec gif
     92 	rump_server_crypto_start $SOCK_REMOTE
     93 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
     94 	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
     95 	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
     96 	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
     97 	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
     98 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
     99 
    100 	export RUMP_SERVER=$SOCK_LOCAL
    101 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
    102 	atf_check -s exit:0 -o ignore \
    103 	    rump.route -n add -net $subnet_remote $ip_gw_local
    104 
    105 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    106 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_local/24
    107 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwlo_tun/24
    108 	atf_check -s exit:0 rump.ifconfig gif0 create
    109 	atf_check -s exit:0 rump.ifconfig gif0 \
    110 	    tunnel $ip_gwlo_tun $ip_gwre_tun
    111 	atf_check -s exit:0 rump.ifconfig gif0 \
    112 	    inet $ip_gwlo_gif/32 $ip_gwre_gif
    113 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1
    114 	atf_check -s exit:0 -o ignore \
    115 	    rump.route -n add -net $subnet_remote $ip_gwre_gif
    116 
    117 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    118 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_remote/24
    119 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwre_tun/24
    120 	atf_check -s exit:0 rump.ifconfig gif0 create
    121 	atf_check -s exit:0 rump.ifconfig gif0 \
    122 	    tunnel $ip_gwre_tun $ip_gwlo_tun
    123 	atf_check -s exit:0 rump.ifconfig gif0 \
    124 	    inet $ip_gwre_gif/32 $ip_gwlo_gif
    125 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1
    126 	atf_check -s exit:0 -o ignore \
    127 	    rump.route -n add -net $subnet_local $ip_gwlo_gif
    128 
    129 	export RUMP_SERVER=$SOCK_REMOTE
    130 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24
    131 	# Run ifconfig -w 10 just once for optimization
    132 	atf_check -s exit:0 rump.ifconfig -w 10
    133 	atf_check -s exit:0 -o ignore \
    134 	    rump.route -n add -net $subnet_local $ip_gw_remote
    135 
    136 	extract_new_packets $BUS_TUNNEL > $outfile
    137 
    138 	export RUMP_SERVER=$SOCK_LOCAL
    139 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    140 
    141 	extract_new_packets $BUS_TUNNEL > $outfile
    142 	str="$ip_gwlo_tun > $ip_gwre_tun:"
    143 	str="$str $ip_local > $ip_remote: ICMP echo request,"
    144 	str="$str .+ \(ipip-proto-4\)"
    145 	atf_check -s exit:0 -o match:"$str" cat $outfile
    146 	str="$ip_gwre_tun > $ip_gwlo_tun:"
    147 	str="$str $ip_remote > $ip_local: ICMP echo reply,"
    148 	str="$str .+ \(ipip-proto-4\)"
    149 	atf_check -s exit:0 -o match:"$str" cat $outfile
    150 
    151 	if [ $mode = tunnel ]; then
    152 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    153 		# from https://www.netbsd.org/docs/network/ipsec/
    154 		cat > $tmpfile <<-EOF
    155 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    156 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    157 		spdadd $subnet_local/24 $subnet_remote/24 any -P out ipsec
    158 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    159 		spdadd $subnet_remote/24 $subnet_local/24 any -P in ipsec
    160 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    161 		EOF
    162 		$DEBUG && cat $tmpfile
    163 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    164 		$DEBUG && $HIJACKING setkey -D
    165 		atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    166 		    $HIJACKING setkey -D
    167 		atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    168 		    $HIJACKING setkey -D
    169 		# TODO: more detail checks
    170 
    171 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    172 		cat > $tmpfile <<-EOF
    173 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    174 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    175 		spdadd $subnet_remote/24 $subnet_local/24 any -P out ipsec
    176 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    177 		spdadd $subnet_local/24 $subnet_remote/24 any -P in ipsec
    178 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    179 		EOF
    180 		$DEBUG && cat $tmpfile
    181 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    182 		$DEBUG && $HIJACKING setkey -D
    183 		atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    184 		    $HIJACKING setkey -D
    185 		atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    186 		    $HIJACKING setkey -D
    187 		# TODO: more detail checks
    188 	else # transport mode
    189 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    190 		# from https://www.netbsd.org/docs/network/ipsec/
    191 		cat > $tmpfile <<-EOF
    192 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    193 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    194 		spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P out ipsec
    195 		    $proto/transport//require;
    196 		spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P in ipsec
    197 		    $proto/transport//require;
    198 		EOF
    199 		$DEBUG && cat $tmpfile
    200 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    201 		$DEBUG && $HIJACKING setkey -D
    202 		atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    203 		    $HIJACKING setkey -D
    204 		atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    205 		    $HIJACKING setkey -D
    206 		# TODO: more detail checks
    207 
    208 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    209 		cat > $tmpfile <<-EOF
    210 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    211 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    212 		spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P out ipsec
    213 		    $proto/transport//require;
    214 		spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P in ipsec
    215 		    $proto/transport//require;
    216 		EOF
    217 		$DEBUG && cat $tmpfile
    218 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    219 		$DEBUG && $HIJACKING setkey -D
    220 		atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    221 		    $HIJACKING setkey -D
    222 		atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    223 		    $HIJACKING setkey -D
    224 		# TODO: more detail checks
    225 	fi
    226 
    227 	export RUMP_SERVER=$SOCK_LOCAL
    228 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    229 
    230 	extract_new_packets $BUS_TUNNEL > $outfile
    231 	str=$(make_gif_pktstr $ip_gwlo_tun $ip_gwre_tun \
    232 	    $ip_local $ip_remote $proto ipv4)
    233 	atf_check -s exit:0 -o match:"$str" cat $outfile
    234 	str=$(make_gif_pktstr $ip_gwre_tun $ip_gwlo_tun \
    235 	    $ip_remote $ip_local $proto ipv4)
    236 	atf_check -s exit:0 -o match:"$str" cat $outfile
    237 }
    238 
    239 test_ipsec6_gif()
    240 {
    241 	local mode=$1
    242 	local proto=$2
    243 	local algo=$3
    244 	local ip_local=fd00:1::2
    245 	local ip_gw_local=fd00:1::1
    246 	local ip_gwlo_tun=fc00::1
    247 	local ip_gwlo_gif=fc01::1
    248 	local ip_gwre_gif=fc01::2
    249 	local ip_gwre_tun=fc00::2
    250 	local ip_gw_remote=fd00:2::1
    251 	local ip_remote=fd00:2::2
    252 	local subnet_local=fd00:1::
    253 	local subnet_remote=fd00:2::
    254 	local keylen=$(get_one_valid_keylen $algo)
    255 	local key=$(generate_key $keylen)
    256 	local tmpfile=./tmp
    257 	local outfile=./out
    258 	local opt= str=
    259 
    260 	if [ $proto = esp ]; then
    261 		opt=-E
    262 	else
    263 		opt=-A
    264 	fi
    265 
    266 	rump_server_crypto_start $SOCK_LOCAL netinet6
    267 	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec netinet6 gif
    268 	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec netinet6 gif
    269 	rump_server_crypto_start $SOCK_REMOTE netinet6
    270 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
    271 	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
    272 	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
    273 	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
    274 	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
    275 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
    276 
    277 	export RUMP_SERVER=$SOCK_LOCAL
    278 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local/64
    279 	atf_check -s exit:0 -o ignore \
    280 	    rump.route -n add -inet6 -net $subnet_remote/64 $ip_gw_local
    281 
    282 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    283 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_local/64
    284 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwlo_tun/64
    285 	atf_check -s exit:0 rump.ifconfig gif0 create
    286 	atf_check -s exit:0 rump.ifconfig gif0 \
    287 	    tunnel $ip_gwlo_tun $ip_gwre_tun
    288 	atf_check -s exit:0 rump.ifconfig gif0 \
    289 	    inet6 $ip_gwlo_gif/128 $ip_gwre_gif
    290 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1
    291 	atf_check -s exit:0 -o ignore \
    292 	    rump.route -n add -inet6 -net $subnet_remote/64 $ip_gwlo_gif
    293 
    294 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    295 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_remote/64
    296 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwre_tun/64
    297 	atf_check -s exit:0 rump.ifconfig gif0 create
    298 	atf_check -s exit:0 rump.ifconfig gif0 \
    299 	    tunnel $ip_gwre_tun $ip_gwlo_tun
    300 	atf_check -s exit:0 rump.ifconfig gif0 \
    301 	    inet6 $ip_gwre_gif/128 $ip_gwlo_gif
    302 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1
    303 	atf_check -s exit:0 -o ignore \
    304 	    rump.route -n add -inet6 -net $subnet_local/64 $ip_gwre_gif
    305 
    306 	export RUMP_SERVER=$SOCK_REMOTE
    307 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_remote
    308 	# Run ifconfig -w 10 just once for optimization
    309 	atf_check -s exit:0 rump.ifconfig -w 10
    310 	atf_check -s exit:0 -o ignore \
    311 	    rump.route -n add -inet6 -net $subnet_local/64 $ip_gw_remote
    312 
    313 	extract_new_packets $BUS_TUNNEL > $outfile
    314 
    315 	export RUMP_SERVER=$SOCK_LOCAL
    316 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    317 
    318 	extract_new_packets $BUS_TUNNEL > $outfile
    319 	str="$ip_gwlo_tun > $ip_gwre_tun:"
    320 	str="$str $ip_local > $ip_remote: ICMP6, echo request"
    321 	atf_check -s exit:0 -o match:"$str" cat $outfile
    322 	str="$ip_gwre_tun > $ip_gwlo_tun:"
    323 	str="$str $ip_remote > $ip_local: ICMP6, echo reply,"
    324 	atf_check -s exit:0 -o match:"$str" cat $outfile
    325 
    326 	if [ $mode = tunnel ]; then
    327 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    328 		# from https://www.netbsd.org/docs/network/ipsec/
    329 		cat > $tmpfile <<-EOF
    330 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    331 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    332 		spdadd $subnet_local/64 $subnet_remote/64 any -P out ipsec
    333 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    334 		spdadd $subnet_remote/64 $subnet_local/64 any -P in ipsec
    335 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    336 		EOF
    337 		$DEBUG && cat $tmpfile
    338 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    339 
    340 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    341 		cat > $tmpfile <<-EOF
    342 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    343 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    344 		spdadd $subnet_remote/64 $subnet_local/64 any -P out ipsec
    345 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    346 		spdadd $subnet_local/64 $subnet_remote/64 any -P in ipsec
    347 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    348 		EOF
    349 		$DEBUG && cat $tmpfile
    350 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    351 	else # transport mode
    352 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    353 		# from https://www.netbsd.org/docs/network/ipsec/
    354 		cat > $tmpfile <<-EOF
    355 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    356 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    357 		spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P out ipsec
    358 		    $proto/transport//require;
    359 		spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P in ipsec
    360 		    $proto/transport//require;
    361 		EOF
    362 		$DEBUG && cat $tmpfile
    363 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    364 
    365 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    366 		cat > $tmpfile <<-EOF
    367 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    368 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    369 		spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P out ipsec
    370 		    $proto/transport//require;
    371 		spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P in ipsec
    372 		    $proto/transport//require;
    373 		EOF
    374 		$DEBUG && cat $tmpfile
    375 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    376 	fi
    377 
    378 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    379 	$DEBUG && $HIJACKING setkey -D
    380 	atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    381 	    $HIJACKING setkey -D
    382 	atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    383 	    $HIJACKING setkey -D
    384 	# TODO: more detail checks
    385 
    386 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    387 	$DEBUG && $HIJACKING setkey -D
    388 	atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    389 	    $HIJACKING setkey -D
    390 	atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    391 	    $HIJACKING setkey -D
    392 	# TODO: more detail checks
    393 
    394 	export RUMP_SERVER=$SOCK_LOCAL
    395 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    396 
    397 	extract_new_packets $BUS_TUNNEL > $outfile
    398 	str=$(make_gif_pktstr $ip_gwlo_tun $ip_gwre_tun \
    399 	    $ip_local $ip_remote $proto ipv6)
    400 	atf_check -s exit:0 -o match:"$str" cat $outfile
    401 	str=$(make_gif_pktstr $ip_gwre_tun $ip_gwlo_tun \
    402 	    $ip_remote $ip_local $proto ipv6)
    403 	atf_check -s exit:0 -o match:"$str" cat $outfile
    404 }
    405 
    406 test_ipsec_gif_common()
    407 {
    408 	local ipproto=$1
    409 	local mode=$2
    410 	local proto=$3
    411 	local algo=$4
    412 
    413 	if [ $ipproto = ipv4 ]; then
    414 		test_ipsec4_gif $mode $proto $algo
    415 	else
    416 		test_ipsec6_gif $mode $proto $algo
    417 	fi
    418 }
    419 
    420 add_test_ipsec_gif()
    421 {
    422 	local ipproto=$1
    423 	local mode=$2
    424 	local proto=$3
    425 	local algo=$4
    426 	local _algo=$(echo $algo | sed 's/-//g')
    427 	local name= desc=
    428 
    429 	name="ipsec_gif_${ipproto}_${mode}_${proto}_${_algo}"
    430 	desc="Tests of gif/IPsec ($ipproto) ${mode} mode with $proto ($algo)"
    431 
    432 	atf_test_case ${name} cleanup
    433 	eval "								\
    434 	    ${name}_head() {						\
    435 	        atf_set \"descr\" \"$desc\";				\
    436 	        atf_set \"require.progs\" \"rump_server\" \"setkey\";	\
    437 	    };								\
    438 	    ${name}_body() {						\
    439 	        test_ipsec_gif_common $ipproto $mode $proto $algo;	\
    440 	        rump_server_destroy_ifaces;				\
    441 	    };								\
    442 	    ${name}_cleanup() {						\
    443 	        $DEBUG && dump;						\
    444 	        cleanup;						\
    445 	    }								\
    446 	"
    447 	atf_add_test_case ${name}
    448 }
    449 
    450 atf_init_test_cases()
    451 {
    452 	local algo=
    453 
    454 	for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
    455 		add_test_ipsec_gif ipv4 tunnel esp $algo
    456 		add_test_ipsec_gif ipv6 tunnel esp $algo
    457 		add_test_ipsec_gif ipv4 transport esp $algo
    458 		add_test_ipsec_gif ipv6 transport esp $algo
    459 	done
    460 
    461 	for algo in $AH_AUTHENTICATION_ALGORITHMS_MINIMUM; do
    462 		add_test_ipsec_gif ipv4 tunnel ah $algo
    463 		add_test_ipsec_gif ipv6 tunnel ah $algo
    464 		add_test_ipsec_gif ipv4 transport ah $algo
    465 		add_test_ipsec_gif ipv6 transport ah $algo
    466 	done
    467 }
    468