t_ipsec_l2tp.sh revision 1.2.2.2
1 1.2.2.2 pgoyette # $NetBSD: t_ipsec_l2tp.sh,v 1.2.2.2 2017/05/02 03:19:23 pgoyette Exp $ 2 1.2.2.2 pgoyette # 3 1.2.2.2 pgoyette # Copyright (c) 2017 Internet Initiative Japan Inc. 4 1.2.2.2 pgoyette # All rights reserved. 5 1.2.2.2 pgoyette # 6 1.2.2.2 pgoyette # Redistribution and use in source and binary forms, with or without 7 1.2.2.2 pgoyette # modification, are permitted provided that the following conditions 8 1.2.2.2 pgoyette # are met: 9 1.2.2.2 pgoyette # 1. Redistributions of source code must retain the above copyright 10 1.2.2.2 pgoyette # notice, this list of conditions and the following disclaimer. 11 1.2.2.2 pgoyette # 2. Redistributions in binary form must reproduce the above copyright 12 1.2.2.2 pgoyette # notice, this list of conditions and the following disclaimer in the 13 1.2.2.2 pgoyette # documentation and/or other materials provided with the distribution. 14 1.2.2.2 pgoyette # 15 1.2.2.2 pgoyette # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 16 1.2.2.2 pgoyette # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 17 1.2.2.2 pgoyette # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 18 1.2.2.2 pgoyette # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 19 1.2.2.2 pgoyette # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 1.2.2.2 pgoyette # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 1.2.2.2 pgoyette # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 1.2.2.2 pgoyette # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 1.2.2.2 pgoyette # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 1.2.2.2 pgoyette # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 1.2.2.2 pgoyette # POSSIBILITY OF SUCH DAMAGE. 26 1.2.2.2 pgoyette # 27 1.2.2.2 pgoyette 28 1.2.2.2 pgoyette SOCK_LOCAL=unix://ipsec_l2tp_local 29 1.2.2.2 pgoyette SOCK_TUN_LOCAL=unix://ipsec_l2tp_tunel_local 30 1.2.2.2 pgoyette SOCK_TUN_REMOTE=unix://ipsec_l2tp_tunnel_remote 31 1.2.2.2 pgoyette SOCK_REMOTE=unix://ipsec_l2tp_remote 32 1.2.2.2 pgoyette BUS_LOCAL=./bus_ipsec_local 33 1.2.2.2 pgoyette BUS_TUNNEL=./bus_ipsec_tunnel 34 1.2.2.2 pgoyette BUS_REMOTE=./bus_ipsec_remote 35 1.2.2.2 pgoyette 36 1.2.2.2 pgoyette DEBUG=${DEBUG:-false} 37 1.2.2.2 pgoyette 38 1.2.2.2 pgoyette make_l2tp_pktstr() 39 1.2.2.2 pgoyette { 40 1.2.2.2 pgoyette local src=$1 41 1.2.2.2 pgoyette local dst=$2 42 1.2.2.2 pgoyette local proto=$3 43 1.2.2.2 pgoyette local ipproto=$4 44 1.2.2.2 pgoyette local mode=$5 45 1.2.2.2 pgoyette local proto_cap= proto_str= 46 1.2.2.2 pgoyette 47 1.2.2.2 pgoyette if [ $proto = esp ]; then 48 1.2.2.2 pgoyette proto_cap=ESP 49 1.2.2.2 pgoyette else 50 1.2.2.2 pgoyette proto_cap=AH 51 1.2.2.2 pgoyette if [ $ipproto = ipv4 ]; then 52 1.2.2.2 pgoyette if [ $mode = tunnel ]; then 53 1.2.2.2 pgoyette proto_str="ip-proto-115 102 \(ipip-proto-4\)" 54 1.2.2.2 pgoyette else 55 1.2.2.2 pgoyette proto_str="ip-proto-115 102" 56 1.2.2.2 pgoyette fi 57 1.2.2.2 pgoyette else 58 1.2.2.2 pgoyette proto_str="ip-proto-115" 59 1.2.2.2 pgoyette fi 60 1.2.2.2 pgoyette fi 61 1.2.2.2 pgoyette 62 1.2.2.2 pgoyette echo "$src > $dst: $proto_cap.+$proto_str" 63 1.2.2.2 pgoyette } 64 1.2.2.2 pgoyette 65 1.2.2.2 pgoyette test_ipsec4_l2tp() 66 1.2.2.2 pgoyette { 67 1.2.2.2 pgoyette local mode=$1 68 1.2.2.2 pgoyette local proto=$2 69 1.2.2.2 pgoyette local algo=$3 70 1.2.2.2 pgoyette local ip_local=10.0.0.1 71 1.2.2.2 pgoyette local ip_gwlo_tun=20.0.0.1 72 1.2.2.2 pgoyette local ip_gwre_tun=20.0.0.2 73 1.2.2.2 pgoyette local ip_remote=10.0.0.2 74 1.2.2.2 pgoyette local subnet_local=20.0.0.0 75 1.2.2.2 pgoyette local subnet_remote=20.0.0.0 76 1.2.2.2 pgoyette local keylen=$(get_one_valid_keylen $algo) 77 1.2.2.2 pgoyette local key=$(generate_key $keylen) 78 1.2.2.2 pgoyette local tmpfile=./tmp 79 1.2.2.2 pgoyette local outfile=./out 80 1.2.2.2 pgoyette local opt= str= 81 1.2.2.2 pgoyette 82 1.2.2.2 pgoyette if [ $proto = esp ]; then 83 1.2.2.2 pgoyette opt=-E 84 1.2.2.2 pgoyette else 85 1.2.2.2 pgoyette opt=-A 86 1.2.2.2 pgoyette fi 87 1.2.2.2 pgoyette 88 1.2.2.2 pgoyette # See https://www.netbsd.org/docs/network/ipsec/#sample_vpn 89 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_LOCAL 90 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_TUN_LOCAL netipsec l2tp bridge 91 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_TUN_REMOTE netipsec l2tp bridge 92 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_REMOTE 93 1.2.2.2 pgoyette rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL 94 1.2.2.2 pgoyette rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL 95 1.2.2.2 pgoyette rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL 96 1.2.2.2 pgoyette rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE 97 1.2.2.2 pgoyette rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL 98 1.2.2.2 pgoyette rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE 99 1.2.2.2 pgoyette 100 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 101 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24 102 1.2.2.2 pgoyette 103 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_LOCAL 104 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 up 105 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwlo_tun/24 106 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 create 107 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 \ 108 1.2.2.2 pgoyette tunnel $ip_gwlo_tun $ip_gwre_tun 109 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 session 1234 4321 110 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 up 111 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig bridge0 create 112 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig bridge0 up 113 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0 114 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0 115 1.2.2.2 pgoyette 116 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_REMOTE 117 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 up 118 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwre_tun/24 119 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 create 120 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 \ 121 1.2.2.2 pgoyette tunnel $ip_gwre_tun $ip_gwlo_tun 122 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 session 4321 1234 123 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 up 124 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig bridge0 create 125 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig bridge0 up 126 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0 127 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0 128 1.2.2.2 pgoyette 129 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_REMOTE 130 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24 131 1.2.2.2 pgoyette # Run ifconfig -w 10 just once for optimization 132 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig -w 10 133 1.2.2.2 pgoyette 134 1.2.2.2 pgoyette extract_new_packets $BUS_TUNNEL > $outfile 135 1.2.2.2 pgoyette 136 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 137 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote 138 1.2.2.2 pgoyette 139 1.2.2.2 pgoyette extract_new_packets $BUS_TUNNEL > $outfile 140 1.2.2.2 pgoyette atf_check -s exit:0 \ 141 1.2.2.2 pgoyette -o match:"$ip_gwlo_tun > $ip_gwre_tun: +ip-proto-115" \ 142 1.2.2.2 pgoyette cat $outfile 143 1.2.2.2 pgoyette atf_check -s exit:0 \ 144 1.2.2.2 pgoyette -o match:"$ip_gwre_tun > $ip_gwlo_tun: +ip-proto-115" \ 145 1.2.2.2 pgoyette cat $outfile 146 1.2.2.2 pgoyette 147 1.2.2.2 pgoyette if [ $mode = tunnel ]; then 148 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_LOCAL 149 1.2.2.2 pgoyette # from https://www.netbsd.org/docs/network/ipsec/ 150 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 151 1.2.2.2 pgoyette add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key; 152 1.2.2.2 pgoyette add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key; 153 1.2.2.2 pgoyette spdadd $subnet_local/24 $subnet_remote/24 any -P out ipsec 154 1.2.2.2 pgoyette $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require; 155 1.2.2.2 pgoyette spdadd $subnet_remote/24 $subnet_local/24 any -P in ipsec 156 1.2.2.2 pgoyette $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require; 157 1.2.2.2 pgoyette EOF 158 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 159 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 160 1.2.2.2 pgoyette 161 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_REMOTE 162 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 163 1.2.2.2 pgoyette add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key; 164 1.2.2.2 pgoyette add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key; 165 1.2.2.2 pgoyette spdadd $subnet_remote/24 $subnet_local/24 any -P out ipsec 166 1.2.2.2 pgoyette $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require; 167 1.2.2.2 pgoyette spdadd $subnet_local/24 $subnet_remote/24 any -P in ipsec 168 1.2.2.2 pgoyette $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require; 169 1.2.2.2 pgoyette EOF 170 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 171 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 172 1.2.2.2 pgoyette else # transport mode 173 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_LOCAL 174 1.2.2.2 pgoyette # from https://www.netbsd.org/docs/network/ipsec/ 175 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 176 1.2.2.2 pgoyette add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key; 177 1.2.2.2 pgoyette add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key; 178 1.2.2.2 pgoyette spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P out ipsec 179 1.2.2.2 pgoyette $proto/transport//require; 180 1.2.2.2 pgoyette spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P in ipsec 181 1.2.2.2 pgoyette $proto/transport//require; 182 1.2.2.2 pgoyette EOF 183 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 184 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 185 1.2.2.2 pgoyette 186 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_REMOTE 187 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 188 1.2.2.2 pgoyette add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key; 189 1.2.2.2 pgoyette add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key; 190 1.2.2.2 pgoyette spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P out ipsec 191 1.2.2.2 pgoyette $proto/transport//require; 192 1.2.2.2 pgoyette spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P in ipsec 193 1.2.2.2 pgoyette $proto/transport//require; 194 1.2.2.2 pgoyette EOF 195 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 196 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 197 1.2.2.2 pgoyette fi 198 1.2.2.2 pgoyette 199 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_LOCAL 200 1.2.2.2 pgoyette $DEBUG && $HIJACKING setkey -D 201 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \ 202 1.2.2.2 pgoyette $HIJACKING setkey -D 203 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \ 204 1.2.2.2 pgoyette $HIJACKING setkey -D 205 1.2.2.2 pgoyette # TODO: more detail checks 206 1.2.2.2 pgoyette 207 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_REMOTE 208 1.2.2.2 pgoyette $DEBUG && $HIJACKING setkey -D 209 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \ 210 1.2.2.2 pgoyette $HIJACKING setkey -D 211 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \ 212 1.2.2.2 pgoyette $HIJACKING setkey -D 213 1.2.2.2 pgoyette # TODO: more detail checks 214 1.2.2.2 pgoyette 215 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 216 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote 217 1.2.2.2 pgoyette 218 1.2.2.2 pgoyette extract_new_packets $BUS_TUNNEL > $outfile 219 1.2.2.2 pgoyette str=$(make_l2tp_pktstr $ip_gwlo_tun $ip_gwre_tun $proto ipv4 $mode) 220 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$str" cat $outfile 221 1.2.2.2 pgoyette str=$(make_l2tp_pktstr $ip_gwre_tun $ip_gwlo_tun $proto ipv4 $mode) 222 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$str" cat $outfile 223 1.2.2.2 pgoyette } 224 1.2.2.2 pgoyette 225 1.2.2.2 pgoyette test_ipsec6_l2tp() 226 1.2.2.2 pgoyette { 227 1.2.2.2 pgoyette local mode=$1 228 1.2.2.2 pgoyette local proto=$2 229 1.2.2.2 pgoyette local algo=$3 230 1.2.2.2 pgoyette local ip_local=fd00::1 231 1.2.2.2 pgoyette local ip_gwlo_tun=fc00::1 232 1.2.2.2 pgoyette local ip_gwre_tun=fc00::2 233 1.2.2.2 pgoyette local ip_remote=fd00::2 234 1.2.2.2 pgoyette local subnet_local=fc00:: 235 1.2.2.2 pgoyette local subnet_remote=fc00:: 236 1.2.2.2 pgoyette local keylen=$(get_one_valid_keylen $algo) 237 1.2.2.2 pgoyette local key=$(generate_key $keylen) 238 1.2.2.2 pgoyette local tmpfile=./tmp 239 1.2.2.2 pgoyette local outfile=./out 240 1.2.2.2 pgoyette local opt= str= 241 1.2.2.2 pgoyette 242 1.2.2.2 pgoyette if [ $proto = esp ]; then 243 1.2.2.2 pgoyette opt=-E 244 1.2.2.2 pgoyette else 245 1.2.2.2 pgoyette opt=-A 246 1.2.2.2 pgoyette fi 247 1.2.2.2 pgoyette 248 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_LOCAL netinet6 249 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_TUN_LOCAL netipsec netinet6 l2tp bridge 250 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_TUN_REMOTE netipsec netinet6 l2tp bridge 251 1.2.2.2 pgoyette rump_server_crypto_start $SOCK_REMOTE netinet6 252 1.2.2.2 pgoyette rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL 253 1.2.2.2 pgoyette rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL 254 1.2.2.2 pgoyette rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL 255 1.2.2.2 pgoyette rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE 256 1.2.2.2 pgoyette rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL 257 1.2.2.2 pgoyette rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE 258 1.2.2.2 pgoyette 259 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 260 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local/64 261 1.2.2.2 pgoyette 262 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_LOCAL 263 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 up 264 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwlo_tun/64 265 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 create 266 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 \ 267 1.2.2.2 pgoyette tunnel $ip_gwlo_tun $ip_gwre_tun 268 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 session 1234 4321 269 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 up 270 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig bridge0 create 271 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig bridge0 up 272 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0 273 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0 274 1.2.2.2 pgoyette 275 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_REMOTE 276 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 up 277 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwre_tun/64 278 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 create 279 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 \ 280 1.2.2.2 pgoyette tunnel $ip_gwre_tun $ip_gwlo_tun 281 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 session 4321 1234 282 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig l2tp0 up 283 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig bridge0 create 284 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig bridge0 up 285 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0 286 1.2.2.2 pgoyette atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0 287 1.2.2.2 pgoyette 288 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_REMOTE 289 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_remote 290 1.2.2.2 pgoyette # Run ifconfig -w 10 just once for optimization 291 1.2.2.2 pgoyette atf_check -s exit:0 rump.ifconfig -w 10 292 1.2.2.2 pgoyette 293 1.2.2.2 pgoyette extract_new_packets $BUS_TUNNEL > $outfile 294 1.2.2.2 pgoyette 295 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 296 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote 297 1.2.2.2 pgoyette 298 1.2.2.2 pgoyette extract_new_packets $BUS_TUNNEL > $outfile 299 1.2.2.2 pgoyette atf_check -s exit:0 \ 300 1.2.2.2 pgoyette -o match:"$ip_gwlo_tun > $ip_gwre_tun: +ip-proto-115" \ 301 1.2.2.2 pgoyette cat $outfile 302 1.2.2.2 pgoyette atf_check -s exit:0 \ 303 1.2.2.2 pgoyette -o match:"$ip_gwre_tun > $ip_gwlo_tun: +ip-proto-115" \ 304 1.2.2.2 pgoyette cat $outfile 305 1.2.2.2 pgoyette 306 1.2.2.2 pgoyette if [ $mode = tunnel ]; then 307 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_LOCAL 308 1.2.2.2 pgoyette # from https://www.netbsd.org/docs/network/ipsec/ 309 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 310 1.2.2.2 pgoyette add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key; 311 1.2.2.2 pgoyette add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key; 312 1.2.2.2 pgoyette spdadd $subnet_local/64 $subnet_remote/64 any -P out ipsec 313 1.2.2.2 pgoyette $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require; 314 1.2.2.2 pgoyette spdadd $subnet_remote/64 $subnet_local/64 any -P in ipsec 315 1.2.2.2 pgoyette $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require; 316 1.2.2.2 pgoyette EOF 317 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 318 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 319 1.2.2.2 pgoyette $DEBUG && $HIJACKING setkey -D 320 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \ 321 1.2.2.2 pgoyette $HIJACKING setkey -D 322 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \ 323 1.2.2.2 pgoyette $HIJACKING setkey -D 324 1.2.2.2 pgoyette # TODO: more detail checks 325 1.2.2.2 pgoyette 326 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_REMOTE 327 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 328 1.2.2.2 pgoyette add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key; 329 1.2.2.2 pgoyette add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key; 330 1.2.2.2 pgoyette spdadd $subnet_remote/64 $subnet_local/64 any -P out ipsec 331 1.2.2.2 pgoyette $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require; 332 1.2.2.2 pgoyette spdadd $subnet_local/64 $subnet_remote/64 any -P in ipsec 333 1.2.2.2 pgoyette $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require; 334 1.2.2.2 pgoyette EOF 335 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 336 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 337 1.2.2.2 pgoyette $DEBUG && $HIJACKING setkey -D 338 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \ 339 1.2.2.2 pgoyette $HIJACKING setkey -D 340 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \ 341 1.2.2.2 pgoyette $HIJACKING setkey -D 342 1.2.2.2 pgoyette # TODO: more detail checks 343 1.2.2.2 pgoyette else # transport mode 344 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_LOCAL 345 1.2.2.2 pgoyette # from https://www.netbsd.org/docs/network/ipsec/ 346 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 347 1.2.2.2 pgoyette add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key; 348 1.2.2.2 pgoyette add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key; 349 1.2.2.2 pgoyette spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P out ipsec 350 1.2.2.2 pgoyette $proto/transport//require; 351 1.2.2.2 pgoyette spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P in ipsec 352 1.2.2.2 pgoyette $proto/transport//require; 353 1.2.2.2 pgoyette EOF 354 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 355 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 356 1.2.2.2 pgoyette $DEBUG && $HIJACKING setkey -D 357 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \ 358 1.2.2.2 pgoyette $HIJACKING setkey -D 359 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \ 360 1.2.2.2 pgoyette $HIJACKING setkey -D 361 1.2.2.2 pgoyette # TODO: more detail checks 362 1.2.2.2 pgoyette 363 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_TUN_REMOTE 364 1.2.2.2 pgoyette cat > $tmpfile <<-EOF 365 1.2.2.2 pgoyette add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key; 366 1.2.2.2 pgoyette add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key; 367 1.2.2.2 pgoyette spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P out ipsec 368 1.2.2.2 pgoyette $proto/transport//require; 369 1.2.2.2 pgoyette spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P in ipsec 370 1.2.2.2 pgoyette $proto/transport//require; 371 1.2.2.2 pgoyette EOF 372 1.2.2.2 pgoyette $DEBUG && cat $tmpfile 373 1.2.2.2 pgoyette atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 374 1.2.2.2 pgoyette $DEBUG && $HIJACKING setkey -D 375 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \ 376 1.2.2.2 pgoyette $HIJACKING setkey -D 377 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \ 378 1.2.2.2 pgoyette $HIJACKING setkey -D 379 1.2.2.2 pgoyette # TODO: more detail checks 380 1.2.2.2 pgoyette fi 381 1.2.2.2 pgoyette 382 1.2.2.2 pgoyette export RUMP_SERVER=$SOCK_LOCAL 383 1.2.2.2 pgoyette atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote 384 1.2.2.2 pgoyette 385 1.2.2.2 pgoyette extract_new_packets $BUS_TUNNEL > $outfile 386 1.2.2.2 pgoyette str=$(make_l2tp_pktstr $ip_gwlo_tun $ip_gwre_tun $proto ipv6 $mode) 387 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$str" cat $outfile 388 1.2.2.2 pgoyette str=$(make_l2tp_pktstr $ip_gwre_tun $ip_gwlo_tun $proto ipv6 $mode) 389 1.2.2.2 pgoyette atf_check -s exit:0 -o match:"$str" cat $outfile 390 1.2.2.2 pgoyette } 391 1.2.2.2 pgoyette 392 1.2.2.2 pgoyette test_ipsec_l2tp_common() 393 1.2.2.2 pgoyette { 394 1.2.2.2 pgoyette local ipproto=$1 395 1.2.2.2 pgoyette local mode=$2 396 1.2.2.2 pgoyette local proto=$3 397 1.2.2.2 pgoyette local algo=$4 398 1.2.2.2 pgoyette 399 1.2.2.2 pgoyette if [ $ipproto = ipv4 ]; then 400 1.2.2.2 pgoyette test_ipsec4_l2tp $mode $proto $algo 401 1.2.2.2 pgoyette else 402 1.2.2.2 pgoyette test_ipsec6_l2tp $mode $proto $algo 403 1.2.2.2 pgoyette fi 404 1.2.2.2 pgoyette } 405 1.2.2.2 pgoyette 406 1.2.2.2 pgoyette add_test_ipsec_l2tp() 407 1.2.2.2 pgoyette { 408 1.2.2.2 pgoyette local ipproto=$1 409 1.2.2.2 pgoyette local mode=$2 410 1.2.2.2 pgoyette local proto=$3 411 1.2.2.2 pgoyette local algo=$4 412 1.2.2.2 pgoyette local _algo=$(echo $algo | sed 's/-//g') 413 1.2.2.2 pgoyette local name= desc= 414 1.2.2.2 pgoyette 415 1.2.2.2 pgoyette name="ipsec_l2tp_${ipproto}_${mode}_${proto}_${_algo}" 416 1.2.2.2 pgoyette desc="Tests of l2tp/IPsec ($ipproto) ${mode} mode with $proto ($algo)" 417 1.2.2.2 pgoyette 418 1.2.2.2 pgoyette atf_test_case ${name} cleanup 419 1.2.2.2 pgoyette eval " \ 420 1.2.2.2 pgoyette ${name}_head() { \ 421 1.2.2.2 pgoyette atf_set \"descr\" \"$desc\"; \ 422 1.2.2.2 pgoyette atf_set \"require.progs\" \"rump_server\" \"setkey\"; \ 423 1.2.2.2 pgoyette }; \ 424 1.2.2.2 pgoyette ${name}_body() { \ 425 1.2.2.2 pgoyette test_ipsec_l2tp_common $ipproto $mode $proto $algo; \ 426 1.2.2.2 pgoyette rump_server_destroy_ifaces; \ 427 1.2.2.2 pgoyette }; \ 428 1.2.2.2 pgoyette ${name}_cleanup() { \ 429 1.2.2.2 pgoyette $DEBUG && dump; \ 430 1.2.2.2 pgoyette cleanup; \ 431 1.2.2.2 pgoyette } \ 432 1.2.2.2 pgoyette " 433 1.2.2.2 pgoyette atf_add_test_case ${name} 434 1.2.2.2 pgoyette } 435 1.2.2.2 pgoyette 436 1.2.2.2 pgoyette atf_init_test_cases() 437 1.2.2.2 pgoyette { 438 1.2.2.2 pgoyette local algo= 439 1.2.2.2 pgoyette 440 1.2.2.2 pgoyette for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do 441 1.2.2.2 pgoyette add_test_ipsec_l2tp ipv4 tunnel esp $algo 442 1.2.2.2 pgoyette add_test_ipsec_l2tp ipv6 tunnel esp $algo 443 1.2.2.2 pgoyette add_test_ipsec_l2tp ipv4 transport esp $algo 444 1.2.2.2 pgoyette add_test_ipsec_l2tp ipv6 transport esp $algo 445 1.2.2.2 pgoyette done 446 1.2.2.2 pgoyette 447 1.2.2.2 pgoyette for algo in $AH_AUTHENTICATION_ALGORITHMS_MINIMUM; do 448 1.2.2.2 pgoyette add_test_ipsec_l2tp ipv4 tunnel ah $algo 449 1.2.2.2 pgoyette add_test_ipsec_l2tp ipv6 tunnel ah $algo 450 1.2.2.2 pgoyette add_test_ipsec_l2tp ipv4 transport ah $algo 451 1.2.2.2 pgoyette add_test_ipsec_l2tp ipv6 transport ah $algo 452 1.2.2.2 pgoyette done 453 1.2.2.2 pgoyette } 454
Indexes created Sun Oct 19 16:10:00 GMT 2025