Home | History | Annotate | Line # | Download | only in ipsec
t_ipsec_l2tp.sh revision 1.3 
      1 #	$NetBSD: t_ipsec_l2tp.sh,v 1.3 2017/05/09 04:25:28 ozaki-r Exp $
      2 #
      3 # Copyright (c) 2017 Internet Initiative Japan Inc.
      4 # All rights reserved.
      5 #
      6 # Redistribution and use in source and binary forms, with or without
      7 # modification, are permitted provided that the following conditions
      8 # are met:
      9 # 1. Redistributions of source code must retain the above copyright
     10 #    notice, this list of conditions and the following disclaimer.
     11 # 2. Redistributions in binary form must reproduce the above copyright
     12 #    notice, this list of conditions and the following disclaimer in the
     13 #    documentation and/or other materials provided with the distribution.
     14 #
     15 # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     16 # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     17 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     18 # PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     19 # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     20 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     21 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     22 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     23 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     24 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     25 # POSSIBILITY OF SUCH DAMAGE.
     26 #
     27 
     28 SOCK_LOCAL=unix://ipsec_l2tp_local
     29 SOCK_TUN_LOCAL=unix://ipsec_l2tp_tunel_local
     30 SOCK_TUN_REMOTE=unix://ipsec_l2tp_tunnel_remote
     31 SOCK_REMOTE=unix://ipsec_l2tp_remote
     32 BUS_LOCAL=./bus_ipsec_local
     33 BUS_TUNNEL=./bus_ipsec_tunnel
     34 BUS_REMOTE=./bus_ipsec_remote
     35 
     36 DEBUG=${DEBUG:-false}
     37 
     38 make_l2tp_pktstr()
     39 {
     40 	local src=$1
     41 	local dst=$2
     42 	local proto=$3
     43 	local ipproto=$4
     44 	local mode=$5
     45 	local proto_cap= proto_str=
     46 
     47 	if [ $proto = esp ]; then
     48 		proto_cap=ESP
     49 	else
     50 		proto_cap=AH
     51 		if [ $ipproto = ipv4 ]; then
     52 			if [ $mode = tunnel ]; then
     53 				proto_str="ip-proto-115 102 \(ipip-proto-4\)"
     54 			else
     55 				proto_str="ip-proto-115 102"
     56 			fi
     57 		else
     58 			proto_str="ip-proto-115"
     59 		fi
     60 	fi
     61 
     62 	echo "$src > $dst: $proto_cap.+$proto_str"
     63 }
     64 
     65 test_ipsec4_l2tp()
     66 {
     67 	local mode=$1
     68 	local proto=$2
     69 	local algo=$3
     70 	local ip_local=10.0.0.1
     71 	local ip_gwlo_tun=20.0.0.1
     72 	local ip_gwre_tun=20.0.0.2
     73 	local ip_remote=10.0.0.2
     74 	local subnet_local=20.0.0.0
     75 	local subnet_remote=20.0.0.0
     76 	local keylen=$(get_one_valid_keylen $algo)
     77 	local key=$(generate_key $keylen)
     78 	local tmpfile=./tmp
     79 	local outfile=./out
     80 	local opt= str=
     81 
     82 	if [ $proto = esp ]; then
     83 		opt=-E
     84 	else
     85 		opt=-A
     86 	fi
     87 
     88 	# See https://www.netbsd.org/docs/network/ipsec/#sample_vpn
     89 	rump_server_crypto_start $SOCK_LOCAL
     90 	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec l2tp bridge
     91 	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec l2tp bridge
     92 	rump_server_crypto_start $SOCK_REMOTE
     93 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
     94 	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
     95 	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
     96 	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
     97 	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
     98 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
     99 
    100 	export RUMP_SERVER=$SOCK_LOCAL
    101 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
    102 
    103 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    104 	atf_check -s exit:0 rump.ifconfig shmif0 up
    105 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwlo_tun/24
    106 	atf_check -s exit:0 rump.ifconfig l2tp0 create
    107 	atf_check -s exit:0 rump.ifconfig l2tp0 \
    108 	    tunnel $ip_gwlo_tun $ip_gwre_tun
    109 	atf_check -s exit:0 rump.ifconfig l2tp0 session 1234 4321
    110 	atf_check -s exit:0 rump.ifconfig l2tp0 up
    111 	atf_check -s exit:0 rump.ifconfig bridge0 create
    112 	atf_check -s exit:0 rump.ifconfig bridge0 up
    113 	atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0
    114 	atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0
    115 
    116 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    117 	atf_check -s exit:0 rump.ifconfig shmif0 up
    118 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwre_tun/24
    119 	atf_check -s exit:0 rump.ifconfig l2tp0 create
    120 	atf_check -s exit:0 rump.ifconfig l2tp0 \
    121 	    tunnel $ip_gwre_tun $ip_gwlo_tun
    122 	atf_check -s exit:0 rump.ifconfig l2tp0 session 4321 1234
    123 	atf_check -s exit:0 rump.ifconfig l2tp0 up
    124 	atf_check -s exit:0 rump.ifconfig bridge0 create
    125 	atf_check -s exit:0 rump.ifconfig bridge0 up
    126 	atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0
    127 	atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0
    128 
    129 	export RUMP_SERVER=$SOCK_REMOTE
    130 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24
    131 	# Run ifconfig -w 10 just once for optimization
    132 	atf_check -s exit:0 rump.ifconfig -w 10
    133 
    134 	extract_new_packets $BUS_TUNNEL > $outfile
    135 
    136 	export RUMP_SERVER=$SOCK_LOCAL
    137 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    138 
    139 	extract_new_packets $BUS_TUNNEL > $outfile
    140 	atf_check -s exit:0 \
    141 	    -o match:"$ip_gwlo_tun > $ip_gwre_tun: +ip-proto-115" \
    142 	    cat $outfile
    143 	atf_check -s exit:0 \
    144 	    -o match:"$ip_gwre_tun > $ip_gwlo_tun: +ip-proto-115" \
    145 	    cat $outfile
    146 
    147 	if [ $mode = tunnel ]; then
    148 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    149 		# from https://www.netbsd.org/docs/network/ipsec/
    150 		cat > $tmpfile <<-EOF
    151 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    152 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    153 		spdadd $subnet_local/24 $subnet_remote/24 any -P out ipsec
    154 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    155 		spdadd $subnet_remote/24 $subnet_local/24 any -P in ipsec
    156 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    157 		EOF
    158 		$DEBUG && cat $tmpfile
    159 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    160 
    161 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    162 		cat > $tmpfile <<-EOF
    163 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    164 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    165 		spdadd $subnet_remote/24 $subnet_local/24 any -P out ipsec
    166 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    167 		spdadd $subnet_local/24 $subnet_remote/24 any -P in ipsec
    168 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    169 		EOF
    170 		$DEBUG && cat $tmpfile
    171 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    172 	else # transport mode
    173 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    174 		# from https://www.netbsd.org/docs/network/ipsec/
    175 		cat > $tmpfile <<-EOF
    176 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    177 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    178 		spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P out ipsec
    179 		    $proto/transport//require;
    180 		spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P in ipsec
    181 		    $proto/transport//require;
    182 		EOF
    183 		$DEBUG && cat $tmpfile
    184 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    185 
    186 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    187 		cat > $tmpfile <<-EOF
    188 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    189 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    190 		spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P out ipsec
    191 		    $proto/transport//require;
    192 		spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P in ipsec
    193 		    $proto/transport//require;
    194 		EOF
    195 		$DEBUG && cat $tmpfile
    196 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    197 	fi
    198 
    199 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    200 	$DEBUG && $HIJACKING setkey -D
    201 	atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    202 	    $HIJACKING setkey -D
    203 	atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    204 	    $HIJACKING setkey -D
    205 	# TODO: more detail checks
    206 
    207 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    208 	$DEBUG && $HIJACKING setkey -D
    209 	atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    210 	    $HIJACKING setkey -D
    211 	atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    212 	    $HIJACKING setkey -D
    213 	# TODO: more detail checks
    214 
    215 	export RUMP_SERVER=$SOCK_LOCAL
    216 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    217 
    218 	extract_new_packets $BUS_TUNNEL > $outfile
    219 	str=$(make_l2tp_pktstr $ip_gwlo_tun $ip_gwre_tun $proto ipv4 $mode)
    220 	atf_check -s exit:0 -o match:"$str" cat $outfile
    221 	str=$(make_l2tp_pktstr $ip_gwre_tun $ip_gwlo_tun $proto ipv4 $mode)
    222 	atf_check -s exit:0 -o match:"$str" cat $outfile
    223 
    224 	test_flush_entries $SOCK_TUN_LOCAL
    225 	test_flush_entries $SOCK_TUN_REMOTE
    226 }
    227 
    228 test_ipsec6_l2tp()
    229 {
    230 	local mode=$1
    231 	local proto=$2
    232 	local algo=$3
    233 	local ip_local=fd00::1
    234 	local ip_gwlo_tun=fc00::1
    235 	local ip_gwre_tun=fc00::2
    236 	local ip_remote=fd00::2
    237 	local subnet_local=fc00::
    238 	local subnet_remote=fc00::
    239 	local keylen=$(get_one_valid_keylen $algo)
    240 	local key=$(generate_key $keylen)
    241 	local tmpfile=./tmp
    242 	local outfile=./out
    243 	local opt= str=
    244 
    245 	if [ $proto = esp ]; then
    246 		opt=-E
    247 	else
    248 		opt=-A
    249 	fi
    250 
    251 	rump_server_crypto_start $SOCK_LOCAL netinet6
    252 	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec netinet6 l2tp bridge
    253 	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec netinet6 l2tp bridge
    254 	rump_server_crypto_start $SOCK_REMOTE netinet6
    255 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
    256 	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
    257 	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
    258 	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
    259 	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
    260 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
    261 
    262 	export RUMP_SERVER=$SOCK_LOCAL
    263 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local/64
    264 
    265 	export RUMP_SERVER=$SOCK_TUN_LOCAL
    266 	atf_check -s exit:0 rump.ifconfig shmif0 up
    267 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwlo_tun/64
    268 	atf_check -s exit:0 rump.ifconfig l2tp0 create
    269 	atf_check -s exit:0 rump.ifconfig l2tp0 \
    270 	    tunnel $ip_gwlo_tun $ip_gwre_tun
    271 	atf_check -s exit:0 rump.ifconfig l2tp0 session 1234 4321
    272 	atf_check -s exit:0 rump.ifconfig l2tp0 up
    273 	atf_check -s exit:0 rump.ifconfig bridge0 create
    274 	atf_check -s exit:0 rump.ifconfig bridge0 up
    275 	atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0
    276 	atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0
    277 
    278 	export RUMP_SERVER=$SOCK_TUN_REMOTE
    279 	atf_check -s exit:0 rump.ifconfig shmif0 up
    280 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwre_tun/64
    281 	atf_check -s exit:0 rump.ifconfig l2tp0 create
    282 	atf_check -s exit:0 rump.ifconfig l2tp0 \
    283 	    tunnel $ip_gwre_tun $ip_gwlo_tun
    284 	atf_check -s exit:0 rump.ifconfig l2tp0 session 4321 1234
    285 	atf_check -s exit:0 rump.ifconfig l2tp0 up
    286 	atf_check -s exit:0 rump.ifconfig bridge0 create
    287 	atf_check -s exit:0 rump.ifconfig bridge0 up
    288 	atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0
    289 	atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0
    290 
    291 	export RUMP_SERVER=$SOCK_REMOTE
    292 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_remote
    293 	# Run ifconfig -w 10 just once for optimization
    294 	atf_check -s exit:0 rump.ifconfig -w 10
    295 
    296 	extract_new_packets $BUS_TUNNEL > $outfile
    297 
    298 	export RUMP_SERVER=$SOCK_LOCAL
    299 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    300 
    301 	extract_new_packets $BUS_TUNNEL > $outfile
    302 	atf_check -s exit:0 \
    303 	    -o match:"$ip_gwlo_tun > $ip_gwre_tun: +ip-proto-115" \
    304 	    cat $outfile
    305 	atf_check -s exit:0 \
    306 	    -o match:"$ip_gwre_tun > $ip_gwlo_tun: +ip-proto-115" \
    307 	    cat $outfile
    308 
    309 	if [ $mode = tunnel ]; then
    310 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    311 		# from https://www.netbsd.org/docs/network/ipsec/
    312 		cat > $tmpfile <<-EOF
    313 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    314 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    315 		spdadd $subnet_local/64 $subnet_remote/64 any -P out ipsec
    316 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    317 		spdadd $subnet_remote/64 $subnet_local/64 any -P in ipsec
    318 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    319 		EOF
    320 		$DEBUG && cat $tmpfile
    321 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    322 		$DEBUG && $HIJACKING setkey -D
    323 		atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    324 		    $HIJACKING setkey -D
    325 		atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    326 		    $HIJACKING setkey -D
    327 		# TODO: more detail checks
    328 
    329 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    330 		cat > $tmpfile <<-EOF
    331 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    332 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    333 		spdadd $subnet_remote/64 $subnet_local/64 any -P out ipsec
    334 		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
    335 		spdadd $subnet_local/64 $subnet_remote/64 any -P in ipsec
    336 		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
    337 		EOF
    338 		$DEBUG && cat $tmpfile
    339 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    340 		$DEBUG && $HIJACKING setkey -D
    341 		atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    342 		    $HIJACKING setkey -D
    343 		atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    344 		    $HIJACKING setkey -D
    345 		# TODO: more detail checks
    346 	else # transport mode
    347 		export RUMP_SERVER=$SOCK_TUN_LOCAL
    348 		# from https://www.netbsd.org/docs/network/ipsec/
    349 		cat > $tmpfile <<-EOF
    350 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    351 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    352 		spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P out ipsec
    353 		    $proto/transport//require;
    354 		spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P in ipsec
    355 		    $proto/transport//require;
    356 		EOF
    357 		$DEBUG && cat $tmpfile
    358 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    359 		$DEBUG && $HIJACKING setkey -D
    360 		atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    361 		    $HIJACKING setkey -D
    362 		atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    363 		    $HIJACKING setkey -D
    364 		# TODO: more detail checks
    365 
    366 		export RUMP_SERVER=$SOCK_TUN_REMOTE
    367 		cat > $tmpfile <<-EOF
    368 		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $opt $algo $key;
    369 		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $opt $algo $key;
    370 		spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P out ipsec
    371 		    $proto/transport//require;
    372 		spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P in ipsec
    373 		    $proto/transport//require;
    374 		EOF
    375 		$DEBUG && cat $tmpfile
    376 		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    377 		$DEBUG && $HIJACKING setkey -D
    378 		atf_check -s exit:0 -o match:"$ip_gwlo_tun $ip_gwre_tun" \
    379 		    $HIJACKING setkey -D
    380 		atf_check -s exit:0 -o match:"$ip_gwre_tun $ip_gwlo_tun" \
    381 		    $HIJACKING setkey -D
    382 		# TODO: more detail checks
    383 	fi
    384 
    385 	export RUMP_SERVER=$SOCK_LOCAL
    386 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    387 
    388 	extract_new_packets $BUS_TUNNEL > $outfile
    389 	str=$(make_l2tp_pktstr $ip_gwlo_tun $ip_gwre_tun $proto ipv6 $mode)
    390 	atf_check -s exit:0 -o match:"$str" cat $outfile
    391 	str=$(make_l2tp_pktstr $ip_gwre_tun $ip_gwlo_tun $proto ipv6 $mode)
    392 	atf_check -s exit:0 -o match:"$str" cat $outfile
    393 
    394 	test_flush_entries $SOCK_TUN_LOCAL
    395 	test_flush_entries $SOCK_TUN_REMOTE
    396 }
    397 
    398 test_ipsec_l2tp_common()
    399 {
    400 	local ipproto=$1
    401 	local mode=$2
    402 	local proto=$3
    403 	local algo=$4
    404 
    405 	if [ $ipproto = ipv4 ]; then
    406 		test_ipsec4_l2tp $mode $proto $algo
    407 	else
    408 		test_ipsec6_l2tp $mode $proto $algo
    409 	fi
    410 }
    411 
    412 add_test_ipsec_l2tp()
    413 {
    414 	local ipproto=$1
    415 	local mode=$2
    416 	local proto=$3
    417 	local algo=$4
    418 	local _algo=$(echo $algo | sed 's/-//g')
    419 	local name= desc=
    420 
    421 	name="ipsec_l2tp_${ipproto}_${mode}_${proto}_${_algo}"
    422 	desc="Tests of l2tp/IPsec ($ipproto) ${mode} mode with $proto ($algo)"
    423 
    424 	atf_test_case ${name} cleanup
    425 	eval "								\
    426 	    ${name}_head() {						\
    427 	        atf_set \"descr\" \"$desc\";				\
    428 	        atf_set \"require.progs\" \"rump_server\" \"setkey\";	\
    429 	    };								\
    430 	    ${name}_body() {						\
    431 	        test_ipsec_l2tp_common $ipproto $mode $proto $algo;	\
    432 	        rump_server_destroy_ifaces;				\
    433 	    };								\
    434 	    ${name}_cleanup() {						\
    435 	        $DEBUG && dump;						\
    436 	        cleanup;						\
    437 	    }								\
    438 	"
    439 	atf_add_test_case ${name}
    440 }
    441 
    442 atf_init_test_cases()
    443 {
    444 	local algo=
    445 
    446 	for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
    447 		add_test_ipsec_l2tp ipv4 tunnel esp $algo
    448 		add_test_ipsec_l2tp ipv6 tunnel esp $algo
    449 		add_test_ipsec_l2tp ipv4 transport esp $algo
    450 		add_test_ipsec_l2tp ipv6 transport esp $algo
    451 	done
    452 
    453 	for algo in $AH_AUTHENTICATION_ALGORITHMS_MINIMUM; do
    454 		add_test_ipsec_l2tp ipv4 tunnel ah $algo
    455 		add_test_ipsec_l2tp ipv6 tunnel ah $algo
    456 		add_test_ipsec_l2tp ipv4 transport ah $algo
    457 		add_test_ipsec_l2tp ipv6 transport ah $algo
    458 	done
    459 }
    460