Home | History | Annotate | Line # | Download | only in ipsec
t_ipsec_misc.sh revision 1.1 
      1 #	$NetBSD: t_ipsec_misc.sh,v 1.1 2017/05/15 09:58:22 ozaki-r Exp $
      2 #
      3 # Copyright (c) 2017 Internet Initiative Japan Inc.
      4 # All rights reserved.
      5 #
      6 # Redistribution and use in source and binary forms, with or without
      7 # modification, are permitted provided that the following conditions
      8 # are met:
      9 # 1. Redistributions of source code must retain the above copyright
     10 #    notice, this list of conditions and the following disclaimer.
     11 # 2. Redistributions in binary form must reproduce the above copyright
     12 #    notice, this list of conditions and the following disclaimer in the
     13 #    documentation and/or other materials provided with the distribution.
     14 #
     15 # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     16 # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     17 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     18 # PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     19 # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     20 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     21 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     22 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     23 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     24 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     25 # POSSIBILITY OF SUCH DAMAGE.
     26 #
     27 
     28 SOCK_LOCAL=unix://ipsec_local
     29 SOCK_PEER=unix://ipsec_peer
     30 BUS=./bus_ipsec
     31 
     32 DEBUG=${DEBUG:-false}
     33 
     34 setup_sasp()
     35 {
     36 	local proto=$1
     37 	local algo_args="$2"
     38 	local ip_local=$3
     39 	local ip_peer=$4
     40 	local lifetime=$5
     41 	local tmpfile=./tmp
     42 
     43 	export RUMP_SERVER=$SOCK_LOCAL
     44 	cat > $tmpfile <<-EOF
     45 	add $ip_local $ip_peer $proto 10000 -lh $lifetime -ls $lifetime $algo_args;
     46 	add $ip_peer $ip_local $proto 10001 -lh $lifetime -ls $lifetime $algo_args;
     47 	spdadd $ip_local $ip_peer any -P out ipsec $proto/transport//require;
     48 	EOF
     49 	$DEBUG && cat $tmpfile
     50 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
     51 	check_sa_entries $SOCK_LOCAL $ip_local $ip_peer
     52 
     53 	export RUMP_SERVER=$SOCK_PEER
     54 	cat > $tmpfile <<-EOF
     55 	add $ip_local $ip_peer $proto 10000 -lh $lifetime -ls $lifetime $algo_args;
     56 	add $ip_peer $ip_local $proto 10001 -lh $lifetime -ls $lifetime $algo_args;
     57 	spdadd $ip_peer $ip_local any -P out ipsec $proto/transport//require;
     58 	EOF
     59 	$DEBUG && cat $tmpfile
     60 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
     61 	check_sa_entries $SOCK_PEER $ip_local $ip_peer
     62 }
     63 
     64 test_ipsec4_lifetime()
     65 {
     66 	local proto=$1
     67 	local algo=$2
     68 	local ip_local=10.0.0.1
     69 	local ip_peer=10.0.0.2
     70 	local outfile=./out
     71 	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
     72 	local algo_args="$(generate_algo_args $proto $algo)"
     73 	local lifetime=3
     74 
     75 	rump_server_crypto_start $SOCK_LOCAL netipsec
     76 	rump_server_crypto_start $SOCK_PEER netipsec
     77 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
     78 	rump_server_add_iface $SOCK_PEER shmif0 $BUS
     79 
     80 	export RUMP_SERVER=$SOCK_LOCAL
     81 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
     82 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
     83 	#atf_check -s exit:0 -o ignore rump.sysctl -w net.key.debug=0xff
     84 
     85 	export RUMP_SERVER=$SOCK_PEER
     86 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0
     87 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer/24
     88 	#atf_check -s exit:0 -o ignore rump.sysctl -w net.key.debug=0xff
     89 
     90 	extract_new_packets $BUS > $outfile
     91 
     92 	export RUMP_SERVER=$SOCK_LOCAL
     93 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
     94 
     95 	extract_new_packets $BUS > $outfile
     96 	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: ICMP echo request" \
     97 	    cat $outfile
     98 	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: ICMP echo reply" \
     99 	    cat $outfile
    100 
    101 	# Set up SAs with lifetime 1 sec.
    102 	setup_sasp $proto "$algo_args" $ip_local $ip_peer 1
    103 
    104 	# Wait for the SAs to be expired
    105 	atf_check -s exit:0 sleep 2
    106 
    107 	# Check the SAs have been expired
    108 	export RUMP_SERVER=$SOCK_LOCAL
    109 	$DEBUG && $HIJACKING setkey -D
    110 	atf_check -s exit:0 -o match:'No SAD entries.' $HIJACKING setkey -D
    111 	export RUMP_SERVER=$SOCK_PEER
    112 	$DEBUG && $HIJACKING setkey -D
    113 	atf_check -s exit:0 -o match:'No SAD entries.' $HIJACKING setkey -D
    114 
    115 	# Clean up SPs
    116 	export RUMP_SERVER=$SOCK_LOCAL
    117 	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P
    118 	export RUMP_SERVER=$SOCK_PEER
    119 	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P
    120 
    121 	# Set up SAs with lifetime with $lifetime
    122 	setup_sasp $proto "$algo_args" $ip_local $ip_peer $lifetime
    123 
    124 	# Use the SAs; this will create a reference from an SP to an SA
    125 	export RUMP_SERVER=$SOCK_LOCAL
    126 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer
    127 
    128 	extract_new_packets $BUS > $outfile
    129 	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: $proto_cap" \
    130 	    cat $outfile
    131 	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: $proto_cap" \
    132 	    cat $outfile
    133 
    134 	atf_check -s exit:0 sleep $((lifetime + 1))
    135 
    136 	export RUMP_SERVER=$SOCK_LOCAL
    137 	$DEBUG && $HIJACKING setkey -D
    138 	atf_check -s exit:0 -o empty $HIJACKING setkey -D
    139 	# The SA on output remain because sp/isr still refers it
    140 	atf_check -s exit:0 -o match:"$ip_local $ip_peer" \
    141 	    $HIJACKING setkey -D -a
    142 	atf_check -s exit:0 -o not-match:"$ip_peer $ip_local" \
    143 	    $HIJACKING setkey -D -a
    144 
    145 	export RUMP_SERVER=$SOCK_PEER
    146 	$DEBUG && $HIJACKING setkey -D
    147 	atf_check -s exit:0 -o empty $HIJACKING setkey -D
    148 	atf_check -s exit:0 -o not-match:"$ip_local $ip_peer" \
    149 	    $HIJACKING setkey -D -a
    150 	# The SA on output remain because sp/isr still refers it
    151 	atf_check -s exit:0 -o match:"$ip_peer $ip_local" \
    152 	    $HIJACKING setkey -D -a
    153 
    154 	export RUMP_SERVER=$SOCK_LOCAL
    155 	atf_check -s not-exit:0 -o match:'0 packets received' \
    156 	    rump.ping -c 1 -n -w 1 $ip_peer
    157 
    158 	test_flush_entries $SOCK_LOCAL
    159 	test_flush_entries $SOCK_PEER
    160 }
    161 
    162 test_ipsec6_lifetime()
    163 {
    164 	local proto=$1
    165 	local algo=$2
    166 	local ip_local=fd00::1
    167 	local ip_peer=fd00::2
    168 	local tmpfile=./tmp
    169 	local outfile=./out
    170 	local proto_cap=$(echo $proto | tr 'a-z' 'A-Z')
    171 	local algo_args="$(generate_algo_args $proto $algo)"
    172 	local lifetime=3
    173 
    174 	rump_server_crypto_start $SOCK_LOCAL netinet6 netipsec
    175 	rump_server_crypto_start $SOCK_PEER netinet6 netipsec
    176 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS
    177 	rump_server_add_iface $SOCK_PEER shmif0 $BUS
    178 
    179 	export RUMP_SERVER=$SOCK_LOCAL
    180 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.dad_count=0
    181 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local
    182 
    183 	export RUMP_SERVER=$SOCK_PEER
    184 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.dad_count=0
    185 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_peer
    186 
    187 	extract_new_packets $BUS > $outfile
    188 
    189 	export RUMP_SERVER=$SOCK_LOCAL
    190 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_peer
    191 
    192 	extract_new_packets $BUS > $outfile
    193 	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: ICMP6, echo request" \
    194 	    cat $outfile
    195 	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: ICMP6, echo reply" \
    196 	    cat $outfile
    197 
    198 	# Set up SAs with lifetime 1 sec.
    199 	setup_sasp $proto "$algo_args" $ip_local $ip_peer 1
    200 
    201 	# Wait for the SAs to be expired
    202 	atf_check -s exit:0 sleep 2
    203 
    204 	# Check the SAs have been expired
    205 	export RUMP_SERVER=$SOCK_LOCAL
    206 	$DEBUG && $HIJACKING setkey -D
    207 	atf_check -s exit:0 -o match:'No SAD entries.' $HIJACKING setkey -D
    208 	export RUMP_SERVER=$SOCK_PEER
    209 	$DEBUG && $HIJACKING setkey -D
    210 	atf_check -s exit:0 -o match:'No SAD entries.' $HIJACKING setkey -D
    211 
    212 	# Clean up SPs
    213 	export RUMP_SERVER=$SOCK_LOCAL
    214 	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P
    215 	export RUMP_SERVER=$SOCK_PEER
    216 	atf_check -s exit:0 -o empty $HIJACKING setkey -F -P
    217 
    218 	# Set up SAs with lifetime with $lifetime
    219 	setup_sasp $proto "$algo_args" $ip_local $ip_peer $lifetime
    220 
    221 	# Use the SAs; this will create a reference from an SP to an SA
    222 	export RUMP_SERVER=$SOCK_LOCAL
    223 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_peer
    224 
    225 	extract_new_packets $BUS > $outfile
    226 	atf_check -s exit:0 -o match:"$ip_local > $ip_peer: $proto_cap" \
    227 	    cat $outfile
    228 	atf_check -s exit:0 -o match:"$ip_peer > $ip_local: $proto_cap" \
    229 	    cat $outfile
    230 
    231 	atf_check -s exit:0 sleep $((lifetime + 1))
    232 
    233 	export RUMP_SERVER=$SOCK_LOCAL
    234 	$DEBUG && $HIJACKING setkey -D
    235 	atf_check -s exit:0 -o empty $HIJACKING setkey -D
    236 	# The SA on output remain because sp/isr still refers it
    237 	atf_check -s exit:0 -o match:"$ip_local $ip_peer" \
    238 	    $HIJACKING setkey -D -a
    239 	atf_check -s exit:0 -o not-match:"$ip_peer $ip_local" \
    240 	    $HIJACKING setkey -D -a
    241 
    242 	export RUMP_SERVER=$SOCK_PEER
    243 	$DEBUG && $HIJACKING setkey -D
    244 	atf_check -s exit:0 -o empty $HIJACKING setkey -D
    245 	atf_check -s exit:0 -o not-match:"$ip_local $ip_peer" \
    246 	    $HIJACKING setkey -D -a
    247 	# The SA on output remain because sp/isr still refers it
    248 	atf_check -s exit:0 -o match:"$ip_peer $ip_local" \
    249 	    $HIJACKING setkey -D -a
    250 
    251 	export RUMP_SERVER=$SOCK_LOCAL
    252 	atf_check -s not-exit:0 -o match:'0 packets received' \
    253 	    rump.ping6 -c 1 -n -X 1 $ip_peer
    254 
    255 	test_flush_entries $SOCK_LOCAL
    256 	test_flush_entries $SOCK_PEER
    257 }
    258 
    259 test_lifetime_common()
    260 {
    261 	local ipproto=$1
    262 	local proto=$2
    263 	local algo=$3
    264 
    265 	if [ $ipproto = ipv4 ]; then
    266 		test_ipsec4_lifetime $proto $algo
    267 	else
    268 		test_ipsec6_lifetime $proto $algo
    269 	fi
    270 }
    271 
    272 add_test_lifetime()
    273 {
    274 	local ipproto=$1
    275 	local proto=$2
    276 	local algo=$3
    277 	local _algo=$(echo $algo | sed 's/-//g')
    278 	local name= desc=
    279 
    280 	name="ipsec_lifetime_${ipproto}_${proto}_${_algo}"
    281 	desc="Tests of lifetime of IPsec ($ipproto) with $proto ($algo)"
    282 
    283 	atf_test_case ${name} cleanup
    284 	eval "								\
    285 	    ${name}_head() {						\
    286 	        atf_set \"descr\" \"$desc\";				\
    287 	        atf_set \"require.progs\" \"rump_server\" \"setkey\";	\
    288 	    };								\
    289 	    ${name}_body() {						\
    290 	        test_lifetime_common $ipproto $proto $algo;		\
    291 	        rump_server_destroy_ifaces;				\
    292 	    };								\
    293 	    ${name}_cleanup() {						\
    294 	        $DEBUG && dump;						\
    295 	        cleanup;						\
    296 	    }								\
    297 	"
    298 	atf_add_test_case ${name}
    299 }
    300 
    301 atf_init_test_cases()
    302 {
    303 	local algo=
    304 
    305 	for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
    306 		add_test_lifetime ipv4 esp $algo
    307 		add_test_lifetime ipv6 esp $algo
    308 	done
    309 	for algo in $AH_AUTHENTICATION_ALGORITHMS_MINIMUM; do
    310 		add_test_lifetime ipv4 ah $algo
    311 		add_test_lifetime ipv6 ah $algo
    312 	done
    313 }
    314