t_ipsec_transport.sh revision 1.1.6.2
1 # $NetBSD: t_ipsec_transport.sh,v 1.1.6.2 2017/05/19 00:22:59 pgoyette Exp $ 2 # 3 # Copyright (c) 2017 Internet Initiative Japan Inc. 4 # All rights reserved. 5 # 6 # Redistribution and use in source and binary forms, with or without 7 # modification, are permitted provided that the following conditions 8 # are met: 9 # 1. Redistributions of source code must retain the above copyright 10 # notice, this list of conditions and the following disclaimer. 11 # 2. Redistributions in binary form must reproduce the above copyright 12 # notice, this list of conditions and the following disclaimer in the 13 # documentation and/or other materials provided with the distribution. 14 # 15 # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 16 # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 17 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 18 # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 19 # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 # POSSIBILITY OF SUCH DAMAGE. 26 # 27 28 SOCK_LOCAL=unix://ipsec_local 29 SOCK_PEER=unix://ipsec_peer 30 BUS=./bus_ipsec 31 32 DEBUG=${DEBUG:-false} 33 34 test_ipsec4_transport() 35 { 36 local proto=$1 37 local algo=$2 38 local ip_local=10.0.0.1 39 local ip_peer=10.0.0.2 40 local tmpfile=./tmp 41 local outfile=./out 42 local proto_cap=$(echo $proto | tr 'a-z' 'A-Z') 43 local algo_args="$(generate_algo_args $proto $algo)" 44 45 rump_server_crypto_start $SOCK_LOCAL netipsec 46 rump_server_crypto_start $SOCK_PEER netipsec 47 rump_server_add_iface $SOCK_LOCAL shmif0 $BUS 48 rump_server_add_iface $SOCK_PEER shmif0 $BUS 49 50 export RUMP_SERVER=$SOCK_LOCAL 51 atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24 52 atf_check -s exit:0 rump.ifconfig -w 10 53 54 export RUMP_SERVER=$SOCK_PEER 55 atf_check -s exit:0 rump.ifconfig shmif0 $ip_peer/24 56 atf_check -s exit:0 rump.ifconfig -w 10 57 58 extract_new_packets $BUS > $outfile 59 60 export RUMP_SERVER=$SOCK_LOCAL 61 atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer 62 63 extract_new_packets $BUS > $outfile 64 atf_check -s exit:0 -o match:"$ip_local > $ip_peer: ICMP echo request" \ 65 cat $outfile 66 atf_check -s exit:0 -o match:"$ip_peer > $ip_local: ICMP echo reply" \ 67 cat $outfile 68 69 export RUMP_SERVER=$SOCK_LOCAL 70 # from https://www.netbsd.org/docs/network/ipsec/ 71 cat > $tmpfile <<-EOF 72 add $ip_local $ip_peer $proto 10000 $algo_args; 73 add $ip_peer $ip_local $proto 10001 $algo_args; 74 spdadd $ip_local $ip_peer any -P out ipsec $proto/transport//require; 75 EOF 76 $DEBUG && cat $tmpfile 77 atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 78 check_sa_entries $SOCK_LOCAL $ip_local $ip_peer 79 80 export RUMP_SERVER=$SOCK_PEER 81 cat > $tmpfile <<-EOF 82 add $ip_local $ip_peer $proto 10000 $algo_args; 83 add $ip_peer $ip_local $proto 10001 $algo_args; 84 spdadd $ip_peer $ip_local any -P out ipsec $proto/transport//require; 85 EOF 86 $DEBUG && cat $tmpfile 87 atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 88 check_sa_entries $SOCK_PEER $ip_local $ip_peer 89 90 export RUMP_SERVER=$SOCK_LOCAL 91 atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_peer 92 93 extract_new_packets $BUS > $outfile 94 atf_check -s exit:0 -o match:"$ip_local > $ip_peer: $proto_cap" \ 95 cat $outfile 96 atf_check -s exit:0 -o match:"$ip_peer > $ip_local: $proto_cap" \ 97 cat $outfile 98 99 test_flush_entries $SOCK_LOCAL 100 test_flush_entries $SOCK_PEER 101 } 102 103 test_ipsec6_transport() 104 { 105 local proto=$1 106 local algo=$2 107 local ip_local=fd00::1 108 local ip_peer=fd00::2 109 local tmpfile=./tmp 110 local outfile=./out 111 local proto_cap=$(echo $proto | tr 'a-z' 'A-Z') 112 local algo_args="$(generate_algo_args $proto $algo)" 113 114 rump_server_crypto_start $SOCK_LOCAL netinet6 netipsec 115 rump_server_crypto_start $SOCK_PEER netinet6 netipsec 116 rump_server_add_iface $SOCK_LOCAL shmif0 $BUS 117 rump_server_add_iface $SOCK_PEER shmif0 $BUS 118 119 export RUMP_SERVER=$SOCK_LOCAL 120 atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local 121 atf_check -s exit:0 rump.ifconfig -w 10 122 123 export RUMP_SERVER=$SOCK_PEER 124 atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_peer 125 atf_check -s exit:0 rump.ifconfig -w 10 126 127 extract_new_packets $BUS > $outfile 128 129 export RUMP_SERVER=$SOCK_LOCAL 130 atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_peer 131 132 extract_new_packets $BUS > $outfile 133 atf_check -s exit:0 -o match:"$ip_local > $ip_peer: ICMP6, echo request" \ 134 cat $outfile 135 atf_check -s exit:0 -o match:"$ip_peer > $ip_local: ICMP6, echo reply" \ 136 cat $outfile 137 138 export RUMP_SERVER=$SOCK_LOCAL 139 # from https://www.netbsd.org/docs/network/ipsec/ 140 cat > $tmpfile <<-EOF 141 add $ip_local $ip_peer $proto 10000 $algo_args; 142 add $ip_peer $ip_local $proto 10001 $algo_args; 143 spdadd $ip_local $ip_peer any -P out ipsec $proto/transport//require; 144 EOF 145 $DEBUG && cat $tmpfile 146 atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 147 check_sa_entries $SOCK_LOCAL $ip_local $ip_peer 148 149 export RUMP_SERVER=$SOCK_PEER 150 cat > $tmpfile <<-EOF 151 add $ip_local $ip_peer $proto 10000 $algo_args; 152 add $ip_peer $ip_local $proto 10001 $algo_args; 153 spdadd $ip_peer $ip_local any -P out ipsec $proto/transport//require; 154 EOF 155 $DEBUG && cat $tmpfile 156 atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 157 check_sa_entries $SOCK_PEER $ip_local $ip_peer 158 159 export RUMP_SERVER=$SOCK_LOCAL 160 atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_peer 161 162 extract_new_packets $BUS > $outfile 163 atf_check -s exit:0 -o match:"$ip_local > $ip_peer: $proto_cap" \ 164 cat $outfile 165 atf_check -s exit:0 -o match:"$ip_peer > $ip_local: $proto_cap" \ 166 cat $outfile 167 168 test_flush_entries $SOCK_LOCAL 169 test_flush_entries $SOCK_PEER 170 } 171 172 test_transport_common() 173 { 174 local ipproto=$1 175 local proto=$2 176 local algo=$3 177 178 if [ $ipproto = ipv4 ]; then 179 test_ipsec4_transport $proto $algo 180 else 181 test_ipsec6_transport $proto $algo 182 fi 183 } 184 185 add_test_transport_mode() 186 { 187 local ipproto=$1 188 local proto=$2 189 local algo=$3 190 local _algo=$(echo $algo | sed 's/-//g') 191 local name= desc= 192 193 name="ipsec_transport_${ipproto}_${proto}_${_algo}" 194 desc="Tests of IPsec ($ipproto) transport mode with $proto ($algo)" 195 196 atf_test_case ${name} cleanup 197 eval " \ 198 ${name}_head() { \ 199 atf_set \"descr\" \"$desc\"; \ 200 atf_set \"require.progs\" \"rump_server\" \"setkey\"; \ 201 }; \ 202 ${name}_body() { \ 203 test_transport_common $ipproto $proto $algo; \ 204 rump_server_destroy_ifaces; \ 205 }; \ 206 ${name}_cleanup() { \ 207 $DEBUG && dump; \ 208 cleanup; \ 209 } \ 210 " 211 atf_add_test_case ${name} 212 } 213 214 atf_init_test_cases() 215 { 216 local algo= 217 218 for algo in $ESP_ENCRYPTION_ALGORITHMS; do 219 add_test_transport_mode ipv4 esp $algo 220 add_test_transport_mode ipv6 esp $algo 221 done 222 for algo in $AH_AUTHENTICATION_ALGORITHMS; do 223 add_test_transport_mode ipv4 ah $algo 224 add_test_transport_mode ipv6 ah $algo 225 done 226 } 227
Indexes created Sun Oct 19 02:09:48 GMT 2025