Home | History | Annotate | Line # | Download | only in ipsec
t_ipsec_tunnel.sh revision 1.4 
      1 #	$NetBSD: t_ipsec_tunnel.sh,v 1.4 2017/05/09 04:25:28 ozaki-r Exp $
      2 #
      3 # Copyright (c) 2017 Internet Initiative Japan Inc.
      4 # All rights reserved.
      5 #
      6 # Redistribution and use in source and binary forms, with or without
      7 # modification, are permitted provided that the following conditions
      8 # are met:
      9 # 1. Redistributions of source code must retain the above copyright
     10 #    notice, this list of conditions and the following disclaimer.
     11 # 2. Redistributions in binary form must reproduce the above copyright
     12 #    notice, this list of conditions and the following disclaimer in the
     13 #    documentation and/or other materials provided with the distribution.
     14 #
     15 # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     16 # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     17 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     18 # PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     19 # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     20 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     21 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     22 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     23 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     24 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     25 # POSSIBILITY OF SUCH DAMAGE.
     26 #
     27 
     28 SOCK_LOCAL=unix://ipsec_local
     29 SOCK_TUNNEL_LOCAL=unix://ipsec_tunel_local
     30 SOCK_TUNNEL_REMOTE=unix://ipsec_tunnel_remote
     31 SOCK_REMOTE=unix://ipsec_remote
     32 BUS_LOCAL=./bus_ipsec_local
     33 BUS_TUNNEL=./bus_ipsec_tunnel
     34 BUS_REMOTE=./bus_ipsec_remote
     35 
     36 DEBUG=${DEBUG:-false}
     37 
     38 test_ipsec4_tunnel()
     39 {
     40 	local proto=$1
     41 	local algo=$2
     42 	local ip_local=10.0.1.2
     43 	local ip_gw_local=10.0.1.1
     44 	local ip_gw_local_tunnel=20.0.0.1
     45 	local ip_gw_remote_tunnel=20.0.0.2
     46 	local ip_gw_remote=10.0.2.1
     47 	local ip_remote=10.0.2.2
     48 	local subnet_local=10.0.1.0
     49 	local subnet_remote=10.0.2.0
     50 	local keylen=$(get_one_valid_keylen $algo)
     51 	local key=$(generate_key $keylen)
     52 	local tmpfile=./tmp
     53 	local outfile=./out
     54 	local opt= proto_cap=
     55 
     56 	if [ $proto = esp ]; then
     57 		opt=-E
     58 		proto_cap=ESP
     59 	else
     60 		opt=-A
     61 		proto_cap=AH
     62 	fi
     63 
     64 	# See https://www.netbsd.org/docs/network/ipsec/#sample_vpn
     65 	rump_server_crypto_start $SOCK_LOCAL
     66 	rump_server_crypto_start $SOCK_TUNNEL_LOCAL netipsec
     67 	rump_server_crypto_start $SOCK_TUNNEL_REMOTE netipsec
     68 	rump_server_crypto_start $SOCK_REMOTE
     69 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
     70 	rump_server_add_iface $SOCK_TUNNEL_LOCAL shmif0 $BUS_LOCAL
     71 	rump_server_add_iface $SOCK_TUNNEL_LOCAL shmif1 $BUS_TUNNEL
     72 	rump_server_add_iface $SOCK_TUNNEL_REMOTE shmif0 $BUS_REMOTE
     73 	rump_server_add_iface $SOCK_TUNNEL_REMOTE shmif1 $BUS_TUNNEL
     74 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
     75 
     76 	export RUMP_SERVER=$SOCK_LOCAL
     77 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
     78 	atf_check -s exit:0 -o ignore \
     79 	    rump.route -n add -net $subnet_remote $ip_gw_local
     80 
     81 	export RUMP_SERVER=$SOCK_TUNNEL_LOCAL
     82 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_local/24
     83 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gw_local_tunnel/24
     84 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1
     85 	atf_check -s exit:0 -o ignore \
     86 	    rump.route -n add -net $subnet_remote $ip_gw_remote_tunnel
     87 
     88 	export RUMP_SERVER=$SOCK_TUNNEL_REMOTE
     89 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_remote/24
     90 	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gw_remote_tunnel/24
     91 	atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1
     92 	atf_check -s exit:0 -o ignore \
     93 	    rump.route -n add -net $subnet_local $ip_gw_local_tunnel
     94 
     95 	export RUMP_SERVER=$SOCK_REMOTE
     96 	atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24
     97 	# Run ifconfig -w 10 just once for optimization
     98 	atf_check -s exit:0 rump.ifconfig -w 10
     99 	atf_check -s exit:0 -o ignore \
    100 	    rump.route -n add -net $subnet_local $ip_gw_remote
    101 
    102 	extract_new_packets $BUS_TUNNEL > $outfile
    103 
    104 	export RUMP_SERVER=$SOCK_LOCAL
    105 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    106 
    107 	extract_new_packets $BUS_TUNNEL > $outfile
    108 	atf_check -s exit:0 \
    109 	    -o match:"$ip_local > $ip_remote: ICMP echo request" \
    110 	    cat $outfile
    111 	atf_check -s exit:0 \
    112 	    -o match:"$ip_remote > $ip_local: ICMP echo reply" \
    113 	    cat $outfile
    114 
    115 	export RUMP_SERVER=$SOCK_TUNNEL_LOCAL
    116 	# from https://www.netbsd.org/docs/network/ipsec/
    117 	cat > $tmpfile <<-EOF
    118 	add $ip_gw_local_tunnel $ip_gw_remote_tunnel $proto 10000 $opt $algo $key;
    119 	add $ip_gw_remote_tunnel $ip_gw_local_tunnel $proto 10001 $opt $algo $key;
    120 	spdadd $subnet_local/24 $subnet_remote/24 any -P out ipsec
    121 	    $proto/tunnel/$ip_gw_local_tunnel-$ip_gw_remote_tunnel/require;
    122 	spdadd $subnet_remote/24 $subnet_local/24 any -P in ipsec
    123 	    $proto/tunnel/$ip_gw_remote_tunnel-$ip_gw_local_tunnel/require;
    124 	EOF
    125 	$DEBUG && cat $tmpfile
    126 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    127 	$DEBUG && $HIJACKING setkey -D
    128 	atf_check -s exit:0 \
    129 	    -o match:"$ip_gw_local_tunnel $ip_gw_remote_tunnel" \
    130 	    $HIJACKING setkey -D
    131 	atf_check -s exit:0 \
    132 	    -o match:"$ip_gw_remote_tunnel $ip_gw_local_tunnel" \
    133 	    $HIJACKING setkey -D
    134 	# TODO: more detail checks
    135 
    136 	export RUMP_SERVER=$SOCK_TUNNEL_REMOTE
    137 	cat > $tmpfile <<-EOF
    138 	add $ip_gw_local_tunnel $ip_gw_remote_tunnel $proto 10000 $opt $algo $key;
    139 	add $ip_gw_remote_tunnel $ip_gw_local_tunnel $proto 10001 $opt $algo $key;
    140 	spdadd $subnet_remote/24 $subnet_local/24 any -P out ipsec
    141 	    $proto/tunnel/$ip_gw_remote_tunnel-$ip_gw_local_tunnel/require;
    142 	spdadd $subnet_local/24 $subnet_remote/24 any -P in ipsec
    143 	    $proto/tunnel/$ip_gw_local_tunnel-$ip_gw_remote_tunnel/require;
    144 	EOF
    145 	$DEBUG && cat $tmpfile
    146 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    147 	$DEBUG && $HIJACKING setkey -D
    148 	atf_check -s exit:0 \
    149 	    -o match:"$ip_gw_local_tunnel $ip_gw_remote_tunnel" \
    150 	    $HIJACKING setkey -D
    151 	atf_check -s exit:0 \
    152 	    -o match:"$ip_gw_remote_tunnel $ip_gw_local_tunnel" \
    153 	    $HIJACKING setkey -D
    154 	# TODO: more detail checks
    155 
    156 	export RUMP_SERVER=$SOCK_LOCAL
    157 	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
    158 
    159 	extract_new_packets $BUS_TUNNEL > $outfile
    160 	atf_check -s exit:0 \
    161 	    -o match:"$ip_gw_local_tunnel > $ip_gw_remote_tunnel: $proto_cap" \
    162 	    cat $outfile
    163 	atf_check -s exit:0 \
    164 	    -o match:"$ip_gw_remote_tunnel > $ip_gw_local_tunnel: $proto_cap" \
    165 	    cat $outfile
    166 
    167 	test_flush_entries $SOCK_TUNNEL_LOCAL
    168 	test_flush_entries $SOCK_TUNNEL_REMOTE
    169 }
    170 
    171 test_ipsec6_tunnel()
    172 {
    173 	local proto=$1
    174 	local algo=$2
    175 	local ip_local=fd00:1::2
    176 	local ip_gw_local=fd00:1::1
    177 	local ip_gw_local_tunnel=fc00::1
    178 	local ip_gw_remote_tunnel=fc00::2
    179 	local ip_gw_remote=fd00:2::1
    180 	local ip_remote=fd00:2::2
    181 	local subnet_local=fd00:1::
    182 	local subnet_remote=fd00:2::
    183 	local keylen=$(get_one_valid_keylen $algo)
    184 	local key=$(generate_key $keylen)
    185 	local tmpfile=./tmp
    186 	local outfile=./out
    187 	local opt= proto_cap=
    188 
    189 	if [ $proto = esp ]; then
    190 		opt=-E
    191 		proto_cap=ESP
    192 	else
    193 		opt=-A
    194 		proto_cap=AH
    195 	fi
    196 
    197 	rump_server_crypto_start $SOCK_LOCAL netinet6
    198 	rump_server_crypto_start $SOCK_TUNNEL_LOCAL netipsec netinet6
    199 	rump_server_crypto_start $SOCK_TUNNEL_REMOTE netipsec netinet6
    200 	rump_server_crypto_start $SOCK_REMOTE netinet6
    201 	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
    202 	rump_server_add_iface $SOCK_TUNNEL_LOCAL shmif0 $BUS_LOCAL
    203 	rump_server_add_iface $SOCK_TUNNEL_LOCAL shmif1 $BUS_TUNNEL
    204 	rump_server_add_iface $SOCK_TUNNEL_REMOTE shmif0 $BUS_REMOTE
    205 	rump_server_add_iface $SOCK_TUNNEL_REMOTE shmif1 $BUS_TUNNEL
    206 	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
    207 
    208 	export RUMP_SERVER=$SOCK_LOCAL
    209 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local/64
    210 	atf_check -s exit:0 -o ignore \
    211 	    rump.route -n add -inet6 -net $subnet_remote/64 $ip_gw_local
    212 
    213 	export RUMP_SERVER=$SOCK_TUNNEL_LOCAL
    214 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_local/64
    215 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gw_local_tunnel/64
    216 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1
    217 	atf_check -s exit:0 -o ignore \
    218 	    rump.route -n add -inet6 -net $subnet_remote/64 $ip_gw_remote_tunnel
    219 
    220 	export RUMP_SERVER=$SOCK_TUNNEL_REMOTE
    221 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_remote/64
    222 	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gw_remote_tunnel/64
    223 	atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1
    224 	atf_check -s exit:0 -o ignore \
    225 	    rump.route -n add -inet6 -net $subnet_local/64 $ip_gw_local_tunnel
    226 
    227 	export RUMP_SERVER=$SOCK_REMOTE
    228 	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_remote
    229 	# Run ifconfig -w 10 just once for optimization
    230 	atf_check -s exit:0 rump.ifconfig -w 10
    231 	atf_check -s exit:0 -o ignore \
    232 	    rump.route -n add -inet6 -net $subnet_local/64 $ip_gw_remote
    233 
    234 	extract_new_packets $BUS_TUNNEL > $outfile
    235 
    236 	export RUMP_SERVER=$SOCK_LOCAL
    237 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    238 
    239 	extract_new_packets $BUS_TUNNEL > $outfile
    240 	atf_check -s exit:0 \
    241 	    -o match:"$ip_local > $ip_remote: ICMP6, echo request" \
    242 	    cat $outfile
    243 	atf_check -s exit:0 \
    244 	    -o match:"$ip_remote > $ip_local: ICMP6, echo reply" \
    245 	    cat $outfile
    246 
    247 	export RUMP_SERVER=$SOCK_TUNNEL_LOCAL
    248 	# from https://www.netbsd.org/docs/network/ipsec/
    249 	cat > $tmpfile <<-EOF
    250 	add $ip_gw_local_tunnel $ip_gw_remote_tunnel $proto 10000 $opt $algo $key;
    251 	add $ip_gw_remote_tunnel $ip_gw_local_tunnel $proto 10001 $opt $algo $key;
    252 	spdadd $subnet_local/64 $subnet_remote/64 any -P out ipsec
    253 	    $proto/tunnel/$ip_gw_local_tunnel-$ip_gw_remote_tunnel/require;
    254 	spdadd $subnet_remote/64 $subnet_local/64 any -P in ipsec
    255 	    $proto/tunnel/$ip_gw_remote_tunnel-$ip_gw_local_tunnel/require;
    256 	EOF
    257 	$DEBUG && cat $tmpfile
    258 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    259 	$DEBUG && $HIJACKING setkey -D
    260 	atf_check -s exit:0 \
    261 	    -o match:"$ip_gw_local_tunnel $ip_gw_remote_tunnel" \
    262 	    $HIJACKING setkey -D
    263 	atf_check -s exit:0 \
    264 	    -o match:"$ip_gw_remote_tunnel $ip_gw_local_tunnel" \
    265 	    $HIJACKING setkey -D
    266 	# TODO: more detail checks
    267 
    268 	export RUMP_SERVER=$SOCK_TUNNEL_REMOTE
    269 	cat > $tmpfile <<-EOF
    270 	add $ip_gw_local_tunnel $ip_gw_remote_tunnel $proto 10000 $opt $algo $key;
    271 	add $ip_gw_remote_tunnel $ip_gw_local_tunnel $proto 10001 $opt $algo $key;
    272 	spdadd $subnet_remote/64 $subnet_local/64 any -P out ipsec
    273 	    $proto/tunnel/$ip_gw_remote_tunnel-$ip_gw_local_tunnel/require;
    274 	spdadd $subnet_local/64 $subnet_remote/64 any -P in ipsec
    275 	    $proto/tunnel/$ip_gw_local_tunnel-$ip_gw_remote_tunnel/require;
    276 	EOF
    277 	$DEBUG && cat $tmpfile
    278 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
    279 	$DEBUG && $HIJACKING setkey -D
    280 	atf_check -s exit:0 \
    281 	    -o match:"$ip_gw_local_tunnel $ip_gw_remote_tunnel" \
    282 	    $HIJACKING setkey -D
    283 	atf_check -s exit:0 \
    284 	    -o match:"$ip_gw_remote_tunnel $ip_gw_local_tunnel" \
    285 	    $HIJACKING setkey -D
    286 	# TODO: more detail checks
    287 
    288 	export RUMP_SERVER=$SOCK_LOCAL
    289 	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
    290 
    291 	extract_new_packets $BUS_TUNNEL > $outfile
    292 	atf_check -s exit:0 \
    293 	    -o match:"$ip_gw_local_tunnel > $ip_gw_remote_tunnel: $proto_cap" \
    294 	    cat $outfile
    295 	atf_check -s exit:0 \
    296 	    -o match:"$ip_gw_remote_tunnel > $ip_gw_local_tunnel: $proto_cap" \
    297 	    cat $outfile
    298 
    299 	test_flush_entries $SOCK_TUNNEL_LOCAL
    300 	test_flush_entries $SOCK_TUNNEL_REMOTE
    301 }
    302 
    303 test_tunnel_common()
    304 {
    305 	local ipproto=$1
    306 	local proto=$2
    307 	local algo=$3
    308 
    309 	if [ $ipproto = ipv4 ]; then
    310 		test_ipsec4_tunnel $proto $algo
    311 	else
    312 		test_ipsec6_tunnel $proto $algo
    313 	fi
    314 }
    315 
    316 add_test_tunnel_mode()
    317 {
    318 	local ipproto=$1
    319 	local proto=$2
    320 	local algo=$3
    321 	local _algo=$(echo $algo | sed 's/-//g')
    322 	local name= desc=
    323 
    324 	name="ipsec_tunnel_${ipproto}_${proto}_${_algo}"
    325 	desc="Tests of IPsec ($ipproto) tunnel mode with $proto ($algo)"
    326 
    327 	atf_test_case ${name} cleanup
    328 	eval "								\
    329 	    ${name}_head() {						\
    330 	        atf_set \"descr\" \"$desc\";				\
    331 	        atf_set \"require.progs\" \"rump_server\" \"setkey\";	\
    332 	    };								\
    333 	    ${name}_body() {						\
    334 	        test_tunnel_common $ipproto $proto $algo;		\
    335 	        rump_server_destroy_ifaces;				\
    336 	    };								\
    337 	    ${name}_cleanup() {						\
    338 	        $DEBUG && dump;						\
    339 	        cleanup;						\
    340 	    }								\
    341 	"
    342 	atf_add_test_case ${name}
    343 }
    344 
    345 atf_init_test_cases()
    346 {
    347 	local algo=
    348 
    349 	for algo in $ESP_ENCRYPTION_ALGORITHMS; do
    350 		add_test_tunnel_mode ipv4 esp $algo
    351 		add_test_tunnel_mode ipv6 esp $algo
    352 	done
    353 
    354 	for algo in $AH_AUTHENTICATION_ALGORITHMS; do
    355 		add_test_tunnel_mode ipv4 ah $algo
    356 		add_test_tunnel_mode ipv6 ah $algo
    357 	done
    358 }
    359