t_ipsec_tunnel.sh revision 1.6
1 # $NetBSD: t_ipsec_tunnel.sh,v 1.6 2017/05/10 08:59:40 ozaki-r Exp $ 2 # 3 # Copyright (c) 2017 Internet Initiative Japan Inc. 4 # All rights reserved. 5 # 6 # Redistribution and use in source and binary forms, with or without 7 # modification, are permitted provided that the following conditions 8 # are met: 9 # 1. Redistributions of source code must retain the above copyright 10 # notice, this list of conditions and the following disclaimer. 11 # 2. Redistributions in binary form must reproduce the above copyright 12 # notice, this list of conditions and the following disclaimer in the 13 # documentation and/or other materials provided with the distribution. 14 # 15 # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 16 # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 17 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 18 # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 19 # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 # POSSIBILITY OF SUCH DAMAGE. 26 # 27 28 SOCK_LOCAL=unix://ipsec_local 29 SOCK_TUNNEL_LOCAL=unix://ipsec_tunel_local 30 SOCK_TUNNEL_REMOTE=unix://ipsec_tunnel_remote 31 SOCK_REMOTE=unix://ipsec_remote 32 BUS_LOCAL=./bus_ipsec_local 33 BUS_TUNNEL=./bus_ipsec_tunnel 34 BUS_REMOTE=./bus_ipsec_remote 35 36 DEBUG=${DEBUG:-false} 37 38 setup_servers() 39 { 40 41 # See https://www.netbsd.org/docs/network/ipsec/#sample_vpn 42 rump_server_crypto_start $SOCK_LOCAL netinet6 43 rump_server_crypto_start $SOCK_TUNNEL_LOCAL netipsec netinet6 44 rump_server_crypto_start $SOCK_TUNNEL_REMOTE netipsec netinet6 45 rump_server_crypto_start $SOCK_REMOTE netinet6 46 rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL 47 rump_server_add_iface $SOCK_TUNNEL_LOCAL shmif0 $BUS_LOCAL 48 rump_server_add_iface $SOCK_TUNNEL_LOCAL shmif1 $BUS_TUNNEL 49 rump_server_add_iface $SOCK_TUNNEL_REMOTE shmif0 $BUS_REMOTE 50 rump_server_add_iface $SOCK_TUNNEL_REMOTE shmif1 $BUS_TUNNEL 51 rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE 52 } 53 54 check_tunnel_packets() 55 { 56 local outfile=$1 57 local src=$2 58 local dst=$3 59 local proto=$4 60 61 atf_check -s exit:0 -o match:"$src > $dst: $proto" cat $outfile 62 atf_check -s exit:0 -o match:"$dst > $src: $proto" cat $outfile 63 } 64 65 test_ipsec4_tunnel() 66 { 67 local proto=$1 68 local algo=$2 69 local ip_local=10.0.1.2 70 local ip_gw_local=10.0.1.1 71 local ip_gw_local_tunnel=20.0.0.1 72 local ip_gw_remote_tunnel=20.0.0.2 73 local ip_gw_remote=10.0.2.1 74 local ip_remote=10.0.2.2 75 local subnet_local=10.0.1.0 76 local subnet_remote=10.0.2.0 77 local keylen=$(get_one_valid_keylen $algo) 78 local key=$(generate_key $keylen) 79 local tmpfile=./tmp 80 local outfile=./out 81 local opt= proto_cap= 82 83 if [ $proto = esp ]; then 84 opt=-E 85 proto_cap=ESP 86 else 87 opt=-A 88 proto_cap=AH 89 fi 90 91 setup_servers 92 93 export RUMP_SERVER=$SOCK_LOCAL 94 atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24 95 atf_check -s exit:0 -o ignore \ 96 rump.route -n add -net $subnet_remote $ip_gw_local 97 98 export RUMP_SERVER=$SOCK_TUNNEL_LOCAL 99 atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_local/24 100 atf_check -s exit:0 rump.ifconfig shmif1 $ip_gw_local_tunnel/24 101 atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1 102 atf_check -s exit:0 -o ignore \ 103 rump.route -n add -net $subnet_remote $ip_gw_remote_tunnel 104 105 export RUMP_SERVER=$SOCK_TUNNEL_REMOTE 106 atf_check -s exit:0 rump.ifconfig shmif0 $ip_gw_remote/24 107 atf_check -s exit:0 rump.ifconfig shmif1 $ip_gw_remote_tunnel/24 108 atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.forwarding=1 109 atf_check -s exit:0 -o ignore \ 110 rump.route -n add -net $subnet_local $ip_gw_local_tunnel 111 112 export RUMP_SERVER=$SOCK_REMOTE 113 atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24 114 # Run ifconfig -w 10 just once for optimization 115 atf_check -s exit:0 rump.ifconfig -w 10 116 atf_check -s exit:0 -o ignore \ 117 rump.route -n add -net $subnet_local $ip_gw_remote 118 119 extract_new_packets $BUS_TUNNEL > $outfile 120 121 export RUMP_SERVER=$SOCK_LOCAL 122 atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote 123 124 extract_new_packets $BUS_TUNNEL > $outfile 125 atf_check -s exit:0 \ 126 -o match:"$ip_local > $ip_remote: ICMP echo request" \ 127 cat $outfile 128 atf_check -s exit:0 \ 129 -o match:"$ip_remote > $ip_local: ICMP echo reply" \ 130 cat $outfile 131 132 export RUMP_SERVER=$SOCK_TUNNEL_LOCAL 133 # from https://www.netbsd.org/docs/network/ipsec/ 134 cat > $tmpfile <<-EOF 135 add $ip_gw_local_tunnel $ip_gw_remote_tunnel $proto 10000 $opt $algo $key; 136 add $ip_gw_remote_tunnel $ip_gw_local_tunnel $proto 10001 $opt $algo $key; 137 spdadd $subnet_local/24 $subnet_remote/24 any -P out ipsec 138 $proto/tunnel/$ip_gw_local_tunnel-$ip_gw_remote_tunnel/require; 139 spdadd $subnet_remote/24 $subnet_local/24 any -P in ipsec 140 $proto/tunnel/$ip_gw_remote_tunnel-$ip_gw_local_tunnel/require; 141 EOF 142 $DEBUG && cat $tmpfile 143 atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 144 check_sa_entries $SOCK_TUNNEL_LOCAL $ip_gw_local_tunnel \ 145 $ip_gw_remote_tunnel 146 147 export RUMP_SERVER=$SOCK_TUNNEL_REMOTE 148 cat > $tmpfile <<-EOF 149 add $ip_gw_local_tunnel $ip_gw_remote_tunnel $proto 10000 $opt $algo $key; 150 add $ip_gw_remote_tunnel $ip_gw_local_tunnel $proto 10001 $opt $algo $key; 151 spdadd $subnet_remote/24 $subnet_local/24 any -P out ipsec 152 $proto/tunnel/$ip_gw_remote_tunnel-$ip_gw_local_tunnel/require; 153 spdadd $subnet_local/24 $subnet_remote/24 any -P in ipsec 154 $proto/tunnel/$ip_gw_local_tunnel-$ip_gw_remote_tunnel/require; 155 EOF 156 $DEBUG && cat $tmpfile 157 atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 158 check_sa_entries $SOCK_TUNNEL_REMOTE $ip_gw_local_tunnel \ 159 $ip_gw_remote_tunnel 160 161 export RUMP_SERVER=$SOCK_LOCAL 162 atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote 163 164 extract_new_packets $BUS_TUNNEL > $outfile 165 check_tunnel_packets $outfile $ip_gw_local_tunnel $ip_gw_remote_tunnel \ 166 $proto_cap 167 168 test_flush_entries $SOCK_TUNNEL_LOCAL 169 test_flush_entries $SOCK_TUNNEL_REMOTE 170 } 171 172 test_ipsec6_tunnel() 173 { 174 local proto=$1 175 local algo=$2 176 local ip_local=fd00:1::2 177 local ip_gw_local=fd00:1::1 178 local ip_gw_local_tunnel=fc00::1 179 local ip_gw_remote_tunnel=fc00::2 180 local ip_gw_remote=fd00:2::1 181 local ip_remote=fd00:2::2 182 local subnet_local=fd00:1:: 183 local subnet_remote=fd00:2:: 184 local keylen=$(get_one_valid_keylen $algo) 185 local key=$(generate_key $keylen) 186 local tmpfile=./tmp 187 local outfile=./out 188 local opt= proto_cap= 189 190 if [ $proto = esp ]; then 191 opt=-E 192 proto_cap=ESP 193 else 194 opt=-A 195 proto_cap=AH 196 fi 197 198 setup_servers 199 200 export RUMP_SERVER=$SOCK_LOCAL 201 atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local/64 202 atf_check -s exit:0 -o ignore \ 203 rump.route -n add -inet6 -net $subnet_remote/64 $ip_gw_local 204 205 export RUMP_SERVER=$SOCK_TUNNEL_LOCAL 206 atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_local/64 207 atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gw_local_tunnel/64 208 atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1 209 atf_check -s exit:0 -o ignore \ 210 rump.route -n add -inet6 -net $subnet_remote/64 $ip_gw_remote_tunnel 211 212 export RUMP_SERVER=$SOCK_TUNNEL_REMOTE 213 atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_gw_remote/64 214 atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gw_remote_tunnel/64 215 atf_check -s exit:0 rump.sysctl -q -w net.inet6.ip6.forwarding=1 216 atf_check -s exit:0 -o ignore \ 217 rump.route -n add -inet6 -net $subnet_local/64 $ip_gw_local_tunnel 218 219 export RUMP_SERVER=$SOCK_REMOTE 220 atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_remote 221 # Run ifconfig -w 10 just once for optimization 222 atf_check -s exit:0 rump.ifconfig -w 10 223 atf_check -s exit:0 -o ignore \ 224 rump.route -n add -inet6 -net $subnet_local/64 $ip_gw_remote 225 226 extract_new_packets $BUS_TUNNEL > $outfile 227 228 export RUMP_SERVER=$SOCK_LOCAL 229 atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote 230 231 extract_new_packets $BUS_TUNNEL > $outfile 232 atf_check -s exit:0 \ 233 -o match:"$ip_local > $ip_remote: ICMP6, echo request" \ 234 cat $outfile 235 atf_check -s exit:0 \ 236 -o match:"$ip_remote > $ip_local: ICMP6, echo reply" \ 237 cat $outfile 238 239 export RUMP_SERVER=$SOCK_TUNNEL_LOCAL 240 # from https://www.netbsd.org/docs/network/ipsec/ 241 cat > $tmpfile <<-EOF 242 add $ip_gw_local_tunnel $ip_gw_remote_tunnel $proto 10000 $opt $algo $key; 243 add $ip_gw_remote_tunnel $ip_gw_local_tunnel $proto 10001 $opt $algo $key; 244 spdadd $subnet_local/64 $subnet_remote/64 any -P out ipsec 245 $proto/tunnel/$ip_gw_local_tunnel-$ip_gw_remote_tunnel/require; 246 spdadd $subnet_remote/64 $subnet_local/64 any -P in ipsec 247 $proto/tunnel/$ip_gw_remote_tunnel-$ip_gw_local_tunnel/require; 248 EOF 249 $DEBUG && cat $tmpfile 250 atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 251 check_sa_entries $SOCK_TUNNEL_LOCAL $ip_gw_local_tunnel \ 252 $ip_gw_remote_tunnel 253 254 export RUMP_SERVER=$SOCK_TUNNEL_REMOTE 255 cat > $tmpfile <<-EOF 256 add $ip_gw_local_tunnel $ip_gw_remote_tunnel $proto 10000 $opt $algo $key; 257 add $ip_gw_remote_tunnel $ip_gw_local_tunnel $proto 10001 $opt $algo $key; 258 spdadd $subnet_remote/64 $subnet_local/64 any -P out ipsec 259 $proto/tunnel/$ip_gw_remote_tunnel-$ip_gw_local_tunnel/require; 260 spdadd $subnet_local/64 $subnet_remote/64 any -P in ipsec 261 $proto/tunnel/$ip_gw_local_tunnel-$ip_gw_remote_tunnel/require; 262 EOF 263 $DEBUG && cat $tmpfile 264 atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile 265 check_sa_entries $SOCK_TUNNEL_REMOTE $ip_gw_local_tunnel \ 266 $ip_gw_remote_tunnel 267 268 export RUMP_SERVER=$SOCK_LOCAL 269 atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote 270 271 extract_new_packets $BUS_TUNNEL > $outfile 272 check_tunnel_packets $outfile $ip_gw_local_tunnel $ip_gw_remote_tunnel \ 273 $proto_cap 274 275 test_flush_entries $SOCK_TUNNEL_LOCAL 276 test_flush_entries $SOCK_TUNNEL_REMOTE 277 } 278 279 test_tunnel_common() 280 { 281 local ipproto=$1 282 local proto=$2 283 local algo=$3 284 285 if [ $ipproto = ipv4 ]; then 286 test_ipsec4_tunnel $proto $algo 287 else 288 test_ipsec6_tunnel $proto $algo 289 fi 290 } 291 292 add_test_tunnel_mode() 293 { 294 local ipproto=$1 295 local proto=$2 296 local algo=$3 297 local _algo=$(echo $algo | sed 's/-//g') 298 local name= desc= 299 300 name="ipsec_tunnel_${ipproto}_${proto}_${_algo}" 301 desc="Tests of IPsec ($ipproto) tunnel mode with $proto ($algo)" 302 303 atf_test_case ${name} cleanup 304 eval " \ 305 ${name}_head() { \ 306 atf_set \"descr\" \"$desc\"; \ 307 atf_set \"require.progs\" \"rump_server\" \"setkey\"; \ 308 }; \ 309 ${name}_body() { \ 310 test_tunnel_common $ipproto $proto $algo; \ 311 rump_server_destroy_ifaces; \ 312 }; \ 313 ${name}_cleanup() { \ 314 $DEBUG && dump; \ 315 cleanup; \ 316 } \ 317 " 318 atf_add_test_case ${name} 319 } 320 321 atf_init_test_cases() 322 { 323 local algo= 324 325 for algo in $ESP_ENCRYPTION_ALGORITHMS; do 326 add_test_tunnel_mode ipv4 esp $algo 327 add_test_tunnel_mode ipv6 esp $algo 328 done 329 330 for algo in $AH_AUTHENTICATION_ALGORITHMS; do 331 add_test_tunnel_mode ipv4 ah $algo 332 add_test_tunnel_mode ipv6 ah $algo 333 done 334 } 335
Indexes created Mon Sep 29 13:09:55 GMT 2025