1# 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2021 The FreeBSD Foundation 5# 6# This software was developed by Mark Johnston under sponsorship 7# from the FreeBSD Foundation. 8# 9# Redistribution and use in source and binary forms, with or without 10# modification, are permitted provided that the following conditions 11# are met: 12# 1. Redistributions of source code must retain the above copyright 13# notice, this list of conditions and the following disclaimer. 14# 2. Redistributions in binary form must reproduce the above copyright 15# notice, this list of conditions and the following disclaimer in the 16# documentation and/or other materials provided with the distribution. 17# 18# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28# SUCH DAMAGE. 29 30. $(atf_get_srcdir)/../../common/vnet.subr 31 32atf_test_case "wg_bad_decrypt" "cleanup" 33wg_bad_decrypt_head() 34{ 35 atf_set descr 'Create a wg(4) tunnel over an epair and inject a decryption error' 36 atf_set require.user root 37 atf_set require.kmods if_wg 38} 39 40wg_bad_decrypt_body() 41{ 42 local epair pri1 pri2 pub1 pub2 wg1 wg2 43 local endpoint1 endpoint2 tunnel1 tunnel2 44 45 pri1=$(wg genkey) 46 pri2=$(wg genkey) 47 48 endpoint1=192.168.2.1 49 endpoint2=192.168.2.2 50 tunnel1=169.254.0.1 51 tunnel2=169.254.0.2 52 53 epair=$(vnet_mkepair) 54 55 vnet_init 56 57 vnet_mkjail wgtest1 ${epair}a 58 vnet_mkjail wgtest2 ${epair}b 59 60 jexec wgtest1 ifconfig ${epair}a ${endpoint1}/24 up 61 jexec wgtest2 ifconfig ${epair}b ${endpoint2}/24 up 62 63 wg1=$(jexec wgtest1 ifconfig wg create) 64 echo "$pri1" | jexec wgtest1 wg set $wg1 listen-port 12345 \ 65 private-key /dev/stdin 66 pub1=$(jexec wgtest1 wg show $wg1 public-key) 67 wg2=$(jexec wgtest2 ifconfig wg create) 68 echo "$pri2" | jexec wgtest2 wg set $wg2 listen-port 12345 \ 69 private-key /dev/stdin 70 pub2=$(jexec wgtest2 wg show $wg2 public-key) 71 72 atf_check -s exit:0 -o ignore \ 73 jexec wgtest1 wg set $wg1 peer "$pub2" \ 74 endpoint ${endpoint2}:12345 allowed-ips ${tunnel2}/32 75 atf_check -s exit:0 \ 76 jexec wgtest1 ifconfig $wg1 inet ${tunnel1}/24 up 77 78 atf_check -s exit:0 -o ignore \ 79 jexec wgtest2 wg set $wg2 peer "$pub1" \ 80 endpoint ${endpoint1}:12345 allowed-ips ${tunnel1}/32 81 atf_check -s exit:0 \ 82 jexec wgtest2 ifconfig $wg2 inet ${tunnel2}/24 up 83 84 # Generous timeout since the handshake takes some time. 85 atf_check -s exit:0 -o ignore jexec wgtest1 ping -c 1 -t 5 $tunnel2 86 87 # No receive errors before injection 88 ierrs=$(netstat -j wgtest2 -I $wg2 --libxo json,pretty | \ 89 awk '/received-errors/ { print $2 }') 90 atf_check_equal "0," "$ierrs" 91 92 # Trigger a decryption error 93 atf_check -s exit:0 -o ignore \ 94 sysctl debug.fail_point.crypto.inject_badmsg="1*return" 95 96 atf_check -s exit:2 -o ignore jexec wgtest1 ping -c 1 -t 5 $tunnel2 97 98 ierrs=$(netstat -j wgtest2 -I $wg2 --libxo json,pretty | \ 99 awk '/received-errors/ { print $2 }') 100 atf_check_equal "1," "$ierrs" 101} 102 103wg_bad_decrypt_cleanup() 104{ 105 vnet_cleanup 106} 107 108atf_init_test_cases() 109{ 110 atf_add_test_case "wg_bad_decrypt" 111} 112