1# Utility functions (mainly from pf tests, should be merged one day) 2## 3 4: ${TMPDIR=/tmp} 5 6. $(atf_get_srcdir)/../../common/vnet.subr 7 8ist_init() 9{ 10 if ! sysctl -q kern.features.ipsec >/dev/null ; then 11 atf_skip "This test requires ipsec" 12 fi 13 14 vnet_init 15} 16 17ist_labsetup () 18{ 19 epair_LAN_A=$(vnet_mkepair) 20 ifconfig ${epair_LAN_A}a up 21 epair_PUB_A=$(vnet_mkepair) 22 ifconfig ${epair_PUB_A}a up 23 epair_LAN_B=$(vnet_mkepair) 24 ifconfig ${epair_LAN_B}a up 25 epair_PUB_B=$(vnet_mkepair) 26 ifconfig ${epair_PUB_B}a up 27 28 vnet_mkjail hostA ${epair_LAN_A}a 29 vnet_mkjail ipsecA ${epair_LAN_A}b ${epair_PUB_A}a 30 vnet_mkjail router ${epair_PUB_A}b ${epair_PUB_B}b 31 vnet_mkjail ipsecB ${epair_LAN_B}b ${epair_PUB_B}a 32 vnet_mkjail hostB ${epair_LAN_B}a 33} 34 35ist_v4_setup () 36{ 37 jexec hostA ifconfig ${epair_LAN_A}a 192.0.2.1/30 up 38 jexec ipsecA ifconfig ${epair_LAN_A}b 192.0.2.2/30 up 39 jexec ipsecA ifconfig ${epair_PUB_A}a 198.51.100.2/30 up 40 jexec router ifconfig ${epair_PUB_A}b 198.51.100.1/30 up 41 jexec router ifconfig ${epair_PUB_B}b 198.51.100.5/30 up 42 jexec ipsecB ifconfig ${epair_PUB_B}a 198.51.100.6/30 up 43 jexec ipsecB ifconfig ${epair_LAN_B}b 203.0.113.2/30 up 44 jexec hostB ifconfig ${epair_LAN_B}a 203.0.113.1/30 up 45 jexec ipsecA sysctl net.inet.ip.forwarding=1 46 jexec router sysctl net.inet.ip.forwarding=1 47 jexec ipsecB sysctl net.inet.ip.forwarding=1 48 jexec hostA route add default 192.0.2.2 49 jexec ipsecA route add default 198.51.100.1 50 jexec ipsecB route add default 198.51.100.5 51 jexec hostB route add default 203.0.113.2 52} 53 54ist_v6_setup () 55{ 56 jexec hostA ifconfig ${epair_LAN_A}a inet6 2001:db8:1::1/64 up no_dad 57 jexec ipsecA ifconfig ${epair_LAN_A}b inet6 2001:db8:1::2/64 up no_dad 58 jexec ipsecA ifconfig ${epair_PUB_A}a inet6 2001:db8:23::2/64 up no_dad 59 jexec router ifconfig ${epair_PUB_A}b inet6 2001:db8:23::3/64 up no_dad 60 jexec router ifconfig ${epair_PUB_B}b inet6 2001:db8:34::3/64 up no_dad 61 jexec ipsecB ifconfig ${epair_PUB_B}a inet6 2001:db8:34::2/64 up no_dad 62 jexec ipsecB ifconfig ${epair_LAN_B}b inet6 2001:db8:45::2/64 up no_dad 63 jexec hostB ifconfig ${epair_LAN_B}a inet6 2001:db8:45::1/64 up no_dad 64 jexec ipsecA sysctl net.inet6.ip6.forwarding=1 65 jexec router sysctl net.inet6.ip6.forwarding=1 66 jexec ipsecB sysctl net.inet6.ip6.forwarding=1 67 jexec hostA route -6 add default 2001:db8:1::2 68 jexec ipsecA route -6 add default 2001:db8:23::3 69 jexec ipsecB route -6 add default 2001:db8:34::3 70 jexec hostB route -6 add default 2001:db8:45::2 71} 72 73ist_setkey() 74{ 75 jname=$1 76 dir=$2 77 afnet=$3 78 enc_algo=$4 79 enc_key=$5 80 auth_algo=$6 81 auth_key=$7 82 83 # Load 84 ( 85 printf "#arguments debug: ${jname} ${afnet} ${dir} ${enc_algo} " 86 printf "${enc_key} ${auth_algo} ${auth_key}\n" 87 printf "flush;\n" 88 printf "spdflush;\n" 89 if [ ${afnet} -eq 4 ]; then 90 SRC_LAN="192.0.2.0/24" 91 DST_LAN="203.0.113.0/24" 92 SRC_GW="198.51.100.2" 93 DST_GW="198.51.100.6" 94 else 95 SRC_LAN="2001:db8:1::/64" 96 DST_LAN="2001:db8:45::/64" 97 SRC_GW="2001:db8:23::2" 98 DST_GW="2001:db8:34::2" 99 fi 100 printf "spdadd ${SRC_LAN} ${DST_LAN} any -P " 101 [ ${dir} = "out" ] && printf "out" || printf "in" 102 printf " ipsec esp/tunnel/${SRC_GW}-${DST_GW}/require;\n" 103 printf "spdadd ${DST_LAN} ${SRC_LAN} any -P " 104 [ ${dir} = "out" ] && printf "in" || printf "out" 105 printf " ipsec esp/tunnel/${DST_GW}-${SRC_GW}/require;\n" 106 printf "add ${SRC_GW} ${DST_GW} esp 0x1000 -E ${enc_algo} \"${enc_key}\"" 107 [ -n "${auth_algo}" ] && printf " -A ${auth_algo} \"${auth_key}\";\n" || printf ";\n" 108 printf "add ${DST_GW} ${SRC_GW} esp 0x1001 -E ${enc_algo} \"${enc_key}\"" 109 [ -n "$auth_algo" ] && printf " -A ${auth_algo} \"${auth_key}\";\n" || printf ";\n" 110 ) > ${TMPDIR}/ipsec.${jname}.conf 111} 112 113ist_test() 114{ 115 ist_init 116 ist_labsetup 117 [ $1 -eq 4 ] && ist_v4_setup || ist_v6_setup 118 ist_setkey ipsecA out $@ 119 atf_check -s exit:0 -o ignore jexec ipsecA setkey -f ${TMPDIR}/ipsec.ipsecA.conf 120 ist_setkey ipsecB in $@ 121 atf_check -s exit:0 -o ignore jexec ipsecB setkey -f ${TMPDIR}/ipsec.ipsecB.conf 122 # Check ipsec tunnel 123 if [ $1 -eq 4 ]; then 124 atf_check -s exit:0 -o ignore jexec hostA ping -c 1 203.0.113.1 125 else 126 atf_check -s exit:0 -o ignore jexec hostA ping -6 -c 1 2001:db8:45::1 127 fi 128} 129ist_cleanup() 130{ 131 vnet_cleanup 132} 133