xref: /netbsd-src/tests/net/ipsec/t_ipsec_l2tp.sh (revision 7d62b00eb9ad855ffcd7da46b41e23feb5476fac) 
1#	$NetBSD: t_ipsec_l2tp.sh,v 1.9 2020/02/17 08:46:10 ozaki-r Exp $
2#
3# Copyright (c) 2017 Internet Initiative Japan Inc.
4# All rights reserved.
5#
6# Redistribution and use in source and binary forms, with or without
7# modification, are permitted provided that the following conditions
8# are met:
9# 1. Redistributions of source code must retain the above copyright
10#    notice, this list of conditions and the following disclaimer.
11# 2. Redistributions in binary form must reproduce the above copyright
12#    notice, this list of conditions and the following disclaimer in the
13#    documentation and/or other materials provided with the distribution.
14#
15# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
16# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
17# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
18# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
19# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25# POSSIBILITY OF SUCH DAMAGE.
26#
27
28SOCK_LOCAL=unix://ipsec_l2tp_local
29SOCK_TUN_LOCAL=unix://ipsec_l2tp_tunel_local
30SOCK_TUN_REMOTE=unix://ipsec_l2tp_tunnel_remote
31SOCK_REMOTE=unix://ipsec_l2tp_remote
32BUS_LOCAL=./bus_ipsec_local
33BUS_TUNNEL=./bus_ipsec_tunnel
34BUS_REMOTE=./bus_ipsec_remote
35
36DEBUG=${DEBUG:-true}
37
38make_l2tp_pktstr()
39{
40	local src=$1
41	local dst=$2
42	local proto=$3
43	local ipproto=$4
44	local mode=$5
45	local proto_cap= proto_str=
46
47	if [ $proto = esp ]; then
48		proto_cap=ESP
49	else
50		proto_cap=AH
51		if [ $ipproto = ipv4 ]; then
52			if [ $mode = tunnel ]; then
53				proto_str="ip-proto-115 102 \(ipip-proto-4\)"
54			else
55				proto_str="ip-proto-115 102"
56			fi
57		else
58			proto_str="ip-proto-115"
59		fi
60	fi
61
62	echo "$src > $dst: $proto_cap.+$proto_str"
63}
64
65wait_for_all_dad_completions()
66{
67
68	for sock in $SOCK_LOCAL $SOCK_TUN_LOCAL $SOCK_TUN_REMOTE $SOCK_REMOTE; do
69		export RUMP_SERVER=$sock
70		atf_check -s exit:0 rump.ifconfig -w 10
71	done
72}
73
74test_ipsec4_l2tp()
75{
76	local mode=$1
77	local proto=$2
78	local algo=$3
79	local ip_local=10.0.0.1
80	local ip_gwlo_tun=20.0.0.1
81	local ip_gwre_tun=20.0.0.2
82	local ip_remote=10.0.0.2
83	local subnet_local=20.0.0.0
84	local subnet_remote=20.0.0.0
85	local tmpfile=./tmp
86	local outfile=./out
87	local str=
88	local algo_args="$(generate_algo_args $proto $algo)"
89
90	# See https://www.netbsd.org/docs/network/ipsec/#sample_vpn
91	rump_server_crypto_start $SOCK_LOCAL
92	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec l2tp bridge
93	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec l2tp bridge
94	rump_server_crypto_start $SOCK_REMOTE
95	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
96	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
97	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
98	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
99	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
100	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
101
102	export RUMP_SERVER=$SOCK_LOCAL
103	atf_check -s exit:0 rump.ifconfig shmif0 $ip_local/24
104
105	export RUMP_SERVER=$SOCK_TUN_LOCAL
106	atf_check -s exit:0 rump.ifconfig shmif0 up
107	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwlo_tun/24
108	rump_server_add_iface $SOCK_TUN_LOCAL l2tp0
109	atf_check -s exit:0 rump.ifconfig l2tp0 \
110	    tunnel $ip_gwlo_tun $ip_gwre_tun
111	atf_check -s exit:0 rump.ifconfig l2tp0 session 1234 4321
112	atf_check -s exit:0 rump.ifconfig l2tp0 up
113	rump_server_add_iface $SOCK_TUN_LOCAL bridge0
114	atf_check -s exit:0 rump.ifconfig bridge0 up
115	atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0
116	atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0
117
118	export RUMP_SERVER=$SOCK_TUN_REMOTE
119	atf_check -s exit:0 rump.ifconfig shmif0 up
120	atf_check -s exit:0 rump.ifconfig shmif1 $ip_gwre_tun/24
121	rump_server_add_iface $SOCK_TUN_REMOTE l2tp0
122	atf_check -s exit:0 rump.ifconfig l2tp0 \
123	    tunnel $ip_gwre_tun $ip_gwlo_tun
124	atf_check -s exit:0 rump.ifconfig l2tp0 session 4321 1234
125	atf_check -s exit:0 rump.ifconfig l2tp0 up
126	rump_server_add_iface $SOCK_TUN_REMOTE bridge0
127	atf_check -s exit:0 rump.ifconfig bridge0 up
128	atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0
129	atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0
130
131	export RUMP_SERVER=$SOCK_REMOTE
132	atf_check -s exit:0 rump.ifconfig shmif0 $ip_remote/24
133
134	wait_for_all_dad_completions
135
136	extract_new_packets $BUS_TUNNEL > $outfile
137
138	export RUMP_SERVER=$SOCK_LOCAL
139	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
140
141	extract_new_packets $BUS_TUNNEL > $outfile
142	atf_check -s exit:0 \
143	    -o match:"$ip_gwlo_tun > $ip_gwre_tun: +ip-proto-115" \
144	    cat $outfile
145	atf_check -s exit:0 \
146	    -o match:"$ip_gwre_tun > $ip_gwlo_tun: +ip-proto-115" \
147	    cat $outfile
148
149	if [ $mode = tunnel ]; then
150		export RUMP_SERVER=$SOCK_TUN_LOCAL
151		# from https://www.netbsd.org/docs/network/ipsec/
152		cat > $tmpfile <<-EOF
153		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $algo_args;
154		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $algo_args;
155		spdadd $subnet_local/24 $subnet_remote/24 any -P out ipsec
156		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
157		spdadd $subnet_remote/24 $subnet_local/24 any -P in ipsec
158		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
159		EOF
160		$DEBUG && cat $tmpfile
161		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
162
163		export RUMP_SERVER=$SOCK_TUN_REMOTE
164		cat > $tmpfile <<-EOF
165		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $algo_args;
166		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $algo_args;
167		spdadd $subnet_remote/24 $subnet_local/24 any -P out ipsec
168		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
169		spdadd $subnet_local/24 $subnet_remote/24 any -P in ipsec
170		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
171		EOF
172		$DEBUG && cat $tmpfile
173		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
174	else # transport mode
175		export RUMP_SERVER=$SOCK_TUN_LOCAL
176		# from https://www.netbsd.org/docs/network/ipsec/
177		cat > $tmpfile <<-EOF
178		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $algo_args;
179		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $algo_args;
180		spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P out ipsec
181		    $proto/transport//require;
182		spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P in ipsec
183		    $proto/transport//require;
184		EOF
185		$DEBUG && cat $tmpfile
186		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
187
188		export RUMP_SERVER=$SOCK_TUN_REMOTE
189		cat > $tmpfile <<-EOF
190		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $algo_args;
191		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $algo_args;
192		spdadd $ip_gwre_tun/32 $ip_gwlo_tun/32 any -P out ipsec
193		    $proto/transport//require;
194		spdadd $ip_gwlo_tun/32 $ip_gwre_tun/32 any -P in ipsec
195		    $proto/transport//require;
196		EOF
197		$DEBUG && cat $tmpfile
198		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
199	fi
200
201	check_sa_entries $SOCK_TUN_LOCAL $ip_gwlo_tun $ip_gwre_tun
202	check_sa_entries $SOCK_TUN_REMOTE $ip_gwlo_tun $ip_gwre_tun
203
204	export RUMP_SERVER=$SOCK_LOCAL
205	atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
206
207	extract_new_packets $BUS_TUNNEL > $outfile
208	str=$(make_l2tp_pktstr $ip_gwlo_tun $ip_gwre_tun $proto ipv4 $mode)
209	atf_check -s exit:0 -o match:"$str" cat $outfile
210	str=$(make_l2tp_pktstr $ip_gwre_tun $ip_gwlo_tun $proto ipv4 $mode)
211	atf_check -s exit:0 -o match:"$str" cat $outfile
212
213	test_flush_entries $SOCK_TUN_LOCAL
214	test_flush_entries $SOCK_TUN_REMOTE
215}
216
217test_ipsec6_l2tp()
218{
219	local mode=$1
220	local proto=$2
221	local algo=$3
222	local ip_local=fd00::1
223	local ip_gwlo_tun=fc00::1
224	local ip_gwre_tun=fc00::2
225	local ip_remote=fd00::2
226	local subnet_local=fc00::
227	local subnet_remote=fc00::
228	local tmpfile=./tmp
229	local outfile=./out
230	local str=
231	local algo_args="$(generate_algo_args $proto $algo)"
232
233	rump_server_crypto_start $SOCK_LOCAL netinet6
234	rump_server_crypto_start $SOCK_TUN_LOCAL netipsec netinet6 l2tp bridge
235	rump_server_crypto_start $SOCK_TUN_REMOTE netipsec netinet6 l2tp bridge
236	rump_server_crypto_start $SOCK_REMOTE netinet6
237	rump_server_add_iface $SOCK_LOCAL shmif0 $BUS_LOCAL
238	rump_server_add_iface $SOCK_TUN_LOCAL shmif0 $BUS_LOCAL
239	rump_server_add_iface $SOCK_TUN_LOCAL shmif1 $BUS_TUNNEL
240	rump_server_add_iface $SOCK_TUN_REMOTE shmif0 $BUS_REMOTE
241	rump_server_add_iface $SOCK_TUN_REMOTE shmif1 $BUS_TUNNEL
242	rump_server_add_iface $SOCK_REMOTE shmif0 $BUS_REMOTE
243
244	export RUMP_SERVER=$SOCK_LOCAL
245	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_local/64
246
247	export RUMP_SERVER=$SOCK_TUN_LOCAL
248	atf_check -s exit:0 rump.ifconfig shmif0 up
249	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwlo_tun/64
250	rump_server_add_iface $SOCK_TUN_LOCAL l2tp0
251	atf_check -s exit:0 rump.ifconfig l2tp0 \
252	    tunnel $ip_gwlo_tun $ip_gwre_tun
253	atf_check -s exit:0 rump.ifconfig l2tp0 session 1234 4321
254	atf_check -s exit:0 rump.ifconfig l2tp0 up
255	rump_server_add_iface $SOCK_TUN_LOCAL bridge0
256	atf_check -s exit:0 rump.ifconfig bridge0 up
257	atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0
258	atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0
259
260	export RUMP_SERVER=$SOCK_TUN_REMOTE
261	atf_check -s exit:0 rump.ifconfig shmif0 up
262	atf_check -s exit:0 rump.ifconfig shmif1 inet6 $ip_gwre_tun/64
263	rump_server_add_iface $SOCK_TUN_REMOTE l2tp0
264	atf_check -s exit:0 rump.ifconfig l2tp0 \
265	    tunnel $ip_gwre_tun $ip_gwlo_tun
266	atf_check -s exit:0 rump.ifconfig l2tp0 session 4321 1234
267	atf_check -s exit:0 rump.ifconfig l2tp0 up
268	rump_server_add_iface $SOCK_TUN_REMOTE bridge0
269	atf_check -s exit:0 rump.ifconfig bridge0 up
270	atf_check -s exit:0 $HIJACKING brconfig bridge0 add l2tp0
271	atf_check -s exit:0 $HIJACKING brconfig bridge0 add shmif0
272
273	export RUMP_SERVER=$SOCK_REMOTE
274	atf_check -s exit:0 rump.ifconfig shmif0 inet6 $ip_remote
275
276	wait_for_all_dad_completions
277
278	extract_new_packets $BUS_TUNNEL > $outfile
279
280	export RUMP_SERVER=$SOCK_LOCAL
281	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
282
283	extract_new_packets $BUS_TUNNEL > $outfile
284	atf_check -s exit:0 \
285	    -o match:"$ip_gwlo_tun > $ip_gwre_tun: +ip-proto-115" \
286	    cat $outfile
287	atf_check -s exit:0 \
288	    -o match:"$ip_gwre_tun > $ip_gwlo_tun: +ip-proto-115" \
289	    cat $outfile
290
291	if [ $mode = tunnel ]; then
292		export RUMP_SERVER=$SOCK_TUN_LOCAL
293		# from https://www.netbsd.org/docs/network/ipsec/
294		cat > $tmpfile <<-EOF
295		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $algo_args;
296		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $algo_args;
297		spdadd $subnet_local/64 $subnet_remote/64 any -P out ipsec
298		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
299		spdadd $subnet_remote/64 $subnet_local/64 any -P in ipsec
300		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
301		EOF
302		$DEBUG && cat $tmpfile
303		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
304
305		export RUMP_SERVER=$SOCK_TUN_REMOTE
306		cat > $tmpfile <<-EOF
307		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $algo_args;
308		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $algo_args;
309		spdadd $subnet_remote/64 $subnet_local/64 any -P out ipsec
310		    $proto/tunnel/$ip_gwre_tun-$ip_gwlo_tun/require;
311		spdadd $subnet_local/64 $subnet_remote/64 any -P in ipsec
312		    $proto/tunnel/$ip_gwlo_tun-$ip_gwre_tun/require;
313		EOF
314		$DEBUG && cat $tmpfile
315		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
316	else # transport mode
317		export RUMP_SERVER=$SOCK_TUN_LOCAL
318		# from https://www.netbsd.org/docs/network/ipsec/
319		cat > $tmpfile <<-EOF
320		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $algo_args;
321		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $algo_args;
322		spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P out ipsec
323		    $proto/transport//require;
324		spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P in ipsec
325		    $proto/transport//require;
326		EOF
327		$DEBUG && cat $tmpfile
328		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
329
330		export RUMP_SERVER=$SOCK_TUN_REMOTE
331		cat > $tmpfile <<-EOF
332		add $ip_gwlo_tun $ip_gwre_tun $proto 10000 $algo_args;
333		add $ip_gwre_tun $ip_gwlo_tun $proto 10001 $algo_args;
334		spdadd $ip_gwre_tun/128 $ip_gwlo_tun/128 any -P out ipsec
335		    $proto/transport//require;
336		spdadd $ip_gwlo_tun/128 $ip_gwre_tun/128 any -P in ipsec
337		    $proto/transport//require;
338		EOF
339		$DEBUG && cat $tmpfile
340		atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
341	fi
342
343	check_sa_entries $SOCK_TUN_LOCAL $ip_gwlo_tun $ip_gwre_tun
344	check_sa_entries $SOCK_TUN_REMOTE $ip_gwlo_tun $ip_gwre_tun
345
346	export RUMP_SERVER=$SOCK_LOCAL
347	atf_check -s exit:0 -o ignore rump.ping6 -c 1 -n -X 3 $ip_remote
348
349	extract_new_packets $BUS_TUNNEL > $outfile
350	str=$(make_l2tp_pktstr $ip_gwlo_tun $ip_gwre_tun $proto ipv6 $mode)
351	atf_check -s exit:0 -o match:"$str" cat $outfile
352	str=$(make_l2tp_pktstr $ip_gwre_tun $ip_gwlo_tun $proto ipv6 $mode)
353	atf_check -s exit:0 -o match:"$str" cat $outfile
354
355	test_flush_entries $SOCK_TUN_LOCAL
356	test_flush_entries $SOCK_TUN_REMOTE
357}
358
359test_ipsec_l2tp_common()
360{
361	local ipproto=$1
362	local mode=$2
363	local proto=$3
364	local algo=$4
365
366	if [ $ipproto = ipv4 ]; then
367		test_ipsec4_l2tp $mode $proto $algo
368	else
369		test_ipsec6_l2tp $mode $proto $algo
370	fi
371}
372
373add_test_ipsec_l2tp()
374{
375	local ipproto=$1
376	local mode=$2
377	local proto=$3
378	local algo=$4
379	local _algo=$(echo $algo | sed 's/-//g')
380	local name= desc=
381
382	name="ipsec_l2tp_${ipproto}_${mode}_${proto}_${_algo}"
383	desc="Tests of l2tp/IPsec ($ipproto) ${mode} mode with $proto ($algo)"
384
385	atf_test_case ${name} cleanup
386	eval "
387	    ${name}_head() {
388	        atf_set descr \"$desc\"
389	        atf_set require.progs rump_server setkey
390	    }
391	    ${name}_body() {
392	        test_ipsec_l2tp_common $ipproto $mode $proto $algo
393	        rump_server_destroy_ifaces
394	    }
395	    ${name}_cleanup() {
396	        \$DEBUG && dump
397	        cleanup
398	    }
399	"
400	atf_add_test_case ${name}
401}
402
403atf_init_test_cases()
404{
405	local algo=
406
407	for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
408		add_test_ipsec_l2tp ipv4 tunnel esp $algo
409		add_test_ipsec_l2tp ipv6 tunnel esp $algo
410		add_test_ipsec_l2tp ipv4 transport esp $algo
411		add_test_ipsec_l2tp ipv6 transport esp $algo
412	done
413
414	for algo in $AH_AUTHENTICATION_ALGORITHMS_MINIMUM; do
415		add_test_ipsec_l2tp ipv4 tunnel ah $algo
416		add_test_ipsec_l2tp ipv6 tunnel ah $algo
417		add_test_ipsec_l2tp ipv4 transport ah $algo
418		add_test_ipsec_l2tp ipv6 transport ah $algo
419	done
420}
421