diff options
| author | martin <martin@NetBSD.org> | 2020-11-10 11:44:22 +0000 |
|---|---|---|
| committer | martin <martin@NetBSD.org> | 2020-11-10 11:44:22 +0000 |
| commit | 0adc1a6ff2c5c840f9bad2d764c7877c193ca1f0 (patch) | |
| tree | 8f51ea91da496aef975c3bc91cd3be1730752ba9 /tests | |
| parent | b4ac178e955d50b1ef19c2e7126a0c474e5699a1 (diff) | |
Pull up following revision(s) (requested by knakahara in ticket #1129):
tests/net/if_ipsec/t_ipsec_pfil.sh: revision 1.3
tests/net/if_ipsec/t_ipsec.sh: revision 1.11
tests/net/if_ipsec/t_ipsec_natt.sh: revision 1.4
tests/net/if_ipsec/t_ipsec_natt.sh: revision 1.5
tests/net/ipsec/t_ipsec_natt.sh: revision 1.4
tests/net/ipsec/t_ipsec_natt.sh: revision 1.5
tests/net/ipsec/common.sh: revision 1.8
Typo in error message
Refactor a little and follow new format of "npfctl list".
Fix the below ATF failures.
- net/if_ipsec/t_ipsec_natt:ipsecif_natt_transport_null
- net/if_ipsec/t_ipsec_natt:ipsecif_natt_transport_rijndaelcbc
- net/ipsec/t_ipsec_natt:ipsec_natt_transport_ipv4_null
- net/ipsec/t_ipsec_natt:ipsec_natt_transport_ipv4_rijndaelcbc
ok'ed by ozaki-r@n.o, thanks.
Fix missing "-m tranport" options. Pointed out by k-goda@IIJ.
Using any mode SA causes unepected call path, that is,
ipsec4_common_input_cb() calls ip_input() directly instead of
ipsecif4_input().
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/net/if_ipsec/t_ipsec.sh | 6 | ||||
| -rw-r--r-- | tests/net/if_ipsec/t_ipsec_natt.sh | 11 | ||||
| -rw-r--r-- | tests/net/if_ipsec/t_ipsec_pfil.sh | 6 | ||||
| -rw-r--r-- | tests/net/ipsec/common.sh | 15 | ||||
| -rw-r--r-- | tests/net/ipsec/t_ipsec_natt.sh | 7 |
5 files changed, 28 insertions, 17 deletions
diff --git a/tests/net/if_ipsec/t_ipsec.sh b/tests/net/if_ipsec/t_ipsec.sh index 60eca7023d0..2d534493f10 100644 --- a/tests/net/if_ipsec/t_ipsec.sh +++ b/tests/net/if_ipsec/t_ipsec.sh @@ -1,4 +1,4 @@ -# $NetBSD: t_ipsec.sh,v 1.9 2019/01/15 05:34:37 knakahara Exp $ +# $NetBSD: t_ipsec.sh,v 1.9.2.1 2020/11/10 11:44:22 martin Exp $ # # Copyright (c) 2017 Internet Initiative Japan Inc. # All rights reserved. @@ -300,8 +300,8 @@ setup_if_ipsec_sa() fi cat > $tmpfile <<-EOF - add $dst $src $proto $inid -u $inunique $algo_args; - add $src $dst $proto $outid -u $outunique $algo_args; + add $dst $src $proto $inid -u $inunique -m transport $algo_args; + add $src $dst $proto $outid -u $outunique -m transport $algo_args; EOF $DEBUG && cat $tmpfile export RUMP_SERVER=$sock diff --git a/tests/net/if_ipsec/t_ipsec_natt.sh b/tests/net/if_ipsec/t_ipsec_natt.sh index 9b0e30d55b1..d0555132176 100644 --- a/tests/net/if_ipsec/t_ipsec_natt.sh +++ b/tests/net/if_ipsec/t_ipsec_natt.sh @@ -1,4 +1,4 @@ -# $NetBSD: t_ipsec_natt.sh,v 1.2 2018/12/26 08:59:41 knakahara Exp $ +# $NetBSD: t_ipsec_natt.sh,v 1.2.6.1 2020/11/10 11:44:22 martin Exp $ # # Copyright (c) 2018 Internet Initiative Japan Inc. # All rights reserved. @@ -33,7 +33,6 @@ BUS_LOCAL=./bus_ipsec_natt_local BUS_NAT=./bus_ipsec_natt_nat DEBUG=${DEBUG:-false} -HIJACKING_NPF="${HIJACKING},blanket=/dev/npf" setup_servers() { @@ -386,10 +385,10 @@ test_ipsecif_natt_transport() export RUMP_SERVER=$SOCK_NAT $DEBUG && $HIJACKING_NPF npfctl list # 192.168.0.2:4500 10.0.0.2:4500 via shmif1:65248 - port_a=$($HIJACKING_NPF npfctl list | grep $ip_local_a | awk -F 'shmif1:' '/4500/ {print $2;}') + port_a=$(get_natt_port $ip_local_a $ip_nat_remote) $DEBUG && echo port_a=$port_a if [ -z "$port_a" ]; then - atf_fail "Failed to get a traslated port on NAPT" + atf_fail "Failed to get a translated port on NAPT" fi # Setup ESP-UDP ipsecif(4) for first client under NAPT @@ -441,10 +440,10 @@ test_ipsecif_natt_transport() export RUMP_SERVER=$SOCK_NAT $DEBUG && $HIJACKING_NPF npfctl list # 192.168.0.2:4500 10.0.0.2:4500 via shmif1:65248 - port_b=$($HIJACKING_NPF npfctl list | grep $ip_local_b | awk -F 'shmif1:' '/4500/ {print $2;}') + port_b=$(get_natt_port $ip_local_b $ip_nat_remote) $DEBUG && echo port_b=$port_b if [ -z "$port_b" ]; then - atf_fail "Failed to get a traslated port on NAPT" + atf_fail "Failed to get a translated port on NAPT" fi # Setup ESP-UDP ipsecif(4) for first client under NAPT diff --git a/tests/net/if_ipsec/t_ipsec_pfil.sh b/tests/net/if_ipsec/t_ipsec_pfil.sh index 3c94d632120..60876f36f4e 100644 --- a/tests/net/if_ipsec/t_ipsec_pfil.sh +++ b/tests/net/if_ipsec/t_ipsec_pfil.sh @@ -1,4 +1,4 @@ -# $NetBSD: t_ipsec_pfil.sh,v 1.1 2019/01/17 02:49:11 knakahara Exp $ +# $NetBSD: t_ipsec_pfil.sh,v 1.1.6.1 2020/11/10 11:44:22 martin Exp $ # # Copyright (c) 2019 Internet Initiative Japan Inc. # All rights reserved. @@ -115,8 +115,8 @@ setup_if_ipsec_sa() atf_check -s exit:0 test "X$outunique" != "X" cat > $tmpfile <<-EOF - add $dst $src $proto $inid -u $inunique $algo_args; - add $src $dst $proto $outid -u $outunique $algo_args; + add $dst $src $proto $inid -u $inunique -m transport $algo_args; + add $src $dst $proto $outid -u $outunique -m transport $algo_args; EOF $DEBUG && cat $tmpfile atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile diff --git a/tests/net/ipsec/common.sh b/tests/net/ipsec/common.sh index f71958c4ffe..27e757e501c 100644 --- a/tests/net/ipsec/common.sh +++ b/tests/net/ipsec/common.sh @@ -1,4 +1,4 @@ -# $NetBSD: common.sh,v 1.7 2017/10/20 03:43:51 ozaki-r Exp $ +# $NetBSD: common.sh,v 1.7.6.1 2020/11/10 11:44:22 martin Exp $ # # Copyright (c) 2017 Internet Initiative Japan Inc. # All rights reserved. @@ -25,6 +25,8 @@ # POSSIBILITY OF SUCH DAMAGE. # +HIJACKING_NPF="${HIJACKING},blanket=/dev/npf" + test_flush_entries() { local sock=$1 @@ -83,3 +85,14 @@ generate_pktproto() echo $proto | tr 'a-z' 'A-Z' fi } + +get_natt_port() +{ + local local_addr=$1 + local remote_addr=$2 + local port="" + + # 10.0.1.2:4500 20.0.0.2:4500 shmif1 20.0.0.1:35574 + port=$($HIJACKING_NPF npfctl list | grep $local_addr | awk -F "${remote_addr}:" '/4500/ {print $2;}') + echo $port +} diff --git a/tests/net/ipsec/t_ipsec_natt.sh b/tests/net/ipsec/t_ipsec_natt.sh index d1ead8b2d1c..411bdfe1f20 100644 --- a/tests/net/ipsec/t_ipsec_natt.sh +++ b/tests/net/ipsec/t_ipsec_natt.sh @@ -1,4 +1,4 @@ -# $NetBSD: t_ipsec_natt.sh,v 1.2 2018/11/22 04:51:41 knakahara Exp $ +# $NetBSD: t_ipsec_natt.sh,v 1.2.2.1 2020/11/10 11:44:22 martin Exp $ # # Copyright (c) 2017 Internet Initiative Japan Inc. # All rights reserved. @@ -34,7 +34,6 @@ BUS_REMOTE=./bus_ipsec_natt_remote BUS_GLOBAL=./bus_ipsec_natt_global DEBUG=${DEBUG:-false} -HIJACKING_NPF="${HIJACKING},blanket=/dev/npf" setup_servers_ipv4() { @@ -325,10 +324,10 @@ test_ipsec_natt_transport_ipv4() export RUMP_SERVER=$SOCK_NAT $DEBUG && $HIJACKING_NPF npfctl list # 10.0.1.2:4500 20.0.0.2:4500 via shmif1:9696 - port=$($HIJACKING_NPF npfctl list | awk -F 'shmif1:' '/4500/ {print $2;}') + port=$(get_natt_port $ip_local $ip_nat_remote) $DEBUG && echo port=$port if [ -z "$port" ]; then - atf_fail "Failed to get a traslated port on NAPT" + atf_fail "Failed to get a translated port on NAPT" fi # Create ESP-UDP IPsec connections |
