selftests/net/xfrm_policy.sh

4 # Check xfrm policy resolution.  Topology:
38     ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
40     ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
52     ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in  enc aes $KEY_AES  auth sha1 $KEY_SHA  mode tunnel sel src $rnet dst $lnet
53     ip -net $ns xfrm state add src $me  dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
75     ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
78     ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
81     ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
107     ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
112        ip -net $ns xfrm policy add src 10.253.1.$((RANDOM%255))/$p dst 10.254.1.$((RANDOM%255))/$p dir fwd priority $((200+k)) action block 2>/dev/null
122     ip -net $ns xfrm policy get src $lnet dst $rnet dir out > /dev/null
125         echo "FAIL: ip -net $ns xfrm policy get src $lnet dst $rnet dir out"
129     ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd > /dev/null
132         echo "FAIL: ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd"
145     ip -net $ns xfrm policy add dst $plain dir out priority 10 action allow
148     ip -net $ns xfrm policy add dst $encryptip dir out tmpl src $me dst $remote proto esp mode tunnel priority 1 action allow
157       echo netns exec $ns ip xfrm policy add src 0.0.0.0/0 dst 10.$i.99.0/30 dir out action block
158       echo netns exec $ns ip xfrm policy add src 10.$i.99.0/30 dst 0.0.0.0/0 dir out action block
160         echo netns exec $ns ip xfrm policy add src 10.$i.1.0/30 dst 10.$i.$j.0/30 dir out action block
162         echo netns exec $ns ip xfrm policy add src 10.$i.1.0/29 dst 10.$i.$j.0/29 dir out action block
164         echo netns exec $ns ip xfrm policy add src 10.$i.1.0/24 dst 10.$i.$j.0/24 dir out action block
165         echo netns exec $ns ip xfrm policy add src 10.$i.$j.0/24 dst 10.$i.1.0/24 dir fwd action block
175        echo netns exec $ns ip xfrm policy add src dead:$i::/64 dst dead:$i:$j::/64 dir out action block
176        echo netns exec $ns ip xfrm policy add src dead:$i:$j::/64 dst dead:$i::/24 dir fwd action block
272 		ip -net ${ns[1]} xfrm policy update src e000:0001::0000 dst ff01::0014:0000:0001 dir in tmpl src :: dst :: proto esp mode tunnel priority 100 action allow || break
273 		ip -net ${ns[1]} xfrm policy set hthresh6 0 28 || break
275 		ip -net ${ns[1]} xfrm policy update src e000:0001::0000 dst ff01::01 dir in tmpl src :: dst :: proto esp mode tunnel priority 100 action allow || break
276 		ip -net ${ns[1]} xfrm policy set hthresh6 0 28 || break
297 		ip -net $ns xfrm policy flush
299 			ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow
302 			if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then
310 		ip -net $ns xfrm policy flush
313 			ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow
317 			if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then
324 	ip -net $ns xfrm policy flush
455 	ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
462 ip -net ${ns[3]} xfrm policy flush
468 ip -net ${ns[3]} xfrm policy set hthresh4 16 16
475 	ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128