1# $NetBSD: t_ipsec_sysctl.sh,v 1.1 2017/04/14 02:56:49 ozaki-r Exp $ 2# 3# Copyright (c) 2017 Internet Initiative Japan Inc. 4# All rights reserved. 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 16# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 17# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 18# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 19# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25# POSSIBILITY OF SUCH DAMAGE. 26# 27 28DEBUG=${DEBUG:-false} 29 30atf_test_case ipsec_sysctl0 cleanup 31ipsec_sysctl0_head() 32{ 33 34 atf_set "descr" "Tests of sysctl entries of IPsec without ipsec.so" 35 atf_set "require.progs" "rump_server" 36} 37 38ipsec_sysctl0_body() 39{ 40 local sock=unix://ipsec_sysctl 41 42 rump_server_crypto_start $sock 43 44 export RUMP_SERVER=$sock 45 atf_check -s not-exit:0 -e match:'invalid' \ 46 rump.sysctl net.inet.ipsec.enabled 47 atf_check -s not-exit:0 -e match:'invalid' \ 48 rump.sysctl net.inet6.ipsec6.enabled 49} 50 51ipsec_sysctl0_cleanup() 52{ 53 54 $DEBUG && dump 55 cleanup 56} 57 58atf_test_case ipsec_sysctl4 cleanup 59ipsec_sysctl4_head() 60{ 61 62 atf_set "descr" "Tests of sysctl entries of IPsec without netinet6.so" 63 atf_set "require.progs" "rump_server" 64} 65 66ipsec_sysctl4_body() 67{ 68 local sock=unix://ipsec_sysctl 69 70 rump_server_crypto_start $sock netipsec 71 72 export RUMP_SERVER=$sock 73 atf_check -s exit:0 -o match:'= 1' rump.sysctl net.inet.ipsec.enabled 74 # net.inet6.ipsec6 entries exit regardless of netinet6 75 # net.inet6.ipsec6.enabled always equals net.inet.ipsec.enabled 76 atf_check -s exit:0 -o match:'= 1' rump.sysctl net.inet6.ipsec6.enabled 77 78 atf_check -s exit:0 -o match:'= 0' rump.sysctl net.inet.ipsec.used 79 # net.inet6.ipsec6.used always equals net.inet.ipsec.used 80 atf_check -s exit:0 -o match:'= 0' rump.sysctl net.inet6.ipsec6.used 81 82 # Add an SAD entry for IPv4 83 atf_check -s exit:0 -o empty $HIJACKING setkey -c <<-EOF 84 add 10.0.0.1 10.0.0.2 esp 9876 -E 3des-cbc "hogehogehogehogehogehoge"; 85 EOF 86 $DEBUG && $HIJACKING setkey -D 87 88 atf_check -s exit:0 -o match:'= 0' rump.sysctl net.inet.ipsec.used 89 atf_check -s exit:0 -o match:'= 0' rump.sysctl net.inet6.ipsec6.used 90 91 # Add an SPD entry for IPv4, which activates the IPsec function 92 atf_check -s exit:0 -o empty $HIJACKING setkey -c <<-EOF 93 spdadd 10.0.0.1 10.0.0.2 any -P out ipsec esp/transport//use; 94 EOF 95 $DEBUG && $HIJACKING setkey -D 96 97 atf_check -s exit:0 -o match:'= 1' rump.sysctl net.inet.ipsec.used 98 atf_check -s exit:0 -o match:'= 1' rump.sysctl net.inet6.ipsec6.used 99} 100 101ipsec_sysctl4_cleanup() 102{ 103 104 $DEBUG && dump 105 cleanup 106} 107 108atf_test_case ipsec_sysctl6 cleanup 109ipsec_sysctl6_head() 110{ 111 112 atf_set "descr" "Tests of sysctl entries of IPsec" 113 atf_set "require.progs" "rump_server" 114} 115 116ipsec_sysctl6_body() 117{ 118 local sock=unix://ipsec_sysctl 119 120 rump_server_crypto_start $sock netinet6 netipsec 121 122 export RUMP_SERVER=$sock 123 atf_check -s exit:0 -o match:'= 1' rump.sysctl net.inet.ipsec.enabled 124 atf_check -s exit:0 -o match:'= 1' rump.sysctl net.inet6.ipsec6.enabled 125 126 atf_check -s exit:0 -o match:'= 0' rump.sysctl net.inet.ipsec.used 127 atf_check -s exit:0 -o match:'= 0' rump.sysctl net.inet6.ipsec6.used 128 129 # Add an SAD entry for IPv6 130 atf_check -s exit:0 -o empty $HIJACKING setkey -c <<-EOF 131 add fd00::1 fd00::2 esp 9876 -E 3des-cbc "hogehogehogehogehogehoge"; 132 EOF 133 $DEBUG && $HIJACKING setkey -D 134 135 atf_check -s exit:0 -o match:'= 0' rump.sysctl net.inet.ipsec.used 136 atf_check -s exit:0 -o match:'= 0' rump.sysctl net.inet6.ipsec6.used 137 138 # Add an SPD entry for IPv6, which activates the IPsec function 139 atf_check -s exit:0 -o empty $HIJACKING setkey -c <<-EOF 140 spdadd fd00::1 fd00::2 any -P out ipsec esp/transport//use; 141 EOF 142 $DEBUG && $HIJACKING setkey -D 143 144 atf_check -s exit:0 -o match:'= 1' rump.sysctl net.inet.ipsec.used 145 atf_check -s exit:0 -o match:'= 1' rump.sysctl net.inet6.ipsec6.used 146} 147 148ipsec_sysctl6_cleanup() 149{ 150 151 $DEBUG && dump 152 cleanup 153} 154 155atf_init_test_cases() 156{ 157 158 atf_add_test_case ipsec_sysctl0 159 atf_add_test_case ipsec_sysctl4 160 atf_add_test_case ipsec_sysctl6 161} 162