Module Name: src
Committed By: martin
Date: Tue Nov 10 11:44:22 UTC 2020
Modified Files:
src/tests/net/if_ipsec [netbsd-9]: t_ipsec.sh t_ipsec_natt.sh
t_ipsec_pfil.sh
src/tests/net/ipsec [netbsd-9]: common.sh t_ipsec_natt.sh
Log Message:
Pull up following revision(s) (requested by knakahara in ticket #1129):
tests/net/if_ipsec/t_ipsec_pfil.sh: revision 1.3
tests/net/if_ipsec/t_ipsec.sh: revision 1.11
tests/net/if_ipsec/t_ipsec_natt.sh: revision 1.4
tests/net/if_ipsec/t_ipsec_natt.sh: revision 1.5
tests/net/ipsec/t_ipsec_natt.sh: revision 1.4
tests/net/ipsec/t_ipsec_natt.sh: revision 1.5
tests/net/ipsec/common.sh: revision 1.8
Typo in error message
Refactor a little and follow new format of "npfctl list".
Fix the below ATF failures.
- net/if_ipsec/t_ipsec_natt:ipsecif_natt_transport_null
- net/if_ipsec/t_ipsec_natt:ipsecif_natt_transport_rijndaelcbc
- net/ipsec/t_ipsec_natt:ipsec_natt_transport_ipv4_null
- net/ipsec/t_ipsec_natt:ipsec_natt_transport_ipv4_rijndaelcbc
ok'ed by [email protected], thanks.
Fix missing "-m tranport" options. Pointed out by k-goda@IIJ.
Using any mode SA causes unepected call path, that is,
ipsec4_common_input_cb() calls ip_input() directly instead of
ipsecif4_input().
To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.9.2.1 src/tests/net/if_ipsec/t_ipsec.sh
cvs rdiff -u -r1.2 -r1.2.6.1 src/tests/net/if_ipsec/t_ipsec_natt.sh
cvs rdiff -u -r1.1 -r1.1.6.1 src/tests/net/if_ipsec/t_ipsec_pfil.sh
cvs rdiff -u -r1.7 -r1.7.6.1 src/tests/net/ipsec/common.sh
cvs rdiff -u -r1.2 -r1.2.2.1 src/tests/net/ipsec/t_ipsec_natt.sh
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/tests/net/if_ipsec/t_ipsec.sh
diff -u src/tests/net/if_ipsec/t_ipsec.sh:1.9 src/tests/net/if_ipsec/t_ipsec.sh:1.9.2.1
--- src/tests/net/if_ipsec/t_ipsec.sh:1.9 Tue Jan 15 05:34:37 2019
+++ src/tests/net/if_ipsec/t_ipsec.sh Tue Nov 10 11:44:22 2020
@@ -1,4 +1,4 @@
-# $NetBSD: t_ipsec.sh,v 1.9 2019/01/15 05:34:37 knakahara Exp $
+# $NetBSD: t_ipsec.sh,v 1.9.2.1 2020/11/10 11:44:22 martin Exp $
#
# Copyright (c) 2017 Internet Initiative Japan Inc.
# All rights reserved.
@@ -300,8 +300,8 @@ setup_if_ipsec_sa()
fi
cat > $tmpfile <<-EOF
- add $dst $src $proto $inid -u $inunique $algo_args;
- add $src $dst $proto $outid -u $outunique $algo_args;
+ add $dst $src $proto $inid -u $inunique -m transport $algo_args;
+ add $src $dst $proto $outid -u $outunique -m transport $algo_args;
EOF
$DEBUG && cat $tmpfile
export RUMP_SERVER=$sock
Index: src/tests/net/if_ipsec/t_ipsec_natt.sh
diff -u src/tests/net/if_ipsec/t_ipsec_natt.sh:1.2 src/tests/net/if_ipsec/t_ipsec_natt.sh:1.2.6.1
--- src/tests/net/if_ipsec/t_ipsec_natt.sh:1.2 Wed Dec 26 08:59:41 2018
+++ src/tests/net/if_ipsec/t_ipsec_natt.sh Tue Nov 10 11:44:22 2020
@@ -1,4 +1,4 @@
-# $NetBSD: t_ipsec_natt.sh,v 1.2 2018/12/26 08:59:41 knakahara Exp $
+# $NetBSD: t_ipsec_natt.sh,v 1.2.6.1 2020/11/10 11:44:22 martin Exp $
#
# Copyright (c) 2018 Internet Initiative Japan Inc.
# All rights reserved.
@@ -33,7 +33,6 @@ BUS_LOCAL=./bus_ipsec_natt_local
BUS_NAT=./bus_ipsec_natt_nat
DEBUG=${DEBUG:-false}
-HIJACKING_NPF="${HIJACKING},blanket=/dev/npf"
setup_servers()
{
@@ -386,10 +385,10 @@ test_ipsecif_natt_transport()
export RUMP_SERVER=$SOCK_NAT
$DEBUG && $HIJACKING_NPF npfctl list
# 192.168.0.2:4500 10.0.0.2:4500 via shmif1:65248
- port_a=$($HIJACKING_NPF npfctl list | grep $ip_local_a | awk -F 'shmif1:' '/4500/ {print $2;}')
+ port_a=$(get_natt_port $ip_local_a $ip_nat_remote)
$DEBUG && echo port_a=$port_a
if [ -z "$port_a" ]; then
- atf_fail "Failed to get a traslated port on NAPT"
+ atf_fail "Failed to get a translated port on NAPT"
fi
# Setup ESP-UDP ipsecif(4) for first client under NAPT
@@ -441,10 +440,10 @@ test_ipsecif_natt_transport()
export RUMP_SERVER=$SOCK_NAT
$DEBUG && $HIJACKING_NPF npfctl list
# 192.168.0.2:4500 10.0.0.2:4500 via shmif1:65248
- port_b=$($HIJACKING_NPF npfctl list | grep $ip_local_b | awk -F 'shmif1:' '/4500/ {print $2;}')
+ port_b=$(get_natt_port $ip_local_b $ip_nat_remote)
$DEBUG && echo port_b=$port_b
if [ -z "$port_b" ]; then
- atf_fail "Failed to get a traslated port on NAPT"
+ atf_fail "Failed to get a translated port on NAPT"
fi
# Setup ESP-UDP ipsecif(4) for first client under NAPT
Index: src/tests/net/if_ipsec/t_ipsec_pfil.sh
diff -u src/tests/net/if_ipsec/t_ipsec_pfil.sh:1.1 src/tests/net/if_ipsec/t_ipsec_pfil.sh:1.1.6.1
--- src/tests/net/if_ipsec/t_ipsec_pfil.sh:1.1 Thu Jan 17 02:49:11 2019
+++ src/tests/net/if_ipsec/t_ipsec_pfil.sh Tue Nov 10 11:44:22 2020
@@ -1,4 +1,4 @@
-# $NetBSD: t_ipsec_pfil.sh,v 1.1 2019/01/17 02:49:11 knakahara Exp $
+# $NetBSD: t_ipsec_pfil.sh,v 1.1.6.1 2020/11/10 11:44:22 martin Exp $
#
# Copyright (c) 2019 Internet Initiative Japan Inc.
# All rights reserved.
@@ -115,8 +115,8 @@ setup_if_ipsec_sa()
atf_check -s exit:0 test "X$outunique" != "X"
cat > $tmpfile <<-EOF
- add $dst $src $proto $inid -u $inunique $algo_args;
- add $src $dst $proto $outid -u $outunique $algo_args;
+ add $dst $src $proto $inid -u $inunique -m transport $algo_args;
+ add $src $dst $proto $outid -u $outunique -m transport $algo_args;
EOF
$DEBUG && cat $tmpfile
atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
Index: src/tests/net/ipsec/common.sh
diff -u src/tests/net/ipsec/common.sh:1.7 src/tests/net/ipsec/common.sh:1.7.6.1
--- src/tests/net/ipsec/common.sh:1.7 Fri Oct 20 03:43:51 2017
+++ src/tests/net/ipsec/common.sh Tue Nov 10 11:44:22 2020
@@ -1,4 +1,4 @@
-# $NetBSD: common.sh,v 1.7 2017/10/20 03:43:51 ozaki-r Exp $
+# $NetBSD: common.sh,v 1.7.6.1 2020/11/10 11:44:22 martin Exp $
#
# Copyright (c) 2017 Internet Initiative Japan Inc.
# All rights reserved.
@@ -25,6 +25,8 @@
# POSSIBILITY OF SUCH DAMAGE.
#
+HIJACKING_NPF="${HIJACKING},blanket=/dev/npf"
+
test_flush_entries()
{
local sock=$1
@@ -83,3 +85,14 @@ generate_pktproto()
echo $proto | tr 'a-z' 'A-Z'
fi
}
+
+get_natt_port()
+{
+ local local_addr=$1
+ local remote_addr=$2
+ local port=""
+
+ # 10.0.1.2:4500 20.0.0.2:4500 shmif1 20.0.0.1:35574
+ port=$($HIJACKING_NPF npfctl list | grep $local_addr | awk -F "${remote_addr}:" '/4500/ {print $2;}')
+ echo $port
+}
Index: src/tests/net/ipsec/t_ipsec_natt.sh
diff -u src/tests/net/ipsec/t_ipsec_natt.sh:1.2 src/tests/net/ipsec/t_ipsec_natt.sh:1.2.2.1
--- src/tests/net/ipsec/t_ipsec_natt.sh:1.2 Thu Nov 22 04:51:41 2018
+++ src/tests/net/ipsec/t_ipsec_natt.sh Tue Nov 10 11:44:22 2020
@@ -1,4 +1,4 @@
-# $NetBSD: t_ipsec_natt.sh,v 1.2 2018/11/22 04:51:41 knakahara Exp $
+# $NetBSD: t_ipsec_natt.sh,v 1.2.2.1 2020/11/10 11:44:22 martin Exp $
#
# Copyright (c) 2017 Internet Initiative Japan Inc.
# All rights reserved.
@@ -34,7 +34,6 @@ BUS_REMOTE=./bus_ipsec_natt_remote
BUS_GLOBAL=./bus_ipsec_natt_global
DEBUG=${DEBUG:-false}
-HIJACKING_NPF="${HIJACKING},blanket=/dev/npf"
setup_servers_ipv4()
{
@@ -325,10 +324,10 @@ test_ipsec_natt_transport_ipv4()
export RUMP_SERVER=$SOCK_NAT
$DEBUG && $HIJACKING_NPF npfctl list
# 10.0.1.2:4500 20.0.0.2:4500 via shmif1:9696
- port=$($HIJACKING_NPF npfctl list | awk -F 'shmif1:' '/4500/ {print $2;}')
+ port=$(get_natt_port $ip_local $ip_nat_remote)
$DEBUG && echo port=$port
if [ -z "$port" ]; then
- atf_fail "Failed to get a traslated port on NAPT"
+ atf_fail "Failed to get a translated port on NAPT"
fi
# Create ESP-UDP IPsec connections
