# $NetBSD: t_ipsec_pfil.sh,v 1.3 2020/08/05 01:10:50 knakahara Exp $

# $NetBSD: t_ipsec_pfil.sh,v 1.3 2020/08/05 01:10:50 knakahara Exp $
#
# Copyright (c) 2019 Internet Initiative Japan Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#

SOCK_ROUTER1=unix://router1
SOCK_ROUTER2=unix://router2
ROUTER1_LANIP=192.168.1.1
ROUTER1_LANNET=192.168.1.0/24
ROUTER1_WANIP=10.0.0.1
ROUTER1_IPSECIP=172.16.1.1
ROUTER2_LANIP=192.168.2.1
ROUTER2_LANNET=192.168.2.0/24
ROUTER2_WANIP=10.0.0.2
ROUTER2_IPSECIP=172.16.2.1

DEBUG=${DEBUG:-false}
TIMEOUT=7
HIJACKING_NPF="${HIJACKING},blanket=/dev/npf"

setup_router()
{
local sock=$1
local lan=$2
local wan=$3

rump_server_add_iface $sock shmif0 bus0
rump_server_add_iface $sock shmif1 bus1

export RUMP_SERVER=${sock}
atf_check -s exit:0 rump.sysctl -q -w net.inet.ip.dad_count=0

atf_check -s exit:0 rump.ifconfig shmif0 inet ${lan} netmask 0xffffff00
atf_check -s exit:0 rump.ifconfig shmif0 up
# Ensure shmif0 is running
atf_check -s exit:0 -o ignore rump.ping -n -c 1 -w $TIMEOUT ${lan}
$DEBUG && rump.ifconfig shmif0

atf_check -s exit:0 rump.ifconfig shmif1 inet ${wan} netmask 0xff000000
atf_check -s exit:0 rump.ifconfig shmif1 up
# Ensure shmif1 is running
atf_check -s exit:0 -o ignore rump.ping -n -c 1 -w $TIMEOUT ${wan}
$DEBUG && rump.ifconfig shmif1

unset RUMP_SERVER
}

setup_if_ipsec()
{
local addr=$1
local remote=$2
local src=$3
local dst=$4
local peernet=$5

rump_server_add_iface $RUMP_SERVER ipsec0
atf_check -s exit:0 rump.ifconfig ipsec0 tunnel $src $dst
atf_check -s exit:0 rump.ifconfig ipsec0 inet ${addr}/32 $remote
atf_check -s exit:0 -o ignore rump.route add -inet $peernet $addr

$DEBUG && rump.ifconfig ipsec0
$DEBUG && rump.route -nL show -inet
}

get_if_ipsec_unique()
{
local src=$1
local proto=$2
local unique=""

unique=`$HIJACKING setkey -DP | grep -A2 "^${src}.*(${proto})$" | grep unique | sed 's/.*unique#//'`

echo $unique
}

setup_if_ipsec_sa()
{
local src=$1
local dst=$2
local inid=$3
local outid=$4
local proto=$5
local algo=$6

local tmpfile=./tmp
local inunique=""
local outunique=""
local algo_args="$(generate_algo_args $proto $algo)"

inunique=`get_if_ipsec_unique $dst "ipv4"`
atf_check -s exit:0 test "X$inunique" != "X"
outunique=`get_if_ipsec_unique $src "ipv4"`
atf_check -s exit:0 test "X$outunique" != "X"

cat > $tmpfile <<-EOF
add $dst $src $proto $inid -u $inunique -m transport $algo_args;
add $src $dst $proto $outid -u $outunique -m transport $algo_args;
EOF
$DEBUG && cat $tmpfile
atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
$DEBUG && $HIJACKING setkey -D
$DEBUG && $HIJACKING setkey -DP
}

setup_tunnel()
{
local proto=$1
local algo=$2

local addr= remote= src= dst= peernet=

export RUMP_SERVER=$SOCK_ROUTER1
addr=$ROUTER1_IPSECIP
remote=$ROUTER2_IPSECIP
src=$ROUTER1_WANIP
dst=$ROUTER2_WANIP
peernet=$ROUTER2_LANNET
setup_if_ipsec $addr $remote $src $dst $peernet
setup_if_ipsec_sa $src $dst "10000" "10001" $proto $algo

export RUMP_SERVER=$SOCK_ROUTER2
addr=$ROUTER2_IPSECIP
remote=$ROUTER1_IPSECIP
src=$ROUTER2_WANIP
dst=$ROUTER1_WANIP
peernet=$ROUTER1_LANNET
setup_if_ipsec $addr $remote $src $dst $peernet
setup_if_ipsec_sa $src $dst "10001" "10000" $proto $algo

# Ensure ipsecif(4) settings have completed.
export RUMP_SERVER=$SOCK_ROUTER1
atf_check -s exit:0 -o ignore \
rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER1_LANIP \
$ROUTER2_LANIP

export RUMP_SERVER=$SOCK_ROUTER2
atf_check -s exit:0 -o ignore \
rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER2_LANIP \
$ROUTER1_LANIP

unset RUMP_SERVER
}

ipsecif_pfil_setup()
{
local proto=$1
local algo=$2

rump_server_crypto_npf_start $SOCK_ROUTER1 netipsec ipsec
rump_server_crypto_npf_start $SOCK_ROUTER2 netipsec ipsec

setup_router $SOCK_ROUTER1 $ROUTER1_LANIP $ROUTER1_WANIP
setup_router $SOCK_ROUTER2 $ROUTER2_LANIP $ROUTER2_WANIP

setup_tunnel $proto $algo
}

prepare_file()
{
local file=$1
local data="0123456789"

touch $file
for i in `seq 1 512`
do
echo $data >> $file
done
}

build_npf_conf()
{
local outfile=$1
local subnet=$2
local direction=$3

local reverse=
if [ "X${direction}" = "Xin" ] ; then
reverse="out"
else
reverse="in"
fi

cat > $outfile <<-EOF
set bpf.jit off
\$if = inet4(ipsec0)
\$subnet = { $subnet }

procedure "log0" {
log: npflog0
}

group default {
block $direction on \$if proto tcp from \$subnet apply "log0"
pass $reverse on \$if proto tcp from \$subnet
pass in on \$if proto icmp from 0.0.0.0/0
pass out on \$if proto icmp from 0.0.0.0/0
pass final on shmif0 all
pass final on shmif1 all
}
EOF
}

ipsecif_pfil_test()
{
local outfile=./out
local npffile=./npf.conf
local file_send=./file.send
local file_recv=./file.recv

local subnet="172.16.0.0/16"

# Try TCP communications just in case.
start_nc_server $SOCK_ROUTER2 8888 $file_recv ipv4
prepare_file $file_send
export RUMP_SERVER=$SOCK_ROUTER1
atf_check -s exit:0 $HIJACKING nc -w 3 $ROUTER2_IPSECIP 8888 < $file_send
atf_check -s exit:0 diff -q $file_send $file_recv
stop_nc_server

# Setup npf to block *out* direction for ipsecif(4).
build_npf_conf $npffile $subnet "out"
$DEBUG && cat $npffile

export RUMP_SERVER=$SOCK_ROUTER1
atf_check -s exit:0 $HIJACKING_NPF npfctl reload $npffile
atf_check -s exit:0 $HIJACKING_NPF npfctl start
$DEBUG && ${HIJACKING},"blanket=/dev/npf" npfctl show

# ping should still work
export RUMP_SERVER=$SOCK_ROUTER1
atf_check -s exit:0 -o ignore \
rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER1_LANIP \
$ROUTER2_LANIP

export RUMP_SERVER=$SOCK_ROUTER2
atf_check -s exit:0 -o ignore \
rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER2_LANIP \
$ROUTER1_LANIP

# TCP communications should be blocked.
start_nc_server $SOCK_ROUTER2 8888 $file_recv ipv4
prepare_file $file_send
export RUMP_SERVER=$SOCK_ROUTER1
atf_check -s exit:1 -o ignore $HIJACKING nc -w 3 $ROUTER2_IPSECIP 8888 < $file_send
stop_nc_server

atf_check -s exit:0 $HIJACKING_NPF npfctl stop
$DEBUG && ${HIJACKING},"blanket=/dev/npf" npfctl show

# Setup npf to block *in* direction for ipsecif(4).
build_npf_conf $npffile $subnet "in"
$DEBUG && cat $npffile

export RUMP_SERVER=$SOCK_ROUTER2
atf_check -s exit:0 $HIJACKING_NPF npfctl reload $npffile
atf_check -s exit:0 $HIJACKING_NPF npfctl start
$DEBUG && ${HIJACKING},"blanket=/dev/npf" npfctl show

# ping should still work.
export RUMP_SERVER=$SOCK_ROUTER1
atf_check -s exit:0 -o ignore \
rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER1_LANIP \
$ROUTER2_LANIP

export RUMP_SERVER=$SOCK_ROUTER2
atf_check -s exit:0 -o ignore \
rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER2_LANIP \
$ROUTER1_LANIP

# TCP communications should be blocked.
start_nc_server $SOCK_ROUTER2 8888 $file_recv ipv4
prepare_file $file_send
export RUMP_SERVER=$SOCK_ROUTER1
atf_check -s exit:1 -o ignore $HIJACKING nc -w 3 $ROUTER2_IPSECIP 8888 < $file_send
stop_nc_server

atf_check -s exit:0 $HIJACKING_NPF npfctl stop
$DEBUG && ${HIJACKING},"blanket=/dev/npf" npfctl show

unset RUMP_SERVER
}

ipsecif_pfil_teardown()
{

export RUMP_SERVER=$SOCK_ROUTER1
atf_check -s exit:0 rump.ifconfig ipsec0 deletetunnel
atf_check -s exit:0 rump.ifconfig ipsec0 destroy
$HIJACKING setkey -F

export RUMP_SERVER=$SOCK_ROUTER2
atf_check -s exit:0 rump.ifconfig ipsec0 deletetunnel
atf_check -s exit:0 rump.ifconfig ipsec0 destroy
$HIJACKING setkey -F

unset RUMP_SERVER
}

add_test()
{
local proto=$1
local algo=$2
local _algo=$(echo $algo | sed 's/-//g')

name="ipsecif_pfil_${proto}_${_algo}"
desc="Does ipsecif filter tests"

atf_test_case ${name} cleanup
eval "${name}_head() {
atf_set descr \"${desc}\"
atf_set require.progs rump_server setkey
}
${name}_body() {
ipsecif_pfil_setup ${proto} ${algo}
ipsecif_pfil_test
ipsecif_pfil_teardown
rump_server_destroy_ifaces
}
${name}_cleanup() {
\$DEBUG && dump
cleanup
}"
atf_add_test_case ${name}
}

add_test_allalgo()
{
local desc=$1

for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
add_test esp $algo
done

# ah does not support yet
}

atf_init_test_cases()
{

add_test_allalgo ipsecif_pfil
}