# $NetBSD: t_ipsec_natt.sh,v 1.5 2020/06/05 03:24:58 knakahara Exp $
#
# Copyright (c) 2017 Internet Initiative Japan Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
add_sa()
{
local proto=$1
local algo_args="$2"
local ip_local=$3
local ip_remote=$4
local ip_nat_remote=$5
local spi=$6
local port=$7
local tmpfile=./tmp
export RUMP_SERVER=$SOCK_LOCAL
cat > $tmpfile <<-EOF
add $ip_local [4500] $ip_remote [4500] $proto $((spi)) $algo_args;
add $ip_remote [4500] $ip_local [4500] $proto $((spi + 1)) $algo_args;
EOF
$DEBUG && cat $tmpfile
atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
$DEBUG && $HIJACKING setkey -D
# XXX it can be expired if $lifetime is very short
#check_sa_entries $SOCK_LOCAL $ip_local $ip_remote
export RUMP_SERVER=$SOCK_REMOTE
cat > $tmpfile <<-EOF
add $ip_local [$port] $ip_remote [4500] $proto $((spi)) $algo_args;
add $ip_remote [4500] $ip_nat_remote [$port] $proto $((spi + 1)) $algo_args;
EOF
$DEBUG && cat $tmpfile
atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
$DEBUG && $HIJACKING setkey -D
# XXX it can be expired if $lifetime is very short
#check_sa_entries $SOCK_PEER $ip_local $ip_remote
}
prepare_file()
{
local file=$1
local data="0123456789"
touch $file
for i in `seq 1 512`
do
echo $data >> $file
done
}
build_npf_conf()
{
local outfile=$1
local localnet=$2
cat > $outfile <<-EOF
set bpf.jit off
\$int_if = inet4(shmif0)
\$ext_if = inet4(shmif1)
\$localnet = { $localnet }
map \$ext_if dynamic \$localnet -> \$ext_if
group "external" on \$ext_if {
pass stateful out final all
}
group "internal" on \$int_if {
block in all
pass in final from \$localnet
pass out final all
}
group default {
pass final on lo0 all
block all
}
EOF
}
PIDSFILE=./terminator.pids
start_natt_terminator()
{
local sock=$1
local proto=$2
local ip=$3
local port=$4
local pidsfile=$5
local backup=$RUMP_SERVER
local pid= opt=
local terminator="$(atf_get_srcdir)/natt_terminator"
if [ "$proto" = "ipv6" ]; then
opt="-6"
else
opt="-4"
fi
export RUMP_SERVER=$sock
env LD_PRELOAD=/usr/lib/librumphijack.so \
$terminator $opt $ip $port &
pid=$!
if [ ! -f $PIDSFILE ]; then
touch $PIDSFILE
fi
echo $pid >> $PIDSFILE
$DEBUG && rump.netstat -a -f inet
export RUMP_SERVER=$backup
sleep 1
}
stop_natt_terminators()
{
local pid=
if [ ! -f $PIDSFILE ]; then
return
fi
for pid in $(cat $PIDSFILE); do
kill -9 $pid
done
rm -f $PIDSFILE
}
test_ipsec_natt_transport_ipv4()
{
local algo=$1
local ip_local=10.0.1.2
local ip_nat_local=10.0.1.1
local ip_nat_remote=20.0.0.1
local ip_remote=20.0.0.2
local subnet_local=10.0.1.0
local outfile=./out
local npffile=./npf.conf
local file_send=./file.send
local file_recv=./file.recv
local algo_args="$(generate_algo_args esp-udp $algo)"
local pid= port=
# There is an NAPT. ping works but source IP/port are translated
export RUMP_SERVER=$SOCK_LOCAL
atf_check -s exit:0 -o ignore rump.ping -c 1 -n -w 3 $ip_remote
# Launch a nc server as a terminator of NAT-T on outside the NAPT
start_natt_terminator $SOCK_REMOTE ipv4 $ip_remote 4500
echo zzz > $file_send
export RUMP_SERVER=$SOCK_LOCAL
# Send a UDP packet to the remote server at port 4500 from the local
# host of port 4500. This makes a mapping on the NAPT between them
atf_check -s exit:0 $HIJACKING \
nc -u -w 3 -p 4500 $ip_remote 4500 < $file_send
# Launch a nc server as a terminator of NAT-T on inside the NAPT,
# taking over port 4500 of the local host.
start_natt_terminator $SOCK_LOCAL ipv4 $ip_local 4500
# Get a translated port number from 4500 on the NAPT
export RUMP_SERVER=$SOCK_NAT
$DEBUG && $HIJACKING_NPF npfctl list
# 10.0.1.2:4500 20.0.0.2:4500 via shmif1:9696
port=$(get_natt_port $ip_local $ip_nat_remote)
$DEBUG && echo port=$port
if [ -z "$port" ]; then
atf_fail "Failed to get a translated port on NAPT"
fi
# Kill the NAT-T terminator
stop_natt_terminators
}
test_ipsec_natt_transport_ipv6_without_nat()
{
local algo=$1
local ip_local_phys=fc00::1
local ip_local_ipsecif=fc00:1111::1
local ip_remote_phys=fc00::2
local ip_remote_ipsecif=fc00:2222::1
local outfile=./out
local npffile=./npf.conf
local file_send=./file.send
local file_recv=./file.recv
local algo_args="$(generate_algo_args esp-udp $algo)"
local pid=
local port=4500
