summaryrefslogtreecommitdiff
path: root/regress/sys/netinet/ipsec
diff options
context:
space:
mode:
authorAlexander Bluhm <bluhm@cvs.openbsd.org>2020-12-20 22:45:23 +0000
committerAlexander Bluhm <bluhm@cvs.openbsd.org>2020-12-20 22:45:23 +0000
commit71ec876454db915001b54511612439261d6fb94d (patch)
tree5e0e47136034e8efece66da9d2ad75b054ab3e9a /regress/sys/netinet/ipsec
parenta495c1f5f0bec142f50ee2c0245a7e2614115cee (diff)
Use regress framework for setup and shorten target names.
Diffstat (limited to 'regress/sys/netinet/ipsec')
-rw-r--r--regress/sys/netinet/ipsec/Makefile88
1 files changed, 47 insertions, 41 deletions
diff --git a/regress/sys/netinet/ipsec/Makefile b/regress/sys/netinet/ipsec/Makefile
index 9b51def008a..3f7e2460488 100644
--- a/regress/sys/netinet/ipsec/Makefile
+++ b/regress/sys/netinet/ipsec/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.27 2020/12/17 00:51:13 bluhm Exp $
+# $OpenBSD: Makefile,v 1.28 2020/12/20 22:45:22 bluhm Exp $
# This test needs a manual setup of four machines, the make
# target create-setup can be used to distribute the configuration.
@@ -155,18 +155,18 @@ PROGS = nonxt-sendrecv nonxt-reflect
.if empty (IPS_SSH) || empty (RT_SSH) || empty (ECO_SSH)
regress:
- @echo this tests needs three remote machines to operate on
- @echo IPS_SSH RT_SSH ECO_SSH are empty
- @echo fill out these variables for additional tests, then
- @echo check whether your test machines are set up properly
+ # This tests needs three remote machines to operate on.
+ # IPS_SSH RT_SSH ECO_SSH are empty.
+ # Fill out these variables for additional tests, then
+ # check whether your test machines are set up properly.
@echo SKIPPED
.elif make (regress) || make (all)
.BEGIN:
- @echo
${SUDO} true
ssh -t ${IPS_SSH} ${SUDO} true
rm -f stamp-*
+ @echo
.endif
# Create python include file containing the addresses.
@@ -191,34 +191,38 @@ addr.py: Makefile
.endfor
mv $@.tmp $@
-# Load the ipsec sa and flow into the kernel of the SRC and IPS machine.
+REGRESS_SETUP_ONCE += ipsec
stamp-ipsec: addr.py ipsec.conf
+ipsec:
+ # Load the ipsec sa and flow into the kernel of the SRC and IPS machine.
cat addr.py ${.CURDIR}/ipsec.conf | /sbin/ipsecctl -n -f -
${SUDO} ipsecctl -F
cat addr.py ${.CURDIR}/ipsec.conf | ${SUDO} ipsecctl -f -
ssh ${IPS_SSH} ${SUDO} ipsecctl -F
cat addr.py ${.CURDIR}/ipsec.conf | ssh ${IPS_SSH} ${SUDO} ipsecctl\
-f - -D FROM=to -D TO=from -D LOCAL=peer -D PEER=local
- @date >$@
-# Load a pf log enc0 pass any rule into the kernel of the IPS machine.
+REGRESS_SETUP_ONCE += pfctl
stamp-pfctl: addr.py pf.conf
+pfctl:
+ # Load a pf log enc0 pass any rule into the kernel of the IPS machine.
cat addr.py ${.CURDIR}/pf.conf | /sbin/pfctl -n -f -
cat addr.py ${.CURDIR}/pf.conf | \
ssh ${IPS_SSH} ${SUDO} pfctl -a regress -f -
- @date >$@
+REGRESS_SETUP_ONCE += reflect
stamp-reflect: nonxt-reflect
+reflect:
+ # Build and start packet reflection program on IPS and ECO machine.
ssh ${IPS_SSH} make -C ${.CURDIR} nonxt-reflect
ssh ${IPS_SSH} ${SUDO} rcctl start inetd nonxt_reflect
- -ssh ${ECO_SSH} make -C ${.CURDIR} nonxt-reflect
+ ssh ${ECO_SSH} make -C ${.CURDIR} nonxt-reflect
ssh ${ECO_SSH} ${SUDO} rcctl start inetd nonxt_reflect
- @date >$@
DUMPCMD= tcpdump -l -e -vvv -s 2048 -ni
-# Run tcpdump on enc device of IPS machine.
stamp-bpf: Makefile stamp-drop
+ # Run tcpdump on enc device of IPS machine.
rm -f enc0.tcpdump
-ssh ${IPS_SSH} ${SUDO} pkill -f "'^${DUMPCMD} enc0'" || true
ssh ${IPS_SSH} ${SUDO} ${DUMPCMD} enc0 >enc0.tcpdump &
@@ -226,8 +230,8 @@ stamp-bpf: Makefile stamp-drop
rm -f stamp-stop
@date >$@
-# Run tcpdump on pflog device of IPS machine.
stamp-pflog: stamp-pfctl stamp-drop
+ # Run tcpdump on pflog device of IPS machine.
rm -f pflog0.tcpdump
-ssh ${IPS_SSH} ${SUDO} pkill -f "'^${DUMPCMD} pflog0'" || true
ssh ${IPS_SSH} ${SUDO} ${DUMPCMD} pflog0 >pflog0.tcpdump &
@@ -236,6 +240,7 @@ stamp-pflog: stamp-pfctl stamp-drop
@date >$@
stamp-stop:
+ # Stop tcpdump on enc and pflog device of IPS machine.
sleep 5 # XXX
-ssh ${IPS_SSH} ${SUDO} pkill -f "'^${DUMPCMD}'"
@date >$@
@@ -243,6 +248,7 @@ stamp-stop:
# Old TCP connections send packets from time to time. These confuse
# the checks that count the IPsec packets with netstat -ss.
stamp-drop:
+ # Drop old TCP connections.
netstat -nv -p tcp |\
perl -ne '\
/ ${PREFIX_IPV6}.* ${PREFIX_IPV6}/ ||\
@@ -256,17 +262,17 @@ stamp-drop:
# Disable tests that do not pass.
-run-regress-pflog-ping-IPS_AH_TRANSP_IPV4 \
- run-regress-pflog-udp-IPS_AH_TRANSP_IPV4 \
- run-regress-pflog-tcp-IPS_AH_TRANSP_IPV4 \
- run-regress-pflog-nonxt-IPS_AH_TRANSP_IPV4 \
- run-regress-pflog-ping-IPS_AH_TRANSP_IPV6 \
- run-regress-pflog-udp-IPS_AH_TRANSP_IPV6 \
- run-regress-pflog-tcp-IPS_AH_TRANSP_IPV6 \
- run-regress-pflog-nonxt-IPS_AH_TRANSP_IPV6:
- @echo IPv6 AH packets are treated as their payload protocol by pf.
- @echo So they match the floating state on the physical interface
- @echo and are not logged by the enc0 pf rule.
+run-pflog-ping-IPS_AH_TRANSP_IPV4 \
+ run-pflog-udp-IPS_AH_TRANSP_IPV4 \
+ run-pflog-tcp-IPS_AH_TRANSP_IPV4 \
+ run-pflog-nonxt-IPS_AH_TRANSP_IPV4 \
+ run-pflog-ping-IPS_AH_TRANSP_IPV6 \
+ run-pflog-udp-IPS_AH_TRANSP_IPV6 \
+ run-pflog-tcp-IPS_AH_TRANSP_IPV6 \
+ run-pflog-nonxt-IPS_AH_TRANSP_IPV6:
+ # IPv6 AH packets are treated as their payload protocol by pf.
+ # So they match the floating state on the physical interface
+ # and are not logged by the enc0 pf rule.
@echo DISABLED
# Ping all addresses. This ensures that the IP addresses are configured
@@ -275,7 +281,7 @@ run-regress-pflog-ping-IPS_AH_TRANSP_IPV4 \
.for host dir in SRC OUT IPS IN IPS OUT RT IN RT OUT ECO IN
.for ping ipv in ping IPV4 ping6 IPV6
TARGETS += ping-${host}_${dir}_${ipv}
-run-regress-send-ping-${host}_${dir}_${ipv}:
+run-send-ping-${host}_${dir}_${ipv}:
${ping} -n -c 1 -w 2 ${${host}_${dir}_${ipv}}
.endfor
.endfor
@@ -292,8 +298,8 @@ run-regress-send-ping-${host}_${dir}_${ipv}:
TARGETS += ping-${len}-${host}_${sec}_${mode}_${ipv}
ping ${host:L} ${sec:L} ${mode:L} ${ipv:L}:\
- run-regress-send-ping-${len}-${host}_${sec}_${mode}_${ipv}
-run-regress-send-ping-${len}-${host}_${sec}_${mode}_${ipv}:
+ run-send-ping-${len}-${host}_${sec}_${mode}_${ipv}
+run-send-ping-${len}-${host}_${sec}_${mode}_${ipv}:
netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\
awk '/input ${sec:S/BUNDLE/ESP/} /{print $$1}' >pkt.in
netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\
@@ -325,8 +331,8 @@ run-regress-send-ping-${len}-${host}_${sec}_${mode}_${ipv}:
TARGETS += udp-${host}_${sec}_${mode}_${ipv}
udp ${host:L} ${sec:L} ${mode:L} ${ipv:L}:\
- run-regress-send-udp-${host}_${sec}_${mode}_${ipv}
-run-regress-send-udp-${host}_${sec}_${mode}_${ipv}:
+ run-send-udp-${host}_${sec}_${mode}_${ipv}
+run-send-udp-${host}_${sec}_${mode}_${ipv}:
netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\
awk '/input ${sec:S/BUNDLE/ESP/} /{print $$1}' >pkt.in
netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\
@@ -351,8 +357,8 @@ run-regress-send-udp-${host}_${sec}_${mode}_${ipv}:
TARGETS += tcp-${host}_${sec}_${mode}_${ipv}
tcp ${host:L} ${sec:L} ${mode:L} ${ipv:L}:\
- run-regress-send-tcp-${host}_${sec}_${mode}_${ipv}
-run-regress-send-tcp-${host}_${sec}_${mode}_${ipv}:
+ run-send-tcp-${host}_${sec}_${mode}_${ipv}
+run-send-tcp-${host}_${sec}_${mode}_${ipv}:
echo $$$$ | nc -n -N -w 3 ${${host}_${sec}_${mode}_${ipv}} 7 |\
fgrep $$$$
@@ -361,8 +367,8 @@ run-regress-send-tcp-${host}_${sec}_${mode}_${ipv}:
TARGETS += nonxt-${host}_${sec}_${mode}_${ipv}
nonxt ${host:L} ${sec:L} ${mode:L} ${ipv:L}:\
- run-regress-send-nonxt-${host}_${sec}_${mode}_${ipv}
-run-regress-send-nonxt-${host}_${sec}_${mode}_${ipv}: nonxt-sendrecv
+ run-send-nonxt-${host}_${sec}_${mode}_${ipv}
+run-send-nonxt-${host}_${sec}_${mode}_${ipv}: nonxt-sendrecv
netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\
awk '/input ${sec:S/BUNDLE/ESP/} /{print $$1}' >pkt.in
netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\
@@ -442,7 +448,7 @@ REGEX_RPL_${host}_${sec}_${mode}_${ipv}_NONXT=\
.for proto in PING UDP TCP NONXT
-run-regress-bpf-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop
+run-bpf-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop
egrep -q '\
${REGEX_${sec}}\
${REGEX_REQ_${mode}}\
@@ -454,7 +460,7 @@ run-regress-bpf-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop
${REGEX_RPL_${host}_${sec}_${mode}_${ipv}_${proto}}\
${REGEX_RPL_${proto}} ' enc0.tcpdump
-run-regress-pflog-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop
+run-pflog-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop
egrep -q '\
rule .*regress.0/\(match\) .*\
pass in on enc0:.*\
@@ -472,11 +478,11 @@ run-regress-pflog-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop
.endfor
.endfor
-REGRESS_TARGETS = ${TARGETS:S/^/run-regress-send-/} \
- ${TARGETS:N*_IPIP_*:N*_BUNDLE_*:N*_IN_*:N*_OUT_*:N*-SRC_*:Nudp-*_IPCOMP_*:Ntcp-*_IPCOMP_*:N*-small-*:Nnonxt-*_IPCOMP_*:S/-big-/-/:S/^/run-regress-bpf-/} \
- ${TARGETS:N*_IPIP_*:N*_IPCOMP_*:N*_IN_*:N*_OUT_*:N*-SRC_*:N*-small-*:S/-big-/-/:S/^/run-regress-pflog-/}
-${REGRESS_TARGETS:Mrun-regress-send-*}: \
- stamp-ipsec stamp-reflect stamp-bpf stamp-pflog stamp-drop
+REGRESS_TARGETS = ${TARGETS:S/^/run-send-/} \
+ ${TARGETS:N*_IPIP_*:N*_BUNDLE_*:N*_IN_*:N*_OUT_*:N*-SRC_*:Nudp-*_IPCOMP_*:Ntcp-*_IPCOMP_*:N*-small-*:Nnonxt-*_IPCOMP_*:S/-big-/-/:S/^/run-bpf-/} \
+ ${TARGETS:N*_IPIP_*:N*_IPCOMP_*:N*_IN_*:N*_OUT_*:N*-SRC_*:N*-small-*:S/-big-/-/:S/^/run-pflog-/}
+
+${REGRESS_TARGETS:Mrun-send-*}: stamp-bpf stamp-pflog stamp-drop
CLEANFILES += addr.py *.pyc *.log stamp-* */hostname.* *.{in,out} *.tcpdump