diff options
author | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2020-12-20 22:45:23 +0000 |
---|---|---|
committer | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2020-12-20 22:45:23 +0000 |
commit | 71ec876454db915001b54511612439261d6fb94d (patch) | |
tree | 5e0e47136034e8efece66da9d2ad75b054ab3e9a /regress/sys/netinet/ipsec | |
parent | a495c1f5f0bec142f50ee2c0245a7e2614115cee (diff) |
Use regress framework for setup and shorten target names.
Diffstat (limited to 'regress/sys/netinet/ipsec')
-rw-r--r-- | regress/sys/netinet/ipsec/Makefile | 88 |
1 files changed, 47 insertions, 41 deletions
diff --git a/regress/sys/netinet/ipsec/Makefile b/regress/sys/netinet/ipsec/Makefile index 9b51def008a..3f7e2460488 100644 --- a/regress/sys/netinet/ipsec/Makefile +++ b/regress/sys/netinet/ipsec/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.27 2020/12/17 00:51:13 bluhm Exp $ +# $OpenBSD: Makefile,v 1.28 2020/12/20 22:45:22 bluhm Exp $ # This test needs a manual setup of four machines, the make # target create-setup can be used to distribute the configuration. @@ -155,18 +155,18 @@ PROGS = nonxt-sendrecv nonxt-reflect .if empty (IPS_SSH) || empty (RT_SSH) || empty (ECO_SSH) regress: - @echo this tests needs three remote machines to operate on - @echo IPS_SSH RT_SSH ECO_SSH are empty - @echo fill out these variables for additional tests, then - @echo check whether your test machines are set up properly + # This tests needs three remote machines to operate on. + # IPS_SSH RT_SSH ECO_SSH are empty. + # Fill out these variables for additional tests, then + # check whether your test machines are set up properly. @echo SKIPPED .elif make (regress) || make (all) .BEGIN: - @echo ${SUDO} true ssh -t ${IPS_SSH} ${SUDO} true rm -f stamp-* + @echo .endif # Create python include file containing the addresses. @@ -191,34 +191,38 @@ addr.py: Makefile .endfor mv $@.tmp $@ -# Load the ipsec sa and flow into the kernel of the SRC and IPS machine. +REGRESS_SETUP_ONCE += ipsec stamp-ipsec: addr.py ipsec.conf +ipsec: + # Load the ipsec sa and flow into the kernel of the SRC and IPS machine. cat addr.py ${.CURDIR}/ipsec.conf | /sbin/ipsecctl -n -f - ${SUDO} ipsecctl -F cat addr.py ${.CURDIR}/ipsec.conf | ${SUDO} ipsecctl -f - ssh ${IPS_SSH} ${SUDO} ipsecctl -F cat addr.py ${.CURDIR}/ipsec.conf | ssh ${IPS_SSH} ${SUDO} ipsecctl\ -f - -D FROM=to -D TO=from -D LOCAL=peer -D PEER=local - @date >$@ -# Load a pf log enc0 pass any rule into the kernel of the IPS machine. +REGRESS_SETUP_ONCE += pfctl stamp-pfctl: addr.py pf.conf +pfctl: + # Load a pf log enc0 pass any rule into the kernel of the IPS machine. cat addr.py ${.CURDIR}/pf.conf | /sbin/pfctl -n -f - cat addr.py ${.CURDIR}/pf.conf | \ ssh ${IPS_SSH} ${SUDO} pfctl -a regress -f - - @date >$@ +REGRESS_SETUP_ONCE += reflect stamp-reflect: nonxt-reflect +reflect: + # Build and start packet reflection program on IPS and ECO machine. ssh ${IPS_SSH} make -C ${.CURDIR} nonxt-reflect ssh ${IPS_SSH} ${SUDO} rcctl start inetd nonxt_reflect - -ssh ${ECO_SSH} make -C ${.CURDIR} nonxt-reflect + ssh ${ECO_SSH} make -C ${.CURDIR} nonxt-reflect ssh ${ECO_SSH} ${SUDO} rcctl start inetd nonxt_reflect - @date >$@ DUMPCMD= tcpdump -l -e -vvv -s 2048 -ni -# Run tcpdump on enc device of IPS machine. stamp-bpf: Makefile stamp-drop + # Run tcpdump on enc device of IPS machine. rm -f enc0.tcpdump -ssh ${IPS_SSH} ${SUDO} pkill -f "'^${DUMPCMD} enc0'" || true ssh ${IPS_SSH} ${SUDO} ${DUMPCMD} enc0 >enc0.tcpdump & @@ -226,8 +230,8 @@ stamp-bpf: Makefile stamp-drop rm -f stamp-stop @date >$@ -# Run tcpdump on pflog device of IPS machine. stamp-pflog: stamp-pfctl stamp-drop + # Run tcpdump on pflog device of IPS machine. rm -f pflog0.tcpdump -ssh ${IPS_SSH} ${SUDO} pkill -f "'^${DUMPCMD} pflog0'" || true ssh ${IPS_SSH} ${SUDO} ${DUMPCMD} pflog0 >pflog0.tcpdump & @@ -236,6 +240,7 @@ stamp-pflog: stamp-pfctl stamp-drop @date >$@ stamp-stop: + # Stop tcpdump on enc and pflog device of IPS machine. sleep 5 # XXX -ssh ${IPS_SSH} ${SUDO} pkill -f "'^${DUMPCMD}'" @date >$@ @@ -243,6 +248,7 @@ stamp-stop: # Old TCP connections send packets from time to time. These confuse # the checks that count the IPsec packets with netstat -ss. stamp-drop: + # Drop old TCP connections. netstat -nv -p tcp |\ perl -ne '\ / ${PREFIX_IPV6}.* ${PREFIX_IPV6}/ ||\ @@ -256,17 +262,17 @@ stamp-drop: # Disable tests that do not pass. -run-regress-pflog-ping-IPS_AH_TRANSP_IPV4 \ - run-regress-pflog-udp-IPS_AH_TRANSP_IPV4 \ - run-regress-pflog-tcp-IPS_AH_TRANSP_IPV4 \ - run-regress-pflog-nonxt-IPS_AH_TRANSP_IPV4 \ - run-regress-pflog-ping-IPS_AH_TRANSP_IPV6 \ - run-regress-pflog-udp-IPS_AH_TRANSP_IPV6 \ - run-regress-pflog-tcp-IPS_AH_TRANSP_IPV6 \ - run-regress-pflog-nonxt-IPS_AH_TRANSP_IPV6: - @echo IPv6 AH packets are treated as their payload protocol by pf. - @echo So they match the floating state on the physical interface - @echo and are not logged by the enc0 pf rule. +run-pflog-ping-IPS_AH_TRANSP_IPV4 \ + run-pflog-udp-IPS_AH_TRANSP_IPV4 \ + run-pflog-tcp-IPS_AH_TRANSP_IPV4 \ + run-pflog-nonxt-IPS_AH_TRANSP_IPV4 \ + run-pflog-ping-IPS_AH_TRANSP_IPV6 \ + run-pflog-udp-IPS_AH_TRANSP_IPV6 \ + run-pflog-tcp-IPS_AH_TRANSP_IPV6 \ + run-pflog-nonxt-IPS_AH_TRANSP_IPV6: + # IPv6 AH packets are treated as their payload protocol by pf. + # So they match the floating state on the physical interface + # and are not logged by the enc0 pf rule. @echo DISABLED # Ping all addresses. This ensures that the IP addresses are configured @@ -275,7 +281,7 @@ run-regress-pflog-ping-IPS_AH_TRANSP_IPV4 \ .for host dir in SRC OUT IPS IN IPS OUT RT IN RT OUT ECO IN .for ping ipv in ping IPV4 ping6 IPV6 TARGETS += ping-${host}_${dir}_${ipv} -run-regress-send-ping-${host}_${dir}_${ipv}: +run-send-ping-${host}_${dir}_${ipv}: ${ping} -n -c 1 -w 2 ${${host}_${dir}_${ipv}} .endfor .endfor @@ -292,8 +298,8 @@ run-regress-send-ping-${host}_${dir}_${ipv}: TARGETS += ping-${len}-${host}_${sec}_${mode}_${ipv} ping ${host:L} ${sec:L} ${mode:L} ${ipv:L}:\ - run-regress-send-ping-${len}-${host}_${sec}_${mode}_${ipv} -run-regress-send-ping-${len}-${host}_${sec}_${mode}_${ipv}: + run-send-ping-${len}-${host}_${sec}_${mode}_${ipv} +run-send-ping-${len}-${host}_${sec}_${mode}_${ipv}: netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\ awk '/input ${sec:S/BUNDLE/ESP/} /{print $$1}' >pkt.in netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\ @@ -325,8 +331,8 @@ run-regress-send-ping-${len}-${host}_${sec}_${mode}_${ipv}: TARGETS += udp-${host}_${sec}_${mode}_${ipv} udp ${host:L} ${sec:L} ${mode:L} ${ipv:L}:\ - run-regress-send-udp-${host}_${sec}_${mode}_${ipv} -run-regress-send-udp-${host}_${sec}_${mode}_${ipv}: + run-send-udp-${host}_${sec}_${mode}_${ipv} +run-send-udp-${host}_${sec}_${mode}_${ipv}: netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\ awk '/input ${sec:S/BUNDLE/ESP/} /{print $$1}' >pkt.in netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\ @@ -351,8 +357,8 @@ run-regress-send-udp-${host}_${sec}_${mode}_${ipv}: TARGETS += tcp-${host}_${sec}_${mode}_${ipv} tcp ${host:L} ${sec:L} ${mode:L} ${ipv:L}:\ - run-regress-send-tcp-${host}_${sec}_${mode}_${ipv} -run-regress-send-tcp-${host}_${sec}_${mode}_${ipv}: + run-send-tcp-${host}_${sec}_${mode}_${ipv} +run-send-tcp-${host}_${sec}_${mode}_${ipv}: echo $$$$ | nc -n -N -w 3 ${${host}_${sec}_${mode}_${ipv}} 7 |\ fgrep $$$$ @@ -361,8 +367,8 @@ run-regress-send-tcp-${host}_${sec}_${mode}_${ipv}: TARGETS += nonxt-${host}_${sec}_${mode}_${ipv} nonxt ${host:L} ${sec:L} ${mode:L} ${ipv:L}:\ - run-regress-send-nonxt-${host}_${sec}_${mode}_${ipv} -run-regress-send-nonxt-${host}_${sec}_${mode}_${ipv}: nonxt-sendrecv + run-send-nonxt-${host}_${sec}_${mode}_${ipv} +run-send-nonxt-${host}_${sec}_${mode}_${ipv}: nonxt-sendrecv netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\ awk '/input ${sec:S/BUNDLE/ESP/} /{print $$1}' >pkt.in netstat -s -p ${sec:L:S/ipip/ipencap/:S/bundle/esp/} |\ @@ -442,7 +448,7 @@ REGEX_RPL_${host}_${sec}_${mode}_${ipv}_NONXT=\ .for proto in PING UDP TCP NONXT -run-regress-bpf-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop +run-bpf-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop egrep -q '\ ${REGEX_${sec}}\ ${REGEX_REQ_${mode}}\ @@ -454,7 +460,7 @@ run-regress-bpf-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop ${REGEX_RPL_${host}_${sec}_${mode}_${ipv}_${proto}}\ ${REGEX_RPL_${proto}} ' enc0.tcpdump -run-regress-pflog-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop +run-pflog-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop egrep -q '\ rule .*regress.0/\(match\) .*\ pass in on enc0:.*\ @@ -472,11 +478,11 @@ run-regress-pflog-${proto:L}-${host}_${sec}_${mode}_${ipv}: stamp-stop .endfor .endfor -REGRESS_TARGETS = ${TARGETS:S/^/run-regress-send-/} \ - ${TARGETS:N*_IPIP_*:N*_BUNDLE_*:N*_IN_*:N*_OUT_*:N*-SRC_*:Nudp-*_IPCOMP_*:Ntcp-*_IPCOMP_*:N*-small-*:Nnonxt-*_IPCOMP_*:S/-big-/-/:S/^/run-regress-bpf-/} \ - ${TARGETS:N*_IPIP_*:N*_IPCOMP_*:N*_IN_*:N*_OUT_*:N*-SRC_*:N*-small-*:S/-big-/-/:S/^/run-regress-pflog-/} -${REGRESS_TARGETS:Mrun-regress-send-*}: \ - stamp-ipsec stamp-reflect stamp-bpf stamp-pflog stamp-drop +REGRESS_TARGETS = ${TARGETS:S/^/run-send-/} \ + ${TARGETS:N*_IPIP_*:N*_BUNDLE_*:N*_IN_*:N*_OUT_*:N*-SRC_*:Nudp-*_IPCOMP_*:Ntcp-*_IPCOMP_*:N*-small-*:Nnonxt-*_IPCOMP_*:S/-big-/-/:S/^/run-bpf-/} \ + ${TARGETS:N*_IPIP_*:N*_IPCOMP_*:N*_IN_*:N*_OUT_*:N*-SRC_*:N*-small-*:S/-big-/-/:S/^/run-pflog-/} + +${REGRESS_TARGETS:Mrun-send-*}: stamp-bpf stamp-pflog stamp-drop CLEANFILES += addr.py *.pyc *.log stamp-* */hostname.* *.{in,out} *.tcpdump |