diff options
Diffstat (limited to 'regress/sys/netinet/ipsec/Makefile')
| -rw-r--r-- | regress/sys/netinet/ipsec/Makefile | 404 |
1 files changed, 271 insertions, 133 deletions
diff --git a/regress/sys/netinet/ipsec/Makefile b/regress/sys/netinet/ipsec/Makefile index f054455482c..00a3b08eee5 100644 --- a/regress/sys/netinet/ipsec/Makefile +++ b/regress/sys/netinet/ipsec/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.4 2017/02/08 23:09:28 bluhm Exp $ +# $OpenBSD: Makefile,v 1.5 2017/02/13 17:54:27 bluhm Exp $ # This test needs a manual setup of four machines, the make # target create-setup can be used distribute the configuration. @@ -27,6 +27,9 @@ # +---+ 458 5 +---+ cd +---+ ef +---+ # out in out in out in # +# The encapsulation is chosen by the digit before +# 0,1 ESP +# 2,3 AH PREFIX_IPV4 ?= 10.188.1 PREFIX_IPV6 ?= fdd7:e83e:66bc:1 @@ -39,21 +42,31 @@ PREFIX_IPV6 ?= fdd7:e83e:66bc:1 SRC_OUT_IPV4 ?= ${PREFIX_IPV4}00.17 SRC_OUT_IPV6 ?= ${PREFIX_IPV6}00::17 -SRC_TRANSP_IPV4 ?= ${PREFIX_IPV4}05.17 -SRC_TRANSP_IPV6 ?= ${PREFIX_IPV6}04::17 -SRC_TUNNEL_IPV4 ?= ${PREFIX_IPV4}08.17 -SRC_TUNNEL_IPV6 ?= ${PREFIX_IPV6}08::17 +SRC_ESP_TRANSP_IPV4 ?= ${PREFIX_IPV4}05.17 +SRC_ESP_TRANSP_IPV6 ?= ${PREFIX_IPV6}04::17 +SRC_ESP_TUNNEL_IPV4 ?= ${PREFIX_IPV4}08.17 +SRC_ESP_TUNNEL_IPV6 ?= ${PREFIX_IPV6}08::17 +SRC_AH_TRANSP_IPV4 ?= ${PREFIX_IPV4}25.17 +SRC_AH_TRANSP_IPV6 ?= ${PREFIX_IPV6}24::17 +SRC_AH_TUNNEL_IPV4 ?= ${PREFIX_IPV4}28.17 +SRC_AH_TUNNEL_IPV6 ?= ${PREFIX_IPV6}28::17 IPS_IN_IPV4 ?= ${PREFIX_IPV4}00.70 IPS_IN_IPV6 ?= ${PREFIX_IPV6}00::70 IPS_OUT_IPV4 ?= ${PREFIX_IPV4}01.70 IPS_OUT_IPV6 ?= ${PREFIX_IPV6}01::70 -IPS_TRANSP_IPV4 ?= ${PREFIX_IPV4}05.70 -IPS_TRANSP_IPV6 ?= ${PREFIX_IPV6}05::70 -IPS_TUNNEL4_IPV4 ?= ${PREFIX_IPV4}12.70 -IPS_TUNNEL4_IPV6 ?= ${PREFIX_IPV6}0c::70 -IPS_TUNNEL6_IPV4 ?= ${PREFIX_IPV4}13.70 -IPS_TUNNEL6_IPV6 ?= ${PREFIX_IPV6}0d::70 +IPS_ESP_TRANSP_IPV4 ?= ${PREFIX_IPV4}05.70 +IPS_ESP_TRANSP_IPV6 ?= ${PREFIX_IPV6}05::70 +IPS_ESP_TUNNEL4_IPV4 ?= ${PREFIX_IPV4}12.70 +IPS_ESP_TUNNEL4_IPV6 ?= ${PREFIX_IPV6}0c::70 +IPS_ESP_TUNNEL6_IPV4 ?= ${PREFIX_IPV4}13.70 +IPS_ESP_TUNNEL6_IPV6 ?= ${PREFIX_IPV6}0d::70 +IPS_AH_TRANSP_IPV4 ?= ${PREFIX_IPV4}25.70 +IPS_AH_TRANSP_IPV6 ?= ${PREFIX_IPV6}25::70 +IPS_AH_TUNNEL4_IPV4 ?= ${PREFIX_IPV4}32.70 +IPS_AH_TUNNEL4_IPV6 ?= ${PREFIX_IPV6}2c::70 +IPS_AH_TUNNEL6_IPV4 ?= ${PREFIX_IPV4}33.70 +IPS_AH_TUNNEL6_IPV6 ?= ${PREFIX_IPV6}2d::70 RT_IN_IPV4 ?= ${PREFIX_IPV4}01.71 RT_IN_IPV6 ?= ${PREFIX_IPV6}01::71 @@ -62,10 +75,14 @@ RT_OUT_IPV6 ?= ${PREFIX_IPV6}02::71 ECO_IN_IPV4 ?= ${PREFIX_IPV4}02.72 ECO_IN_IPV6 ?= ${PREFIX_IPV6}02::72 -ECO_TUNNEL4_IPV4 ?= ${PREFIX_IPV4}14.72 -ECO_TUNNEL4_IPV6 ?= ${PREFIX_IPV6}0e::72 -ECO_TUNNEL6_IPV4 ?= ${PREFIX_IPV4}15.72 -ECO_TUNNEL6_IPV6 ?= ${PREFIX_IPV6}0f::72 +ECO_ESP_TUNNEL4_IPV4 ?= ${PREFIX_IPV4}14.72 +ECO_ESP_TUNNEL4_IPV6 ?= ${PREFIX_IPV6}0e::72 +ECO_ESP_TUNNEL6_IPV4 ?= ${PREFIX_IPV4}15.72 +ECO_ESP_TUNNEL6_IPV6 ?= ${PREFIX_IPV6}0f::72 +ECO_AH_TUNNEL4_IPV4 ?= ${PREFIX_IPV4}34.72 +ECO_AH_TUNNEL4_IPV6 ?= ${PREFIX_IPV6}2e::72 +ECO_AH_TUNNEL6_IPV4 ?= ${PREFIX_IPV4}35.72 +ECO_AH_TUNNEL6_IPV6 ?= ${PREFIX_IPV6}2f::72 # Configure Addresses on the machines, there must be routes for the # networks. Adapt interface and addresse variables to your local @@ -114,11 +131,14 @@ addr.py: Makefile .endfor .endfor .endfor -.for host dir in SRC TRANSP SRC TUNNEL \ +.for sec in ESP AH +.for host mode in SRC TRANSP SRC TUNNEL \ IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 \ ECO TUNNEL4 ECO TUNNEL6 .for ipv in IPV4 IPV6 - echo '${host}_${dir}_${ipv}="${${host}_${dir}_${ipv}}"' >>$@.tmp + echo '${host}_${sec}_${mode}_${ipv}="${${host}_${sec}_${mode}_${ipv}}"'\ + >>$@.tmp +.endfor .endfor .endfor mv $@.tmp $@ @@ -139,59 +159,79 @@ stamp-ipsec: addr.py ipsec.conf # Ping all addresses. This ensures that the IP addresses are configured # and all routing table are set up to allow bidirectional packet flow. -run-regress-ping-IPS_TRANSP_IPV6: +.for host dir in SRC OUT IPS IN IPS OUT RT IN RT OUT ECO IN +.for ping ipv in ping IPV4 ping6 IPV6 +TARGETS += ping-${host}_${dir}_${ipv} +run-regress-ping-${host}_${dir}_${ipv}: + @echo '\n======== $@ ========' + ${ping} -n -c 1 -w 2 ${${host}_${dir}_${ipv}} +.endfor +.endfor + +.for sec in ESP AH + +run-regress-ping-IPS_${sec}_TRANSP_IPV6: @echo '\n======== $@ ========' @echo 'IPv6 IPsec input does not filter enc0 interface with pf. Echo' @echo 'request does not create state and echo reply does not pass pf.' @echo DISABLED -run-regress-tcp-IPS_TRANSP_IPV6: +run-regress-tcp-IPS_${sec}_TRANSP_IPV6: @echo '\n======== $@ ========' @echo 'IPv6 IPsec input does not filter enc0 interface with pf. TCP' @echo 'SYN does not create state and SYN+ACK does not pass pf.' @echo DISABLED -.for host dir in SRC OUT SRC TRANSP SRC TUNNEL \ - IPS IN IPS OUT IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 \ - RT IN RT OUT \ - ECO IN ECO TUNNEL4 ECO TUNNEL6 +.for host mode in SRC TRANSP SRC TUNNEL \ + IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 \ + ECO TUNNEL4 ECO TUNNEL6 .for ping ipv in ping IPV4 ping6 IPV6 -TARGETS += ping-${host}_${dir}_${ipv} -run-regress-ping-${host}_${dir}_${ipv}: +TARGETS += ping-${host}_${sec}_${mode}_${ipv} +run-regress-ping-${host}_${sec}_${mode}_${ipv}: @echo '\n======== $@ ========' - netstat -s -p esp | awk '/input ESP /{print $$1}' >esp.in - netstat -s -p esp | awk '/output ESP /{print $$1}' >esp.out - ${ping} -n -c 1 -w 2 ${${host}_${dir}_${ipv}} -.if "${host}" != SRC && "${dir}" != IN && "${dir}" != OUT - netstat -s -p esp | awk '/input ESP /{print $$1-1}' | diff esp.in - - netstat -s -p esp | awk '/output ESP /{print $$1-1}' | diff esp.out - + netstat -s -p ${sec:L} | awk '/input ${sec} /{print $$1}' >pkt.in + netstat -s -p ${sec:L} | awk '/output ${sec} /{print $$1}' >pkt.out + ${ping} -n -c 1 -w 2 ${${host}_${sec}_${mode}_${ipv}} +.if "${host}" != SRC + netstat -s -p ${sec:L} | awk '/input ${sec} /{print $$1-1}' |\ + diff pkt.in - + netstat -s -p ${sec:L} | awk '/output ${sec} /{print $$1-1}' |\ + diff pkt.out - .endif .endfor .endfor -.for host dir in IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 \ +.for host mode in IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 \ ECO TUNNEL4 ECO TUNNEL6 .for ipv in IPV4 IPV6 -TARGETS += udp-${host}_${dir}_${ipv} -run-regress-udp-${host}_${dir}_${ipv}: +TARGETS += udp-${host}_${sec}_${mode}_${ipv} +run-regress-udp-${host}_${sec}_${mode}_${ipv}: @echo '\n======== $@ ========' - netstat -s -p esp | awk '/input ESP /{print $$1}' >esp.in - netstat -s -p esp | awk '/output ESP /{print $$1}' >esp.out - echo $$$$ | nc -n -u -w 1 ${${host}_${dir}_${ipv}} 7 | fgrep $$$$ - netstat -s -p esp | awk '/input ESP /{print $$1-1}' | diff esp.in - - netstat -s -p esp | awk '/output ESP /{print $$1-1}' | diff esp.out - - -TARGETS += tcp-${host}_${dir}_${ipv} -run-regress-tcp-${host}_${dir}_${ipv}: + netstat -s -p ${sec:L} | awk '/input ${sec} /{print $$1}' >pkt.in + netstat -s -p ${sec:L} | awk '/output ${sec} /{print $$1}' >pkt.out + echo $$$$ | nc -n -u -w 1 ${${host}_${sec}_${mode}_${ipv}} 7 |\ + fgrep $$$$ + netstat -s -p ${sec:L} | awk '/input ${sec} /{print $$1-1}' |\ + diff pkt.in - + netstat -s -p ${sec:L} | awk '/output ${sec} /{print $$1-1}' |\ + diff pkt.out - + +TARGETS += tcp-${host}_${sec}_${mode}_${ipv} +run-regress-tcp-${host}_${sec}_${mode}_${ipv}: @echo '\n======== $@ ========' - netstat -s -p esp | awk '/input ESP /{print $$1}' >esp.in - netstat -s -p esp | awk '/output ESP /{print $$1}' >esp.out - echo $$$$ | nc -n -N -w 3 ${${host}_${dir}_${ipv}} 7 | fgrep $$$$ - netstat -s -p esp | awk '/input ESP /{print $$1-4}' | diff esp.in - - netstat -s -p esp | awk '/output ESP /{print $$1-6}' | diff esp.out - + netstat -s -p ${sec:L} | awk '/input ${sec} /{print $$1}' >pkt.in + netstat -s -p ${sec:L} | awk '/output ${sec} /{print $$1}' >pkt.out + echo $$$$ | nc -n -N -w 3 ${${host}_${sec}_${mode}_${ipv}} 7 |\ + fgrep $$$$ + netstat -s -p ${sec:L} | awk '/input ${sec} /{print $$1-4}' |\ + diff pkt.in - + netstat -s -p ${sec:L} | awk '/output ${sec} /{print $$1-6}' |\ + diff pkt.out - .endfor .endfor +.endfor + REGRESS_TARGETS = ${TARGETS:S/^/run-regress-/} ${REGRESS_TARGETS}: stamp-ipsec @@ -207,32 +247,41 @@ etc/hostname.${SRC_OUT_IF}: Makefile mkdir -p ${@:H} rm -f $@ $@.tmp echo '### regress ipsec $@' >$@.tmp -.for dir in OUT TRANSP TUNNEL - echo '# SRC_${dir}' >>$@.tmp + echo '# SRC_OUT' >>$@.tmp +.for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 + echo '${inet} alias ${SRC_OUT_${ipv}} ${masklen}' >>$@.tmp +.endfor +.for sec in ESP AH + echo '## SRC_${sec}' >>$@.tmp +.for mode in TRANSP TUNNEL + echo '# SRC_${sec}_${mode}' >>$@.tmp .for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 - echo '${inet} alias ${SRC_${dir}_${ipv}} ${masklen}' >>$@.tmp + echo '${inet} alias ${SRC_${sec}_${mode}_${ipv}} ${masklen}' >>$@.tmp .endfor .endfor - echo '# IPS_TRANSP_IPV6/64 IPS_IN_IPV6' >>$@.tmp - echo '!route -q delete -inet6 ${IPS_TRANSP_IPV6}/64' >>$@.tmp - echo '!route add -inet6 ${IPS_TRANSP_IPV6}/64 ${IPS_IN_IPV6}' >>$@.tmp + echo '# IPS_${sec}_TRANSP_IPV6/64 IPS_IN_IPV6' >>$@.tmp + echo '!route -q delete -inet6 ${IPS_${sec}_TRANSP_IPV6}/64' >>$@.tmp + echo '!route add -inet6 ${IPS_${sec}_TRANSP_IPV6}/64 ${IPS_IN_IPV6}'\ + >>$@.tmp .for host dir in RT IN ECO IN echo '# ${host}_${dir}/pfxlen IPS_IN' >>$@.tmp .for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 echo '!route -q delete -${inet} ${${host}_${dir}_${ipv}}/${pfxlen}'\ >>$@.tmp - echo '!route add -${inet} ${${host}_${dir}_${ipv}}/${pfxlen}'\ - ${IPS_IN_${ipv}} >>$@.tmp + echo '!route add -${inet} ${${host}_${dir}_${ipv}}/${pfxlen}\ + ${IPS_IN_${ipv}}' >>$@.tmp .endfor .endfor .for host in IPS ECO -.for dir in TUNNEL4 TUNNEL6 - echo '# ${host}_${dir}/pfxlen reject ${SRC_TUNNEL_${ipv}}' >>$@.tmp +.for mode in TUNNEL4 TUNNEL6 + echo '# ${host}_${sec}_${mode}/pfxlen reject\ + ${SRC_${sec}_TUNNEL_${ipv}}' >>$@.tmp .for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 - echo '!route -q delete -${inet} ${${host}_${dir}_${ipv}}/${pfxlen}'\ - >>$@.tmp - echo '!route add -${inet} ${${host}_${dir}_${ipv}}/${pfxlen}'\ - -reject ${SRC_TUNNEL_${ipv}} >>$@.tmp + echo '!route -q delete -${inet}\ + ${${host}_${sec}_${mode}_${ipv}}/${pfxlen}' >>$@.tmp + echo '!route add -${inet} ${${host}_${sec}_${mode}_${ipv}}/${pfxlen}\ + -reject ${SRC_${sec}_TUNNEL_${ipv}}' >>$@.tmp +.endfor .endfor .endfor .endfor @@ -242,22 +291,28 @@ ${IPS_SSH}/hostname.${IPS_IN_IF}: Makefile mkdir -p ${@:H} rm -f $@ $@.tmp echo '### regress ipsec $@' >$@.tmp -.for dir in IN TRANSP - echo '# IPS_${dir}' >>$@.tmp + echo '# IPS_IN' >>$@.tmp .for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 - echo '${inet} alias ${IPS_${dir}_${ipv}} ${masklen}' >>$@.tmp + echo '${inet} alias ${IPS_IN_${ipv}} ${masklen}' >>$@.tmp .endfor +.for sec in ESP AH + echo '## IPS_${sec}' >>$@.tmp + echo '# IPS_${sec}_TRANSP' >>$@.tmp +.for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 + echo '${inet} alias ${IPS_${sec}_TRANSP_${ipv}} ${masklen}' >>$@.tmp .endfor - echo '# SRC_TRANSP_IPV6/64 SRC_OUT_IPV6' >>$@.tmp - echo '!route -q delete -inet6 ${SRC_TRANSP_IPV6}/64' >>$@.tmp - echo '!route add -inet6 ${SRC_TRANSP_IPV6}/64 ${SRC_OUT_IPV6}' >>$@.tmp -.for host dir in SRC TUNNEL - echo '# ${host}_${dir}/pfxlen reject ${IPS_IN_${ipv}}' >>$@.tmp -.for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 - echo '!route -q delete -${inet} ${${host}_${dir}_${ipv}}/${pfxlen}'\ + echo '# SRC_${sec}_TRANSP_IPV6/64 SRC_OUT_IPV6' >>$@.tmp + echo '!route -q delete -inet6 ${SRC_${sec}_TRANSP_IPV6}/64' >>$@.tmp + echo '!route add -inet6 ${SRC_${sec}_TRANSP_IPV6}/64 ${SRC_OUT_IPV6}'\ >>$@.tmp - echo '!route add -${inet} ${${host}_${dir}_${ipv}}/${pfxlen}'\ - -reject ${IPS_IN_${ipv}} >>$@.tmp +.for mode in TUNNEL + echo '# SRC_${sec}_${mode}/pfxlen reject ${IPS_IN_${ipv}}' >>$@.tmp +.for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 + echo '!route -q delete -${inet}\ + ${SRC_${sec}_${mode}_${ipv}}/${pfxlen}' >>$@.tmp + echo '!route add -${inet} ${SRC_${sec}_${mode}_${ipv}}/${pfxlen}\ + -reject ${IPS_IN_${ipv}}' >>$@.tmp +.endfor .endfor .endfor mv $@.tmp $@ @@ -267,19 +322,33 @@ ${IPS_SSH}/hostname.${IPS_OUT_IF}: Makefile mkdir -p ${@:H} rm -f $@ $@.tmp echo '### regress ipsec $@' >$@.tmp -.for dir in OUT TUNNEL4 TUNNEL6 - echo '# IPS_${dir}' >>$@.tmp + echo '# IPS_OUT' >>$@.tmp .for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 - echo '${inet} alias ${IPS_${dir}_${ipv}} ${masklen}' >>$@.tmp -.endfor + echo '${inet} alias ${IPS_OUT_${ipv}} ${masklen}' >>$@.tmp .endfor -.for dir in IN TUNNEL4 TUNNEL6 - echo '# ECO_${dir}/pfxlen RT_IN' >>$@.tmp + echo '# ECO_IN/pfxlen RT_IN' >>$@.tmp .for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 - echo '!route -q delete -${inet} ${ECO_${dir}_${ipv}}/${pfxlen}'\ + echo '!route -q delete -${inet} ${ECO_IN_${ipv}}/${pfxlen}'\ >>$@.tmp - echo '!route add -${inet} ${ECO_${dir}_${ipv}}/${pfxlen}'\ - ${RT_IN_${ipv}} >>$@.tmp + echo '!route add -${inet} ${ECO_IN_${ipv}}/${pfxlen} ${RT_IN_${ipv}}'\ + >>$@.tmp +.endfor +.for sec in ESP AH + echo '## IPS_${sec}' >>$@.tmp +.for mode in TUNNEL4 TUNNEL6 + echo '# IPS_${sec}_${mode}' >>$@.tmp +.for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 + echo '${inet} alias ${IPS_${sec}_${mode}_${ipv}} ${masklen}' >>$@.tmp +.endfor +.endfor +.for mode in TUNNEL4 TUNNEL6 + echo '# ECO_${sec}_${mode}/pfxlen RT_IN' >>$@.tmp +.for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 + echo '!route -q delete -${inet}\ + ${ECO_${sec}_${mode}_${ipv}}/${pfxlen}' >>$@.tmp + echo '!route add -${inet} ${ECO_${sec}_${mode}_${ipv}}/${pfxlen}\ + ${RT_IN_${ipv}}' >>$@.tmp +.endfor .endfor .endfor mv $@.tmp $@ @@ -293,14 +362,24 @@ ${RT_SSH}/hostname.${RT_IN_IF}: Makefile .for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 echo '${inet} alias ${RT_IN_${ipv}} ${masklen}' >>$@.tmp .endfor -.for dir in OUT TUNNEL - echo '# SRC_${dir}/pfxlen IPS_OUT' >>$@.tmp + echo '# SRC_OUT/pfxlen IPS_OUT' >>$@.tmp .for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 - echo '!route -q delete -${inet} ${SRC_${dir}_${ipv}}/${pfxlen}'\ + echo '!route -q delete -${inet} ${SRC_OUT_${ipv}}/${pfxlen}'\ >>$@.tmp - echo '!route add -${inet} ${SRC_${dir}_${ipv}}/${pfxlen}'\ + echo '!route add -${inet} ${SRC_OUT_${ipv}}/${pfxlen}'\ ${IPS_OUT_${ipv}} >>$@.tmp .endfor +.for sec in ESP AH + echo '## IPS_${sec}' >>$@.tmp +.for mode in TUNNEL + echo '# SRC_${mode}/pfxlen IPS_OUT' >>$@.tmp +.for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 + echo '!route -q delete -${inet} ${SRC_${sec}_${mode}_${ipv}}/${pfxlen}'\ + >>$@.tmp + echo '!route add -${inet} ${SRC_${sec}_${mode}_${ipv}}/${pfxlen}\ + ${IPS_OUT_${ipv}}' >>$@.tmp +.endfor +.endfor .endfor mv $@.tmp $@ @@ -313,13 +392,16 @@ ${RT_SSH}/hostname.${RT_OUT_IF}: Makefile .for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 echo '${inet} alias ${RT_OUT_${ipv}} ${masklen}' >>$@.tmp .endfor -.for dir in TUNNEL4 TUNNEL6 - echo '# ECO_${dir}/pfxlen ECO_IN' >>$@.tmp +.for sec in ESP AH + echo '## IPS_${sec}' >>$@.tmp +.for mode in TUNNEL4 TUNNEL6 + echo '# ECO_${sec}_${mode}/pfxlen ECO_IN' >>$@.tmp .for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 - echo '!route -q delete -${inet} ${ECO_${dir}_${ipv}}/${pfxlen}'\ - >>$@.tmp - echo '!route add -${inet} ${ECO_${dir}_${ipv}}/${pfxlen}'\ - ${ECO_IN_${ipv}} >>$@.tmp + echo '!route -q delete -${inet}\ + ${ECO_${sec}_${mode}_${ipv}}/${pfxlen}' >>$@.tmp + echo '!route add -${inet} ${ECO_${sec}_${mode}_${ipv}}/${pfxlen}\ + ${ECO_IN_${ipv}}' >>$@.tmp +.endfor .endfor .endfor mv $@.tmp $@ @@ -329,26 +411,35 @@ ${ECO_SSH}/hostname.${ECO_IN_IF}: Makefile mkdir -p ${@:H} rm -f $@ $@.tmp echo '### regress ipsec $@' >$@.tmp -.for dir in IN TUNNEL4 TUNNEL6 - echo '# ECO_${dir}' >>$@.tmp + echo '# ECO_IN' >>$@.tmp .for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 - echo '${inet} alias ${ECO_${dir}_${ipv}} ${masklen}' >>$@.tmp + echo '${inet} alias ${ECO_IN_${ipv}} ${masklen}' >>$@.tmp .endfor -.endfor - echo '# IPS_OUT/pfxlen RT_OUT' >>$@.tmp +.for host in IPS SRC + echo '# ${host}_OUT/pfxlen RT_OUT' >>$@.tmp .for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 - echo '!route -q delete -${inet} ${IPS_OUT_${ipv}}/${pfxlen}'\ + echo '!route -q delete -${inet} ${${host}_OUT_${ipv}}/${pfxlen}'\ >>$@.tmp - echo '!route add -${inet} ${IPS_OUT_${ipv}}/${pfxlen}'\ - ${RT_OUT_${ipv}} >>$@.tmp + echo '!route add -${inet} ${${host}_OUT_${ipv}}/${pfxlen}\ + ${RT_OUT_${ipv}}' >>$@.tmp +.endfor +.endfor +.for sec in ESP AH + echo '## IPS_${sec}' >>$@.tmp +.for mode in TUNNEL4 TUNNEL6 + echo '# ECO_${sec}_${mode}' >>$@.tmp +.for inet ipv masklen in inet IPV4 255.255.255.0 inet6 IPV6 64 + echo '${inet} alias ${ECO_${sec}_${mode}_${ipv}} ${masklen}' >>$@.tmp .endfor -.for dir in OUT TUNNEL - echo '# SRC_${dir}/pfxlen RT_OUT' >>$@.tmp +.endfor +.for mode in TUNNEL + echo '# SRC_${sec}_${mode}/pfxlen RT_OUT' >>$@.tmp .for inet ipv pfxlen in inet IPV4 24 inet6 IPV6 64 - echo '!route -q delete -${inet} ${SRC_${dir}_${ipv}}/${pfxlen}'\ - >>$@.tmp - echo '!route add -${inet} ${SRC_${dir}_${ipv}}/${pfxlen}'\ - ${RT_OUT_${ipv}} >>$@.tmp + echo '!route -q delete -${inet}\ + ${SRC_${sec}_${mode}_${ipv}}/${pfxlen}' >>$@.tmp + echo '!route add -${inet} ${SRC_${sec}_${mode}_${ipv}}/${pfxlen}\ + ${RT_OUT_${ipv}}' >>$@.tmp +.endfor .endfor .endfor mv $@.tmp $@ @@ -384,7 +475,7 @@ check-setup: check-setup-src check-setup-ips check-setup-rt check-setup-eco check-setup-src: @echo '\n======== $@ ========' .for ping inet ipv in ping inet IPV4 ping6 inet6 IPV6 -.for host dir in SRC OUT SRC TRANSP SRC TUNNEL +.for host dir in SRC OUT ${ping} -n -c 1 ${${host}_${dir}_${ipv}} # ${host}_${dir}_${ipv} route -n get -${inet} ${${host}_${dir}_${ipv}} |\ grep -q 'flags: .*LOCAL' # ${host}_${dir}_${ipv} @@ -395,21 +486,31 @@ check-setup-src: fgrep -q 'gateway: ${IPS_IN_${ipv}}' \ # ${host}_${dir}_${ipv} IPS_IN_${ipv} .endfor -.for host dir in IPS TUNNEL4 IPS TUNNEL6 ECO TUNNEL4 ECO TUNNEL6 - route -n get -${inet} ${${host}_${dir}_${ipv}} |\ - grep -q 'flags: .*REJECT' # ${host}_${dir}_${ipv} +.for sec in ESP AH +.for host mode in SRC TRANSP SRC TUNNEL + ${ping} -n -c 1 ${${host}_${sec}_${mode}_${ipv}} \ + # ${host}_${sec}_${mode}_${ipv} + route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ + grep -q 'flags: .*LOCAL' # ${host}_${sec}_${mode}_${ipv} .endfor +.for host mode in IPS TUNNEL4 IPS TUNNEL6 ECO TUNNEL4 ECO TUNNEL6 + route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ + grep -q 'flags: .*REJECT' # ${host}_${sec}_${mode}_${ipv} .endfor - route -n get -inet ${IPS_TRANSP_IPV4} |\ - egrep -q 'flags: .*(CLONING|CLONED)' # IPS_TRANSP_IPV4 - route -n get -inet6 ${IPS_TRANSP_IPV6} |\ +.endfor +.endfor +.for sec in ESP AH + route -n get -inet ${IPS_${sec}_TRANSP_IPV4} |\ + egrep -q 'flags: .*(CLONING|CLONED)' # IPS_${sec}_TRANSP_IPV4 + route -n get -inet6 ${IPS_${sec}_TRANSP_IPV6} |\ fgrep -q 'gateway: ${IPS_IN_IPV6}' \ - # IPS_TRANSP_IPV6 IPS_IN_IPV6 + # IPS_${sec}_TRANSP_IPV6 IPS_IN_IPV6 +.endfor check-setup-ips: @echo '\n======== $@ ========' .for ping inet ipv in ping inet IPV4 ping6 inet6 IPV6 -.for host dir in IPS IN IPS OUT IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 +.for host dir in IPS IN IPS OUT ssh ${IPS_SSH} ${ping} -n -c 1 ${${host}_${dir}_${ipv}} \ # ${host}_${dir}_${ipv} ssh ${IPS_SSH} route -n get -${inet} ${${host}_${dir}_${ipv}} |\ @@ -417,26 +518,42 @@ check-setup-ips: .endfor ssh ${IPS_SSH} ${ping} -n -c 1 ${SRC_OUT_${ipv}} # SRC_OUT_${ipv} ssh ${IPS_SSH} ${ping} -n -c 1 ${RT_IN_${ipv}} # RT_IN_${ipv} -.for host dir in RT OUT ECO IN ECO TUNNEL4 ECO TUNNEL6 +.for host dir in RT OUT ECO IN ssh ${IPS_SSH} route -n get -${inet} ${${host}_${dir}_${ipv}} |\ fgrep -q 'gateway: ${RT_IN_${ipv}}' \ # ${host}_${dir}_${ipv} RT_IN_${ipv} .endfor -.for host dir in SRC TUNNEL - ssh ${IPS_SSH} route -n get -${inet} ${${host}_${dir}_${ipv}} |\ - grep -q 'flags: .*REJECT' # ${host}_${dir}_${ipv} +.for sec in ESP AH +.for host mode in IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 + ssh ${IPS_SSH} ${ping} -n -c 1 ${${host}_${sec}_${mode}_${ipv}} \ + # ${host}_${sec}_${mode}_${ipv} + ssh ${IPS_SSH} route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ + grep -q 'flags: .*LOCAL' # ${host}_${sec}_${mode}_${ipv} .endfor -.for host dir in IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 +.for host mode in ECO TUNNEL4 ECO TUNNEL6 + ssh ${IPS_SSH} route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ + fgrep -q 'gateway: ${RT_IN_${ipv}}' \ + # ${host}_${sec}_${mode}_${ipv} RT_IN_${ipv} +.endfor +.for host mode in SRC TUNNEL + ssh ${IPS_SSH} route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ + grep -q 'flags: .*REJECT' # ${host}_${sec}_${mode}_${ipv} +.endfor +.for host mode in IPS TRANSP IPS TUNNEL4 IPS TUNNEL6 ssh ${IPS_SSH} netstat -nav -f ${inet} -p udp |\ - fgrep ' ${${host}_${dir}_${ipv}}.7 ' # ${host}_${dir}_${ipv} + fgrep ' ${${host}_${sec}_${mode}_${ipv}}.7 ' \ + # ${host}_${sec}_${mode}_${ipv} +.endfor .endfor ssh ${ECO_SSH} netstat -na -f ${inet} -p tcp | fgrep ' *.7 ' .endfor - ssh ${IPS_SSH} route -n get -inet ${SRC_TRANSP_IPV4} |\ - egrep -q 'flags: .*(CLONING|CLONED)' # SRC_TRANSP_IPV4 - ssh ${IPS_SSH} route -n get -inet6 ${SRC_TRANSP_IPV6} |\ +.for sec in ESP AH + ssh ${IPS_SSH} route -n get -inet ${SRC_${sec}_TRANSP_IPV4} |\ + egrep -q 'flags: .*(CLONING|CLONED)' # SRC_${sec}_TRANSP_IPV4 + ssh ${IPS_SSH} route -n get -inet6 ${SRC_${sec}_TRANSP_IPV6} |\ fgrep -q 'gateway: ${SRC_OUT_IPV6}' \ - # SRC_TRANSP_IPV6 SRC_OUT_IPV6 + # SRC_${sec}_TRANSP_IPV6 SRC_OUT_IPV6 +.endfor check-setup-rt: @echo '\n======== $@ ========' @@ -448,37 +565,58 @@ check-setup-rt: grep -q 'flags: .*LOCAL' # ${host}_${dir}_${ipv} .endfor ssh ${RT_SSH} ${ping} -n -c 1 ${IPS_OUT_${ipv}} # IPS_OUT_${ipv} -.for host dir in IPS IN SRC OUT SRC TUNNEL +.for host dir in IPS IN SRC OUT ssh ${RT_SSH} route -n get -${inet} ${${host}_${dir}_${ipv}} |\ fgrep -q 'gateway: ${IPS_OUT_${ipv}}' \ # ${host}_${dir}_${ipv} IPS_OUT_${ipv} .endfor ssh ${RT_SSH} ${ping} -n -c 1 ${ECO_IN_${ipv}} # ECO_IN_${ipv} -.for host dir in ECO TUNNEL4 ECO TUNNEL6 - ssh ${RT_SSH} route -n get -${inet} ${${host}_${dir}_${ipv}} |\ +.for sec in ESP AH +.for host mode in SRC TUNNEL + ssh ${RT_SSH} route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ + fgrep -q 'gateway: ${IPS_OUT_${ipv}}' \ + # ${host}_${sec}_${mode}_${ipv} IPS_OUT_${ipv} +.endfor +.for host mode in ECO TUNNEL4 ECO TUNNEL6 + ssh ${RT_SSH} route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ fgrep -q 'gateway: ${ECO_IN_${ipv}}' \ - # ${host}_${dir}_${ipv} ECO_IN_${ipv} + # ${host}_${sec}_${mode}_${ipv} ECO_IN_${ipv} +.endfor .endfor .endfor check-setup-eco: @echo '\n======== $@ ========' .for ping inet ipv in ping inet IPV4 ping6 inet6 IPV6 -.for host dir in ECO IN ECO TUNNEL4 ECO TUNNEL6 +.for host dir in ECO IN ssh ${ECO_SSH} ${ping} -n -c 1 ${${host}_${dir}_${ipv}} \ # ${host}_${dir}_${ipv} ssh ${ECO_SSH} route -n get -${inet} ${${host}_${dir}_${ipv}} |\ grep -q 'flags: .*LOCAL' # ${host}_${dir}_${ipv} .endfor ssh ${ECO_SSH} ${ping} -n -c 1 ${RT_OUT_${ipv}} # RT_OUT_${ipv} -.for host dir in RT IN IPS OUT IPS IN SRC OUT SRC TUNNEL +.for host dir in RT IN IPS OUT IPS IN SRC OUT ssh ${ECO_SSH} route -n get -${inet} ${${host}_${dir}_${ipv}} |\ fgrep -q 'gateway: ${RT_OUT_${ipv}}' \ # ${host}_${dir}_${ipv} RT_OUT_${ipv} .endfor -.for host dir in ECO TUNNEL4 ECO TUNNEL6 +.for sec in ESP AH +.for host mode in ECO TUNNEL4 ECO TUNNEL6 + ssh ${ECO_SSH} ${ping} -n -c 1 ${${host}_${sec}_${mode}_${ipv}} \ + # ${host}_${sec}_${mode}_${ipv} + ssh ${ECO_SSH} route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ + grep -q 'flags: .*LOCAL' # ${host}_${sec}_${mode}_${ipv} +.endfor +.for host mode in SRC TUNNEL + ssh ${ECO_SSH} route -n get -${inet} ${${host}_${sec}_${mode}_${ipv}} |\ + fgrep -q 'gateway: ${RT_OUT_${ipv}}' \ + # ${host}_${sec}_${mode}_${ipv} RT_OUT_${ipv} +.endfor +.for host mode in ECO TUNNEL4 ECO TUNNEL6 ssh ${ECO_SSH} netstat -nav -f ${inet} -p udp |\ - fgrep ' ${${host}_${dir}_${ipv}}.7 ' # ${host}_${dir}_${ipv} + fgrep ' ${${host}_${sec}_${mode}_${ipv}}.7 ' \ + # ${host}_${sec}_${mode}_${ipv} +.endfor .endfor ssh ${ECO_SSH} netstat -na -f ${inet} -p tcp | fgrep ' *.7 ' .endfor |