1## 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2022 Rubicon Communications, LLC ("Netgate") 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26 27. $(atf_get_srcdir)/utils.subr 28. $(atf_get_srcdir)/../../netpfil/pf/utils.subr 29 30atf_test_case "4in4" "cleanup" 314in4_head() 32{ 33 atf_set descr 'IPv4 in IPv4 tunnel' 34 atf_set require.user root 35 atf_set require.progs openvpn 36} 37 384in4_body() 39{ 40 ovpn_init 41 42 l=$(vnet_mkepair) 43 44 vnet_mkjail a ${l}a 45 jexec a ifconfig ${l}a 192.0.2.1/24 up 46 vnet_mkjail b ${l}b 47 jexec b ifconfig ${l}b 192.0.2.2/24 up 48 49 # Sanity check 50 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2 51 52 ovpn_start a " 53 dev ovpn0 54 dev-type tun 55 proto udp4 56 57 cipher AES-256-GCM 58 auth SHA256 59 60 local 192.0.2.1 61 server 198.51.100.0 255.255.255.0 62 ca $(atf_get_srcdir)/ca.crt 63 cert $(atf_get_srcdir)/server.crt 64 key $(atf_get_srcdir)/server.key 65 dh $(atf_get_srcdir)/dh.pem 66 67 mode server 68 script-security 2 69 auth-user-pass-verify /usr/bin/true via-env 70 topology subnet 71 72 keepalive 100 600 73 " 74 ovpn_start b " 75 dev tun0 76 dev-type tun 77 78 client 79 80 remote 192.0.2.1 81 auth-user-pass $(atf_get_srcdir)/user.pass 82 83 ca $(atf_get_srcdir)/ca.crt 84 cert $(atf_get_srcdir)/client.crt 85 key $(atf_get_srcdir)/client.key 86 dh $(atf_get_srcdir)/dh.pem 87 88 keepalive 100 600 89 " 90 91 # Give the tunnel time to come up 92 sleep 10 93 94 atf_check -s exit:0 -o ignore jexec b ping -c 1 198.51.100.1 95 96 echo 'foo' | jexec b nc -u -w 2 192.0.2.1 1194 97 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1 98 99 # Test routing loop protection 100 jexec b route add 192.0.2.1 198.51.100.1 101 atf_check -s exit:2 -o ignore jexec b ping -t 1 -c 1 198.51.100.1 102} 103 1044in4_cleanup() 105{ 106 ovpn_cleanup 107} 108 109atf_test_case "4mapped" "cleanup" 1104mapped_head() 111{ 112 atf_set descr 'IPv4 mapped addresses' 113 atf_set require.user root 114 atf_set require.progs openvpn 115} 116 1174mapped_body() 118{ 119 ovpn_init 120 121 l=$(vnet_mkepair) 122 123 vnet_mkjail a ${l}a 124 jexec a ifconfig ${l}a 192.0.2.1/24 up 125 vnet_mkjail b ${l}b 126 jexec b ifconfig ${l}b 192.0.2.2/24 up 127 128 # Sanity check 129 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2 130 131 #jexec a ifconfig ${l}a 132 133 ovpn_start a " 134 dev ovpn0 135 dev-type tun 136 137 cipher AES-256-GCM 138 auth SHA256 139 140 server 198.51.100.0 255.255.255.0 141 ca $(atf_get_srcdir)/ca.crt 142 cert $(atf_get_srcdir)/server.crt 143 key $(atf_get_srcdir)/server.key 144 dh $(atf_get_srcdir)/dh.pem 145 146 mode server 147 script-security 2 148 auth-user-pass-verify /usr/bin/true via-env 149 topology subnet 150 151 keepalive 100 600 152 " 153 ovpn_start b " 154 dev tun0 155 dev-type tun 156 157 client 158 159 remote 192.0.2.1 160 auth-user-pass $(atf_get_srcdir)/user.pass 161 162 ca $(atf_get_srcdir)/ca.crt 163 cert $(atf_get_srcdir)/client.crt 164 key $(atf_get_srcdir)/client.key 165 dh $(atf_get_srcdir)/dh.pem 166 167 keepalive 100 600 168 " 169 170 # Give the tunnel time to come up 171 sleep 10 172 173 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1 174} 175 1764mapped_cleanup() 177{ 178 ovpn_cleanup 179} 180 181atf_test_case "6in4" "cleanup" 1826in4_head() 183{ 184 atf_set descr 'IPv6 in IPv4 tunnel' 185 atf_set require.user root 186 atf_set require.progs openvpn 187} 188 1896in4_body() 190{ 191 ovpn_init 192 193 l=$(vnet_mkepair) 194 195 vnet_mkjail a ${l}a 196 jexec a ifconfig ${l}a 192.0.2.1/24 up 197 vnet_mkjail b ${l}b 198 jexec b ifconfig ${l}b 192.0.2.2/24 up 199 200 # Sanity check 201 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2 202 203 ovpn_start a " 204 dev ovpn0 205 dev-type tun 206 proto udp 207 208 cipher AES-256-GCM 209 auth SHA256 210 211 local 192.0.2.1 212 server-ipv6 2001:db8:1::/64 213 214 ca $(atf_get_srcdir)/ca.crt 215 cert $(atf_get_srcdir)/server.crt 216 key $(atf_get_srcdir)/server.key 217 dh $(atf_get_srcdir)/dh.pem 218 219 mode server 220 script-security 2 221 auth-user-pass-verify /usr/bin/true via-env 222 topology subnet 223 224 keepalive 100 600 225 " 226 ovpn_start b " 227 dev tun0 228 dev-type tun 229 230 client 231 232 remote 192.0.2.1 233 auth-user-pass $(atf_get_srcdir)/user.pass 234 235 ca $(atf_get_srcdir)/ca.crt 236 cert $(atf_get_srcdir)/client.crt 237 key $(atf_get_srcdir)/client.key 238 dh $(atf_get_srcdir)/dh.pem 239 240 keepalive 100 600 241 " 242 243 # Give the tunnel time to come up 244 sleep 10 245 246 atf_check -s exit:0 -o ignore jexec b ping6 -c 3 2001:db8:1::1 247} 248 2496in4_cleanup() 250{ 251 ovpn_cleanup 252} 253 254atf_test_case "4in6" "cleanup" 2554in6_head() 256{ 257 atf_set descr 'IPv4 in IPv6 tunnel' 258 atf_set require.user root 259 atf_set require.progs openvpn 260} 261 2624in6_body() 263{ 264 ovpn_init 265 266 l=$(vnet_mkepair) 267 268 vnet_mkjail a ${l}a 269 jexec a ifconfig ${l}a inet6 2001:db8::1/64 up no_dad 270 vnet_mkjail b ${l}b 271 jexec b ifconfig ${l}b inet6 2001:db8::2/64 up no_dad 272 273 # Sanity check 274 atf_check -s exit:0 -o ignore jexec a ping6 -c 1 2001:db8::2 275 276 ovpn_start a " 277 dev ovpn0 278 dev-type tun 279 proto udp6 280 281 cipher AES-256-GCM 282 auth SHA256 283 284 local 2001:db8::1 285 server 198.51.100.0 255.255.255.0 286 ca $(atf_get_srcdir)/ca.crt 287 cert $(atf_get_srcdir)/server.crt 288 key $(atf_get_srcdir)/server.key 289 dh $(atf_get_srcdir)/dh.pem 290 291 mode server 292 script-security 2 293 auth-user-pass-verify /usr/bin/true via-env 294 topology subnet 295 296 keepalive 100 600 297 " 298 ovpn_start b " 299 dev tun0 300 dev-type tun 301 302 client 303 304 remote 2001:db8::1 305 auth-user-pass $(atf_get_srcdir)/user.pass 306 307 ca $(atf_get_srcdir)/ca.crt 308 cert $(atf_get_srcdir)/client.crt 309 key $(atf_get_srcdir)/client.key 310 dh $(atf_get_srcdir)/dh.pem 311 312 keepalive 100 600 313 " 314 315 # Give the tunnel time to come up 316 sleep 10 317 318 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1 319} 320 3214in6_cleanup() 322{ 323 ovpn_cleanup 324} 325 326atf_test_case "6in6" "cleanup" 3276in6_head() 328{ 329 atf_set descr 'IPv6 in IPv6 tunnel' 330 atf_set require.user root 331 atf_set require.progs openvpn 332} 333 3346in6_body() 335{ 336 ovpn_init 337 338 l=$(vnet_mkepair) 339 340 vnet_mkjail a ${l}a 341 jexec a ifconfig ${l}a inet6 2001:db8::1/64 up no_dad 342 vnet_mkjail b ${l}b 343 jexec b ifconfig ${l}b inet6 2001:db8::2/64 up no_dad 344 345 # Sanity check 346 atf_check -s exit:0 -o ignore jexec a ping6 -c 1 2001:db8::2 347 348 ovpn_start a " 349 dev ovpn0 350 dev-type tun 351 proto udp6 352 353 cipher AES-256-GCM 354 auth SHA256 355 356 local 2001:db8::1 357 server-ipv6 2001:db8:1::/64 358 359 ca $(atf_get_srcdir)/ca.crt 360 cert $(atf_get_srcdir)/server.crt 361 key $(atf_get_srcdir)/server.key 362 dh $(atf_get_srcdir)/dh.pem 363 364 mode server 365 script-security 2 366 auth-user-pass-verify /usr/bin/true via-env 367 topology subnet 368 369 keepalive 100 600 370 " 371 ovpn_start b " 372 dev tun0 373 dev-type tun 374 375 client 376 377 remote 2001:db8::1 378 auth-user-pass $(atf_get_srcdir)/user.pass 379 380 ca $(atf_get_srcdir)/ca.crt 381 cert $(atf_get_srcdir)/client.crt 382 key $(atf_get_srcdir)/client.key 383 dh $(atf_get_srcdir)/dh.pem 384 385 keepalive 100 600 386 " 387 388 # Give the tunnel time to come up 389 sleep 10 390 391 atf_check -s exit:0 -o ignore jexec b ping6 -c 3 2001:db8:1::1 392 atf_check -s exit:0 -o ignore jexec b ping6 -c 3 -z 16 2001:db8:1::1 393 394 # Test routing loop protection 395 jexec b route add -6 2001:db8::1 2001:db8:1::1 396 atf_check -s exit:2 -o ignore jexec b ping6 -t 1 -c 3 2001:db8:1::1 397} 398 3996in6_cleanup() 400{ 401 ovpn_cleanup 402} 403 404atf_test_case "timeout_client" "cleanup" 405timeout_client_head() 406{ 407 atf_set descr 'IPv4 in IPv4 tunnel' 408 atf_set require.user root 409 atf_set require.progs openvpn 410} 411 412timeout_client_body() 413{ 414 ovpn_init 415 416 l=$(vnet_mkepair) 417 418 vnet_mkjail a ${l}a 419 jexec a ifconfig ${l}a 192.0.2.1/24 up 420 jexec a ifconfig lo0 127.0.0.1/8 up 421 vnet_mkjail b ${l}b 422 jexec b ifconfig ${l}b 192.0.2.2/24 up 423 424 # Sanity check 425 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2 426 427 ovpn_start a " 428 dev ovpn0 429 dev-type tun 430 proto udp4 431 432 cipher AES-256-GCM 433 auth SHA256 434 435 local 192.0.2.1 436 server 198.51.100.0 255.255.255.0 437 ca $(atf_get_srcdir)/ca.crt 438 cert $(atf_get_srcdir)/server.crt 439 key $(atf_get_srcdir)/server.key 440 dh $(atf_get_srcdir)/dh.pem 441 442 mode server 443 script-security 2 444 auth-user-pass-verify /usr/bin/true via-env 445 topology subnet 446 447 keepalive 2 10 448 449 management 192.0.2.1 1234 450 " 451 ovpn_start b " 452 dev tun0 453 dev-type tun 454 455 client 456 457 remote 192.0.2.1 458 auth-user-pass $(atf_get_srcdir)/user.pass 459 460 ca $(atf_get_srcdir)/ca.crt 461 cert $(atf_get_srcdir)/client.crt 462 key $(atf_get_srcdir)/client.key 463 dh $(atf_get_srcdir)/dh.pem 464 465 keepalive 2 10 466 " 467 468 # Give the tunnel time to come up 469 sleep 10 470 471 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1 472 473 # Kill the client 474 jexec b killall openvpn 475 476 # Now wait for the server to notice 477 sleep 15 478 479 while echo "status" | jexec a nc -N 192.0.2.1 1234 | grep 192.0.2.2; do 480 echo "Client disconnect not discovered" 481 sleep 1 482 done 483} 484 485timeout_client_cleanup() 486{ 487 ovpn_cleanup 488} 489 490atf_test_case "explicit_exit" "cleanup" 491explicit_exit_head() 492{ 493 atf_set descr 'Test explicit exit notification' 494 atf_set require.user root 495 atf_set require.progs openvpn 496} 497 498explicit_exit_body() 499{ 500 ovpn_init 501 502 l=$(vnet_mkepair) 503 504 vnet_mkjail a ${l}a 505 jexec a ifconfig ${l}a 192.0.2.1/24 up 506 jexec a ifconfig lo0 127.0.0.1/8 up 507 vnet_mkjail b ${l}b 508 jexec b ifconfig ${l}b 192.0.2.2/24 up 509 510 # Sanity check 511 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2 512 513 ovpn_start a " 514 dev ovpn0 515 dev-type tun 516 proto udp4 517 518 cipher AES-256-GCM 519 auth SHA256 520 521 local 192.0.2.1 522 server 198.51.100.0 255.255.255.0 523 ca $(atf_get_srcdir)/ca.crt 524 cert $(atf_get_srcdir)/server.crt 525 key $(atf_get_srcdir)/server.key 526 dh $(atf_get_srcdir)/dh.pem 527 528 mode server 529 script-security 2 530 auth-user-pass-verify /usr/bin/true via-env 531 topology subnet 532 533 management 192.0.2.1 1234 534 " 535 ovpn_start b " 536 dev tun0 537 dev-type tun 538 539 client 540 541 remote 192.0.2.1 542 auth-user-pass $(atf_get_srcdir)/user.pass 543 544 ca $(atf_get_srcdir)/ca.crt 545 cert $(atf_get_srcdir)/client.crt 546 key $(atf_get_srcdir)/client.key 547 dh $(atf_get_srcdir)/dh.pem 548 549 explicit-exit-notify 550 " 551 552 # Give the tunnel time to come up 553 sleep 10 554 555 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1 556 557 if ! echo "status" | jexec a nc -N 192.0.2.1 1234 | grep 192.0.2.2; then 558 atf_fail "Client not found in status list!" 559 fi 560 561 # Kill the client 562 jexec b killall openvpn 563 564 while echo "status" | jexec a nc -N 192.0.2.1 1234 | grep 192.0.2.2; do 565 jexec a ps auxf 566 echo "Client disconnect not discovered" 567 sleep 1 568 done 569} 570 571explicit_exit_cleanup() 572{ 573 ovpn_cleanup 574} 575 576atf_test_case "multi_client" "cleanup" 577multi_client_head() 578{ 579 atf_set descr 'Multiple simultaneous clients' 580 atf_set require.user root 581 atf_set require.progs openvpn 582} 583 584multi_client_body() 585{ 586 ovpn_init 587 vnet_init_bridge 588 589 bridge=$(vnet_mkbridge) 590 srv=$(vnet_mkepair) 591 one=$(vnet_mkepair) 592 two=$(vnet_mkepair) 593 594 ifconfig ${bridge} up 595 596 ifconfig ${srv}a up 597 ifconfig ${bridge} addm ${srv}a 598 ifconfig ${one}a up 599 ifconfig ${bridge} addm ${one}a 600 ifconfig ${two}a up 601 ifconfig ${bridge} addm ${two}a 602 603 vnet_mkjail srv ${srv}b 604 jexec srv ifconfig ${srv}b 192.0.2.1/24 up 605 vnet_mkjail one ${one}b 606 jexec one ifconfig ${one}b 192.0.2.2/24 up 607 vnet_mkjail two ${two}b 608 jexec two ifconfig ${two}b 192.0.2.3/24 up 609 jexec two ifconfig lo0 127.0.0.1/8 up 610 jexec two ifconfig lo0 inet alias 203.0.113.1/24 611 612 # Sanity checks 613 atf_check -s exit:0 -o ignore jexec one ping -c 1 192.0.2.1 614 atf_check -s exit:0 -o ignore jexec two ping -c 1 192.0.2.1 615 616 jexec srv sysctl net.inet.ip.forwarding=1 617 618 ovpn_start srv " 619 dev ovpn0 620 dev-type tun 621 proto udp4 622 623 cipher AES-256-GCM 624 auth SHA256 625 626 local 192.0.2.1 627 server 198.51.100.0 255.255.255.0 628 629 push \"route 203.0.113.0 255.255.255.0 198.51.100.1\" 630 631 ca $(atf_get_srcdir)/ca.crt 632 cert $(atf_get_srcdir)/server.crt 633 key $(atf_get_srcdir)/server.key 634 dh $(atf_get_srcdir)/dh.pem 635 636 mode server 637 duplicate-cn 638 script-security 2 639 auth-user-pass-verify /usr/bin/true via-env 640 topology subnet 641 642 keepalive 100 600 643 644 client-config-dir $(atf_get_srcdir)/ccd 645 " 646 ovpn_start one " 647 dev tun0 648 dev-type tun 649 650 client 651 652 remote 192.0.2.1 653 auth-user-pass $(atf_get_srcdir)/user.pass 654 655 ca $(atf_get_srcdir)/ca.crt 656 cert $(atf_get_srcdir)/client.crt 657 key $(atf_get_srcdir)/client.key 658 dh $(atf_get_srcdir)/dh.pem 659 660 keepalive 100 600 661 " 662 ovpn_start two " 663 dev tun0 664 dev-type tun 665 666 client 667 668 remote 192.0.2.1 669 auth-user-pass $(atf_get_srcdir)/user.pass 670 671 ca $(atf_get_srcdir)/ca.crt 672 cert $(atf_get_srcdir)/client2.crt 673 key $(atf_get_srcdir)/client2.key 674 dh $(atf_get_srcdir)/dh.pem 675 676 keepalive 100 600 677 " 678 679 # Give the tunnel time to come up 680 sleep 10 681 682 atf_check -s exit:0 -o ignore jexec one ping -c 3 198.51.100.1 683 atf_check -s exit:0 -o ignore jexec two ping -c 3 198.51.100.1 684 685 # Client-to-client communication 686 atf_check -s exit:0 -o ignore jexec one ping -c 3 198.51.100.3 687 atf_check -s exit:0 -o ignore jexec two ping -c 3 198.51.100.2 688 689 # iroute test 690 atf_check -s exit:0 -o ignore jexec one ping -c 3 203.0.113.1 691} 692 693multi_client_cleanup() 694{ 695 ovpn_cleanup 696} 697 698atf_test_case "route_to" "cleanup" 699route_to_head() 700{ 701 atf_set descr "Test pf's route-to with OpenVPN tunnels" 702 atf_set require.user root 703 atf_set require.progs openvpn 704} 705 706route_to_body() 707{ 708 pft_init 709 ovpn_init 710 711 l=$(vnet_mkepair) 712 n=$(vnet_mkepair) 713 714 vnet_mkjail a ${l}a 715 jexec a ifconfig ${l}a 192.0.2.1/24 up 716 vnet_mkjail b ${l}b ${n}a 717 jexec b ifconfig ${l}b 192.0.2.2/24 up 718 jexec b ifconfig ${n}a up 719 720 # Sanity check 721 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2 722 723 ovpn_start a " 724 dev ovpn0 725 dev-type tun 726 proto udp4 727 728 cipher AES-256-GCM 729 auth SHA256 730 731 local 192.0.2.1 732 server 198.51.100.0 255.255.255.0 733 ca $(atf_get_srcdir)/ca.crt 734 cert $(atf_get_srcdir)/server.crt 735 key $(atf_get_srcdir)/server.key 736 dh $(atf_get_srcdir)/dh.pem 737 738 mode server 739 script-security 2 740 auth-user-pass-verify /usr/bin/true via-env 741 topology subnet 742 743 keepalive 100 600 744 " 745 ovpn_start b " 746 dev tun0 747 dev-type tun 748 749 client 750 751 remote 192.0.2.1 752 auth-user-pass $(atf_get_srcdir)/user.pass 753 754 ca $(atf_get_srcdir)/ca.crt 755 cert $(atf_get_srcdir)/client.crt 756 key $(atf_get_srcdir)/client.key 757 dh $(atf_get_srcdir)/dh.pem 758 759 keepalive 100 600 760 " 761 762 # Give the tunnel time to come up 763 sleep 10 764 jexec a ifconfig ovpn0 inet alias 198.51.100.254/24 765 766 # Check the tunnel 767 atf_check -s exit:0 -o ignore jexec b ping -c 1 -S 198.51.100.2 198.51.100.1 768 atf_check -s exit:0 -o ignore jexec b ping -c 1 -S 198.51.100.2 198.51.100.254 769 770 # Break our route to .254 so that we need a route-to to make things work. 771 jexec b ifconfig ${n}a 203.0.113.1/24 up 772 jexec b route add 198.51.100.254 -interface ${n}a 773 774 # Make sure it's broken. 775 atf_check -s exit:2 -o ignore jexec b ping -c 1 -S 198.51.100.2 198.51.100.254 776 777 jexec b pfctl -e 778 pft_set_rules b \ 779 "pass out route-to (tun0 198.51.100.1) proto icmp from 198.51.100.2 " 780 atf_check -s exit:0 -o ignore jexec b ping -c 3 -S 198.51.100.2 198.51.100.254 781} 782 783route_to_cleanup() 784{ 785 ovpn_cleanup 786 pft_cleanup 787} 788 789atf_test_case "ra" "cleanup" 790ra_head() 791{ 792 atf_set descr 'Remote access with multiple clients' 793 atf_set require.user root 794 atf_set require.progs openvpn 795} 796 797ra_body() 798{ 799 ovpn_init 800 vnet_init_bridge 801 802 bridge=$(vnet_mkbridge) 803 srv=$(vnet_mkepair) 804 lan=$(vnet_mkepair) 805 one=$(vnet_mkepair) 806 two=$(vnet_mkepair) 807 808 ifconfig ${bridge} up 809 810 ifconfig ${srv}a up 811 ifconfig ${bridge} addm ${srv}a 812 ifconfig ${one}a up 813 ifconfig ${bridge} addm ${one}a 814 ifconfig ${two}a up 815 ifconfig ${bridge} addm ${two}a 816 817 vnet_mkjail srv ${srv}b ${lan}a 818 jexec srv ifconfig lo0 inet 127.0.0.1/8 up 819 jexec srv ifconfig ${srv}b 192.0.2.1/24 up 820 jexec srv ifconfig ${lan}a 203.0.113.1/24 up 821 vnet_mkjail lan ${lan}b 822 jexec lan ifconfig lo0 inet 127.0.0.1/8 up 823 jexec lan ifconfig ${lan}b 203.0.113.2/24 up 824 jexec lan route add default 203.0.113.1 825 vnet_mkjail one ${one}b 826 jexec one ifconfig lo0 inet 127.0.0.1/8 up 827 jexec one ifconfig ${one}b 192.0.2.2/24 up 828 vnet_mkjail two ${two}b 829 jexec two ifconfig lo0 inet 127.0.0.1/8 up 830 jexec two ifconfig ${two}b 192.0.2.3/24 up 831 832 # Sanity checks 833 atf_check -s exit:0 -o ignore jexec one ping -c 1 192.0.2.1 834 atf_check -s exit:0 -o ignore jexec two ping -c 1 192.0.2.1 835 atf_check -s exit:0 -o ignore jexec srv ping -c 1 203.0.113.2 836 837 jexec srv sysctl net.inet.ip.forwarding=1 838 839 ovpn_start srv " 840 dev ovpn0 841 dev-type tun 842 proto udp4 843 844 cipher AES-256-GCM 845 auth SHA256 846 847 local 192.0.2.1 848 server 198.51.100.0 255.255.255.0 849 850 push \"route 203.0.113.0 255.255.255.0\" 851 852 ca $(atf_get_srcdir)/ca.crt 853 cert $(atf_get_srcdir)/server.crt 854 key $(atf_get_srcdir)/server.key 855 dh $(atf_get_srcdir)/dh.pem 856 857 mode server 858 duplicate-cn 859 script-security 2 860 auth-user-pass-verify /usr/bin/true via-env 861 topology subnet 862 863 keepalive 100 600 864 " 865 ovpn_start one " 866 dev tun0 867 dev-type tun 868 869 client 870 871 remote 192.0.2.1 872 auth-user-pass $(atf_get_srcdir)/user.pass 873 874 ca $(atf_get_srcdir)/ca.crt 875 cert $(atf_get_srcdir)/client.crt 876 key $(atf_get_srcdir)/client.key 877 dh $(atf_get_srcdir)/dh.pem 878 879 keepalive 100 600 880 " 881 sleep 2 882 ovpn_start two " 883 dev tun0 884 dev-type tun 885 886 client 887 888 remote 192.0.2.1 889 auth-user-pass $(atf_get_srcdir)/user.pass 890 891 ca $(atf_get_srcdir)/ca.crt 892 cert $(atf_get_srcdir)/client2.crt 893 key $(atf_get_srcdir)/client2.key 894 dh $(atf_get_srcdir)/dh.pem 895 896 keepalive 100 600 897 " 898 899 # Give the tunnel time to come up 900 sleep 10 901 902 atf_check -s exit:0 -o ignore jexec one ping -c 1 198.51.100.1 903 atf_check -s exit:0 -o ignore jexec two ping -c 1 198.51.100.1 904 905 # Client-to-client communication 906 atf_check -s exit:0 -o ignore jexec one ping -c 1 198.51.100.3 907 atf_check -s exit:0 -o ignore jexec one ping -c 1 198.51.100.2 908 atf_check -s exit:0 -o ignore jexec two ping -c 1 198.51.100.2 909 atf_check -s exit:0 -o ignore jexec two ping -c 1 198.51.100.3 910 911 # RA test 912 atf_check -s exit:0 -o ignore jexec one ping -c 1 203.0.113.1 913 atf_check -s exit:0 -o ignore jexec two ping -c 1 203.0.113.1 914 915 atf_check -s exit:0 -o ignore jexec srv ping -c 1 -S 203.0.113.1 198.51.100.2 916 atf_check -s exit:0 -o ignore jexec srv ping -c 1 -S 203.0.113.1 198.51.100.3 917 918 atf_check -s exit:0 -o ignore jexec one ping -c 1 203.0.113.2 919 atf_check -s exit:0 -o ignore jexec two ping -c 1 203.0.113.2 920 921 atf_check -s exit:0 -o ignore jexec lan ping -c 1 198.51.100.1 922 atf_check -s exit:0 -o ignore jexec lan ping -c 1 198.51.100.2 923 atf_check -s exit:0 -o ignore jexec lan ping -c 1 198.51.100.3 924 atf_check -s exit:2 -o ignore jexec lan ping -c 1 198.51.100.4 925} 926 927ra_cleanup() 928{ 929 ovpn_cleanup 930} 931 932ovpn_algo_body() 933{ 934 algo=$1 935 936 ovpn_init 937 938 l=$(vnet_mkepair) 939 940 vnet_mkjail a ${l}a 941 jexec a ifconfig ${l}a 192.0.2.1/24 up 942 vnet_mkjail b ${l}b 943 jexec b ifconfig ${l}b 192.0.2.2/24 up 944 945 # Sanity check 946 atf_check -s exit:0 -o ignore jexec a ping -c 1 192.0.2.2 947 948 ovpn_start a " 949 dev ovpn0 950 dev-type tun 951 proto udp4 952 953 cipher ${algo} 954 data-ciphers ${algo} 955 auth SHA256 956 957 local 192.0.2.1 958 server 198.51.100.0 255.255.255.0 959 ca $(atf_get_srcdir)/ca.crt 960 cert $(atf_get_srcdir)/server.crt 961 key $(atf_get_srcdir)/server.key 962 dh $(atf_get_srcdir)/dh.pem 963 964 mode server 965 script-security 2 966 auth-user-pass-verify /usr/bin/true via-env 967 topology subnet 968 969 keepalive 100 600 970 " 971 ovpn_start b " 972 dev tun0 973 dev-type tun 974 975 client 976 977 cipher ${algo} 978 data-ciphers ${algo} 979 980 remote 192.0.2.1 981 auth-user-pass $(atf_get_srcdir)/user.pass 982 983 ca $(atf_get_srcdir)/ca.crt 984 cert $(atf_get_srcdir)/client.crt 985 key $(atf_get_srcdir)/client.key 986 dh $(atf_get_srcdir)/dh.pem 987 988 keepalive 100 600 989 " 990 991 # Give the tunnel time to come up 992 sleep 10 993 994 atf_check -s exit:0 -o ignore jexec b ping -c 3 198.51.100.1 995} 996 997atf_test_case "chacha" "cleanup" 998chacha_head() 999{ 1000 atf_set descr 'Test DCO with the chacha algorithm' 1001 atf_set require.user root 1002 atf_set require.progs openvpn 1003} 1004 1005chacha_body() 1006{ 1007 ovpn_algo_body CHACHA20-POLY1305 1008} 1009 1010chacha_cleanup() 1011{ 1012 ovpn_cleanup 1013} 1014 1015atf_test_case "gcm_128" "cleanup" 1016gcm_128_head() 1017{ 1018 atf_set descr 'Test DCO with AES-128-GCM' 1019 atf_set require.user root 1020 atf_set require.progs openvpn 1021} 1022 1023gcm_128_body() 1024{ 1025 ovpn_algo_body AES-128-GCM 1026} 1027 1028gcm_128_cleanup() 1029{ 1030 ovpn_cleanup 1031} 1032 1033atf_init_test_cases() 1034{ 1035 atf_add_test_case "4in4" 1036 atf_add_test_case "4mapped" 1037 atf_add_test_case "6in4" 1038 atf_add_test_case "6in6" 1039 atf_add_test_case "4in6" 1040 atf_add_test_case "timeout_client" 1041 atf_add_test_case "explicit_exit" 1042 atf_add_test_case "multi_client" 1043 atf_add_test_case "route_to" 1044 atf_add_test_case "ra" 1045 atf_add_test_case "chacha" 1046 atf_add_test_case "gcm_128" 1047} 1048