From nobody Wed Mar 01 15:10:51 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PRd3H4TRhz3tySq; Wed, 1 Mar 2023 15:10:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PRd3H3s1Jz3NHY; Wed, 1 Mar 2023 15:10:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1677683451; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=725g8bxL8lofX/4HGc2mZLYbVW9ZIIvBu0nehVuZaoI=; b=s51YOuhULvq1kFFvQEYzRGeNCHrZ7k+2Ty0gRP5sHQ1SJntyJb9gewOwp0mKsuro3VifvZ 5S4t9sQMVJPnBvjYN1Ews3AK+JgMyZNATl7YNmD8pzz6oJgBpZgfc8O94c0xudP/rJrvUI 7jHCjAOc+xHWs5tYxAusBVEVapqDOjDQlf1I5iQbSOcNZ5IzHeJLnyV1mIahRXFcUdnajF 5Bosw7hnKOCpn9skIXSeV869Y0mdCzIaQ/csYl5Qa/MCxqzU39harPWXazVx0m/JN2IFZ9 a/ySqg0ASRFo+xdMCMZbol4NtaEkEd/aRkM2b+9ZWx0D8+K74G1A4fP9BBoSSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1677683451; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=725g8bxL8lofX/4HGc2mZLYbVW9ZIIvBu0nehVuZaoI=; b=jgShVVDD4nbHqTvGgSHbvDA356nTk0Pcs9ZFAX+zHbPPnrggKrav4+GhZSG94xJRI7C1TW xPacpFY8qu7rRKJ1njNz3HgMvSkI1cTDy7FUVDvUEBePQX8G/jL9sXoxaJXJ9czVSw5NFU EOvRml+WjBfydFJFNW4p5OFdSU0T3/nBZTma0VPjfGUQy/9KY6rl4rdFximryN0F+cwBbW GD+Fv9Ny+uu28dK8ksFRSKnNmN/JnTh8/+wZgtbof7lvwbwTFCNOT/bE9URixwzKgqPGxA yyXnjIvhbCdHh92jvhaedq1njq3rRrYE22HwAgzHi2tq/7V2yj4+2FoLPuN+QA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1677683451; a=rsa-sha256; cv=none; b=jWyZrfyoCj28flytBRZUZ703kK++DU0TuTJhlBViykJ4SnClckHoyUzC8MyMKSa/Q4O0nV bxMjNGnalNPel7OhHJfn/19BjhciL9zeXzJIasHwH7Lep8hJ0IlaITTU3HiAJ5VCgGPIce 7rP8ruj+IvwzibIiaO4d6stRABevuOM/cgCapv2sn10+cCMLWKWRbIAnrsd9zTr66mHCpg vHw9vmqbnUlLhsh2xMpP5alxNBEHVxKWvOgOOxh6ca2zut3jArsuNtXcsdsjMaIjevQ5KX F0e2yPKYDV/pATUJ7gkr4AerFzNi6cW5UbUf5TaiIspKy0lMofRNck9uIbwIHA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PRd3H2vbNzf46; Wed, 1 Mar 2023 15:10:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 321FApLN064146; Wed, 1 Mar 2023 15:10:51 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 321FAp63064145; Wed, 1 Mar 2023 15:10:51 GMT (envelope-from git) Date: Wed, 1 Mar 2023 15:10:51 GMT Message-Id: <202303011510.321FAp63064145@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 2a02d3dad391 - main - pf tests: test pfsync over IPSec List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 2a02d3dad391694516c82e6b7359bcac7d0327d0 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=2a02d3dad391694516c82e6b7359bcac7d0327d0 commit 2a02d3dad391694516c82e6b7359bcac7d0327d0 Author: Kristof Provost AuthorDate: 2023-03-01 13:02:15 +0000 Commit: Kristof Provost CommitDate: 2023-03-01 15:10:12 +0000 pf tests: test pfsync over IPSec Test that we can transport pfsync (unicast) over IPSec. Sponsored by: Rubicon Communications, LLC ("Netgate") --- tests/sys/netpfil/pf/pfsync.sh | 82 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/tests/sys/netpfil/pf/pfsync.sh b/tests/sys/netpfil/pf/pfsync.sh index 7b8268216734..3871d6be8e14 100644 --- a/tests/sys/netpfil/pf/pfsync.sh +++ b/tests/sys/netpfil/pf/pfsync.sh @@ -588,6 +588,87 @@ pbr_common_cleanup() pft_cleanup } +atf_test_case "ipsec" "cleanup" +ipsec_head() +{ + atf_set descr 'Transport pfsync over IPSec' + atf_set require.user root +} + +ipsec_body() +{ + if ! sysctl -q kern.features.ipsec >/dev/null ; then + atf_skip "This test requires ipsec" + fi + + # Run the common test, to set up pfsync + common_body + + # But we want unicast pfsync + jexec one ifconfig pfsync0 syncpeer 192.0.2.2 + jexec two ifconfig pfsync0 syncpeer 192.0.2.1 + + # Flush existing states + jexec one pfctl -Fs + jexec two pfctl -Fs + + # Now define an ipsec policy to run over the epair_sync interfaces + echo "flush; + spdflush; + spdadd 192.0.2.1/32 192.0.2.2/32 any -P out ipsec esp/transport//require; + spdadd 192.0.2.2/32 192.0.2.1/32 any -P in ipsec esp/transport//require; + add 192.0.2.1 192.0.2.2 esp 0x1000 -E aes-gcm-16 \"12345678901234567890\"; + add 192.0.2.2 192.0.2.1 esp 0x1001 -E aes-gcm-16 \"12345678901234567890\";" \ + | jexec one setkey -c + + echo "flush; + spdflush; + spdadd 192.0.2.2/32 192.0.2.1/32 any -P out ipsec esp/transport//require; + spdadd 192.0.2.1/32 192.0.2.2/32 any -P in ipsec esp/transport//require; + add 192.0.2.1 192.0.2.2 esp 0x1000 -E aes-gcm-16 \"12345678901234567891\"; + add 192.0.2.2 192.0.2.1 esp 0x1001 -E aes-gcm-16 \"12345678901234567891\";" \ + | jexec two setkey -c + + # We've set incompatible keys, so pfsync will be broken. + ping -c 1 -S 198.51.100.254 198.51.100.1 + + # Give pfsync time to do its thing + sleep 2 + + if jexec two pfctl -s states | grep icmp | grep 198.51.100.1 | \ + grep 198.51.100.2 ; then + atf_fail "state synced although IPSec should have prevented it" + fi + + # Flush existing states + jexec one pfctl -Fs + jexec two pfctl -Fs + + # Fix the IPSec key to match + echo "flush; + spdflush; + spdadd 192.0.2.2/32 192.0.2.1/32 any -P out ipsec esp/transport//require; + spdadd 192.0.2.1/32 192.0.2.2/32 any -P in ipsec esp/transport//require; + add 192.0.2.1 192.0.2.2 esp 0x1000 -E aes-gcm-16 \"12345678901234567890\"; + add 192.0.2.2 192.0.2.1 esp 0x1001 -E aes-gcm-16 \"12345678901234567890\";" \ + | jexec two setkey -c + + ping -c 1 -S 198.51.100.254 198.51.100.1 + + # Give pfsync time to do its thing + sleep 2 + + if ! jexec two pfctl -s states | grep icmp | grep 198.51.100.1 | \ + grep 198.51.100.2 ; then + atf_fail "state not found on synced host" + fi +} + +ipsec_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "basic" @@ -596,4 +677,5 @@ atf_init_test_cases() atf_add_test_case "bulk" atf_add_test_case "pbr" atf_add_test_case "pfsync_pbr" + atf_add_test_case "ipsec" }