1# $OpenBSD: Makefile,v 1.13 2020/07/21 13:45:13 tobhe Exp $ 2 3# Copyright (c) 2020 Tobias Heider <tobhe@openbsd.org> 4# 5# Permission to use, copy, modify, and distribute this software for any 6# purpose with or without fee is hereby granted, provided that the above 7# copyright notice and this permission notice appear in all copies. 8# 9# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17REGRESS_SETUP_ONCE = setup 18REGRESS_CLEANUP = cleanup 19CLEANFILES = *.conf *.cnf *.csr *.key *.crt *.srl 20 21LEFT_SSH ?= 22RIGHT_SSH ?= 23LEFT_ADDR ?= 24RIGHT_ADDR ?= 25 26.if empty(LEFT_SSH) || empty(RIGHT_SSH) || empty(LEFT_ADDR) || empty(RIGHT_ADDR) 27regress: 28 @echo this test needs two remote machines to operate 29 @echo LEFT_SSH RIGHT_SSH RIGHT_ADDR LEFT_ADDR are not defined 30 @echo SKIPPED 31.endif 32 33TEST_FLOWS = \ 34 [ -z $$tmode ] && tmode=tunnel; \ 35 success=false; \ 36 count=0; \ 37 while [[ $$count -le 3 ]]; do \ 38 ipsecctlleft=`ssh ${LEFT_SSH} ipsecctl -sa`; \ 39 ipsecctlright=`ssh ${RIGHT_SSH} ipsecctl -sa`; \ 40 flowleft=`echo "$$ipsecctlleft" \ 41 | sed -n "/^flow $$flowtype in from ${RIGHT_ADDR} to ${LEFT_ADDR}/p"`; \ 42 flowright=`echo "$$ipsecctlright" \ 43 | sed -n "/^flow $$flowtype in from ${LEFT_ADDR} to ${RIGHT_ADDR}/p"`; \ 44 saleft_rtol=`echo "$$ipsecctlleft" \ 45 | sed -n "/^$$flowtype $$tmode from ${RIGHT_ADDR} to ${LEFT_ADDR}/p"`; \ 46 saleft_ltor=`echo "$$ipsecctlleft" \ 47 | sed -n "/^$$flowtype $$tmode from ${LEFT_ADDR} to ${RIGHT_ADDR}/p"`; \ 48 saright_rtol=`echo "$$ipsecctlright" \ 49 | sed -n "/^$$flowtype $$tmode from ${RIGHT_ADDR} to ${LEFT_ADDR}/p"`; \ 50 saright_ltor=`echo "$$ipsecctlright" \ 51 | sed -n "/^$$flowtype $$tmode from ${LEFT_ADDR} to ${RIGHT_ADDR}/p"`; \ 52 if [[ -n "$$saleft_ltor" && -n "$$saleft_rtol" && \ 53 -n "$$saright_ltor" && -n "$$saright_rtol" && \ 54 -n "$$flowleft" && -n "$$flowright" ]]; then \ 55 success=true; \ 56 break; \ 57 fi; \ 58 let count=$$count+1; \ 59 done; \ 60 if [[ "$$success" = false ]]; then \ 61 echo "error: SAs not found:\n$$ipsecctlleft\n$$ipsecctlright"; \ 62 exit 1; \ 63 fi 64 65TEST_PING = \ 66 if [[ "${IPV}" == "6" ]]; then ping="ping6"; else ping="ping"; fi; \ 67 dump=`ssh ${LEFT_SSH} "tcpdump -n -c2 -i enc0 -w '/tmp/test.pcap' > /dev/null & \ 68 $$ping -c 5 ${RIGHT_ADDR} > /dev/null && tcpdump -n -r /tmp/test.pcap" && rm -f /tmp/test.pcap`; \ 69 rtol=`echo "$$dump" \ 70 | sed -n "/(authentic,confidential): SPI 0x[0-9a-f]\{8\}: ${LEFT_ADDR} > ${RIGHT_ADDR}/p"`; \ 71 ltor=`echo "$$dump" \ 72 | sed -n "/(authentic,confidential): SPI 0x[0-9a-f]\{8\}: ${RIGHT_ADDR} > ${LEFT_ADDR}/p"`; \ 73 if [[ -z "$$rtol" || -z "$$ltor" ]]; then \ 74 echo "error: no esp traffic."; \ 75 exit 1; \ 76 fi; \ 77 echo "$$dump" 78 79SETUP_CONFIGS = \ 80 authstr=""; \ 81 if [[ "$$auth" = "psk" ]]; then \ 82 psk=`openssl rand -hex 20`; \ 83 authstr="psk $$psk"; \ 84 fi; \ 85 ipcomp=""; \ 86 if [[ "$$flowtype" = "ipcomp" ]]; then \ 87 ipcomp="ipcomp"; \ 88 fi; \ 89 fragstr=""; \ 90 if [ "$$fragmentation" = true ]; then \ 91 fragstr="set fragmentation"; \ 92 fi; \ 93 echo "FRAGMENTATION=\"$$fragstr\"" > $@_left.conf; \ 94 echo "TMODE=\"$$tmode\"" >> $@_left.conf; \ 95 echo "LOCAL_ADDR=\"${LEFT_ADDR}\"" >> $@_left.conf; \ 96 echo "PEER_ADDR=\"${RIGHT_ADDR}\"" >> $@_left.conf; \ 97 echo "IPCOMP=\"$$ipcomp\"" >> $@_left.conf; \ 98 echo "SRCID=\"$$leftid\"" >> $@_left.conf; \ 99 echo "AUTH=\"$$authstr\"" >> $@_left.conf; \ 100 cat ${.CURDIR}/iked.in >> $@_left.conf; \ 101 chmod 0600 $@_left.conf; \ 102 echo "cd /tmp\nput $@_left.conf test.conf" | sftp -q ${LEFT_SSH}; \ 103 echo "FRAGMENTATION=\"$$fragstr\"" > $@_right.conf; \ 104 echo "TMODE=\"$$tmode\"" >> $@_right.conf; \ 105 echo "LOCAL_ADDR=\"${RIGHT_ADDR}\"" >> $@_right.conf; \ 106 echo "PEER_ADDR=\"${LEFT_ADDR}\"" >> $@_right.conf; \ 107 echo "IPCOMP=\"$$ipcomp\"" >> $@_right.conf; \ 108 echo "SRCID=\"$$rightid\"" >> $@_right.conf; \ 109 echo "AUTH=\"$$authstr\"" >> $@_right.conf; \ 110 cat ${.CURDIR}/iked.in >> $@_right.conf; \ 111 chmod 0600 $@_right.conf; \ 112 echo "cd /tmp\nput $@_right.conf test.conf" | sftp -q ${RIGHT_SSH} 113 114SETUP_SYSCTL = \ 115 ssh ${LEFT_SSH} "sysctl $$sysctl"; \ 116 ssh ${RIGHT_SSH} "sysctl $$sysctl" 117 118SETUP_START = \ 119 ssh ${LEFT_SSH} "ipsecctl -F; pkill iked; iked $$iked_flags -f /tmp/test.conf"; \ 120 ssh ${RIGHT_SSH} "ipsecctl -F; pkill iked; iked $$iked_flags -f /tmp/test.conf" 121 122SETUP_CERT = \ 123 echo "ALTNAME = $$name-from-$$caname" > $$name-from-$$caname.cnf; \ 124 cat ${.CURDIR}/crt.in >> $$name-from-$$caname.cnf; \ 125 openssl req -config $$name-from-$$caname.cnf -new -key $$name.key -nodes \ 126 -out $$name-from-$$caname.csr; \ 127 openssl x509 -extfile $$name-from-$$caname.cnf -extensions req_cert_extensions \ 128 -req -in $$name-from-$$caname.csr -CA $$caname.crt -CAkey $$caname.key \ 129 -CAcreateserial -out $$name-from-$$caname.crt 130 131SETUP_CA = \ 132 openssl genrsa -out $$caname.key 2048; \ 133 openssl req -subj "/C=DE/ST=Bavaria/L=Munich/O=iked/CN=$$caname" \ 134 -new -x509 -key $$caname.key -out $$caname.crt 135 136cleanup: 137 -ssh ${LEFT_SSH} 'rm -f /tmp/test.conf; ipsecctl -F; pkill iked; \ 138 rm -f /etc/iked/ca/*; rm -f /etc/iked/certs/*; rm -f /etc/iked/private/*; \ 139 sysctl "net.inet.esp.udpencap_port=4500"; \ 140 rm -f /tmp/pf.conf; pfctl -d; pfctl -f /etc/pf.conf;' 141 -ssh ${RIGHT_SSH} 'rm -f /tmp/test.conf; ipsecctl -F; pkill iked; \ 142 rm -f /etc/iked/ca/*; rm -f /etc/iked/certs/*; rm -f /etc/iked/private/*; \ 143 sysctl "net.inet.esp.udpencap_port=4500"; \ 144 rm -f /tmp/pf.conf; pfctl -d; pfctl -f /etc/pf.conf;' 145 146setup_certs: ca-both.crt left-from-ca-both.crt left.key right-from-ca-both.crt \ 147 right.key ca-left.crt right-from-ca-left.crt ca-right.crt left-from-ca-right.crt 148 echo "cd /etc/iked\n \ 149 put left-from-ca-both.crt certs\n \ 150 put left-from-ca-right.crt certs\n \ 151 put left.key private/local.key\n \ 152 put ca-left.crt ca\n \ 153 put ca-both.crt ca\n" | sftp ${LEFT_SSH} -q; \ 154 echo "cd /etc/iked\n \ 155 put right-from-ca-both.crt certs\n \ 156 put right-from-ca-left.crt certs\n \ 157 put right.key private/local.key\n \ 158 put ca-right.crt ca\n \ 159 put ca-both.crt ca\n" | sftp ${RIGHT_SSH} -q; \ 160 ssh ${LEFT_SSH} "openssl rsa -in /etc/iked/private/local.key -pubout > /etc/iked/local.pub"; \ 161 ssh ${RIGHT_SSH} "openssl rsa -in /etc/iked/private/local.key -pubout > /etc/iked/local.pub" 162 163setup_pf: pf.in 164 echo "cd /tmp\nput ${.CURDIR}/pf.in pf.conf" | sftp -q ${LEFT_SSH} 165 echo "cd /tmp\nput ${.CURDIR}/pf.in pf.conf" | sftp -q ${RIGHT_SSH} 166 -ssh ${LEFT_SSH} "pfctl -f /tmp/pf.conf; pfctl -e" 167 -ssh ${RIGHT_SSH} "pfctl -f /tmp/pf.conf; pfctl -e" 168 169setup: setup_pf setup_certs 170 171.PHONY: setup_certs 172 173test_flows: 174 ${TEST_FLOWS} 175 176left.key right.key: 177 openssl genrsa -out $@ 2048 178 179ca-both.crt ca-both.key: 180 caname=ca-both; ${SETUP_CA} 181 182left-from-ca-both.crt: ca-both.crt ca-both.key left.key 183 caname=ca-both; name=left; ${SETUP_CERT} 184 185right-from-ca-both.crt: ca-both.crt ca-both.key right.key 186 caname=ca-both; name=right; ${SETUP_CERT} 187 188ca-left.crt ca-left.key: 189 caname=ca-left; ${SETUP_CA} 190 191right-from-ca-left.crt right.key: ca-left.crt ca-left.key 192 caname=ca-left; name=right; ${SETUP_CERT} 193 194ca-right.crt ca-right.key: 195 caname=ca-right; ${SETUP_CA} 196 197left-from-ca-right.crt left.key: ca-right.crt ca-right.key 198 caname=ca-right; name=left; ${SETUP_CERT} 199 200REGRESS_TARGETS = run-cert-single-ca 201run-cert-single-ca: 202 @echo '======= $@ ========' 203 flowtype=esp; 204 leftid=left-from-ca-both; \ 205 rightid=right-from-ca-both; \ 206 ${SETUP_CONFIGS} 207 ${SETUP_START} 208 flowtype=esp; ${TEST_FLOWS} 209 ${TEST_PING} 210 211REGRESS_TARGETS += run-cert-multi-ca 212run-cert-multi-ca: 213 @echo '======= $@ ========' 214 flowtype=esp; \ 215 leftid=left-from-ca-right; \ 216 rightid=right-from-ca-left; \ 217 ${SETUP_CONFIGS} 218 ${SETUP_START} 219 flowtype=esp; ${TEST_FLOWS} 220 ${TEST_PING} 221 222REGRESS_TARGETS += run-cert-second-altname 223run-cert-second-altname: 224 @echo '======= $@ ========' 225 flowtype=esp; 226 leftid=left-from-ca-both-alternative; \ 227 rightid=right-from-ca-both@openbsd.org; \ 228 ${SETUP_CONFIGS} 229 ${SETUP_START} 230 flowtype=esp; ${TEST_FLOWS} 231 ${TEST_PING} 232 233REGRESS_TARGETS += run-psk 234run-psk: 235 @echo '======= $@ ========' 236 auth=psk; \ 237 leftid=left; \ 238 rightid=right; \ 239 flowtype=esp; \ 240 ${SETUP_CONFIGS} 241 ${SETUP_START} 242 flowtype=esp; ${TEST_FLOWS} 243 ${TEST_PING} 244 245REGRESS_TARGETS += run-fragmentation 246run-fragmentation: 247 @echo '======= $@ ========' 248 flowtype=esp; \ 249 fragmentation=true; \ 250 leftid=left-from-ca-both; \ 251 rightid=right-from-ca-both; \ 252 ${SETUP_CONFIGS} 253 ${SETUP_START} 254 flowtype=esp; ${TEST_FLOWS} 255 ${TEST_PING} 256 257REGRESS_TARGETS += run-transport 258run-transport: 259 @echo '======= $@ ========' 260 flowtype=esp; \ 261 tmode=transport; \ 262 leftid=left-from-ca-both; \ 263 rightid=right-from-ca-both; \ 264 ${SETUP_CONFIGS} 265 ${SETUP_START} 266 tmode=transport; flowtype=esp; \ 267 ${TEST_FLOWS} 268 ${TEST_PING} 269 270REGRESS_TARGETS += run-ipcomp 271run-ipcomp: 272 @echo '======= $@ ========' 273 flowtype=ipcomp; \ 274 leftid=left-from-ca-both; \ 275 rightid=right-from-ca-both; \ 276 ${SETUP_CONFIGS} 277 sysctl="net.inet.ipcomp.enable=1"; \ 278 ${SETUP_SYSCTL} 279 ${SETUP_START} 280 flowtype=ipcomp; ${TEST_FLOWS} 281 ${TEST_PING} 282 283REGRESS_TARGETS += run-udpencap-port 284run-udpencap-port: 285 @echo '======= $@ ========' 286 flowtype=esp; \ 287 leftid=left-from-ca-both; \ 288 rightid=right-from-ca-both; \ 289 ${SETUP_CONFIGS}; \ 290 sysctl="net.inet.esp.udpencap_port=9999"; \ 291 ${SETUP_SYSCTL}; 292 iked_flags=-p9999; \ 293 ${SETUP_START}; 294 flowtype=esp; ${TEST_FLOWS}; \ 295 ${TEST_PING} 296 sysctl="net.inet.esp.udpencap_port=4500"; \ 297 ${SETUP_SYSCTL}; 298 299.include <bsd.regress.mk> 300