selftests/net/xfrm_policy.sh

23 ret=0
26 KEY_SHA=0xdeadbeef1234567890abcdefabcdefabcdefabcd
27 KEY_AES=0x0123456789abcdef0123456789012345
28 SPI1=0x1
29 SPI2=0x2
32     local ns=$1
39 …ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tu…
41 …ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tu…
45     local ns=$1
53 …ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in  enc aes $KEY_AES  auth sha1 …
54 …ip -net $ns xfrm state add src $me  dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 …
56     do_esp_policy $ns $me $remote $lnet $rnet
73     local ns=$1
76     ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
79     ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
82     ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
108     ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
113 …ip -net $ns xfrm policy add src 10.253.1.$((RANDOM%255))/$p dst 10.254.1.$((RANDOM%255))/$p dir fw…
119     local ns=$1
123     ip -net $ns xfrm policy get src $lnet dst $rnet dir out > /dev/null
124     if [ $? -ne 0 ] && [ $policy_checks_ok -eq 1 ] ;then
125         policy_checks_ok=0
126         echo "FAIL: ip -net $ns xfrm policy get src $lnet dst $rnet dir out"
130     ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd > /dev/null
131     if [ $? -ne 0 ] && [ $policy_checks_ok -eq 1 ] ;then
132         policy_checks_ok=0
133         echo "FAIL: ip -net $ns xfrm policy get src $rnet dst $lnet dir fwd"
139     local ns=$1
146     ip -net $ns xfrm policy add dst $plain dir out priority 10 action allow
149 …ip -net $ns xfrm policy add dst $encryptip dir out tmpl src $me dst $remote proto esp mode tunnel …
154     local ns=$1
158       echo netns exec $ns ip xfrm policy add src 0.0.0.0/0 dst 10.$i.99.0/30 dir out action block
159       echo netns exec $ns ip xfrm policy add src 10.$i.99.0/30 dst 0.0.0.0/0 dir out action block
161 …     echo netns exec $ns ip xfrm policy add src 10.$i.1.0/30 dst 10.$i.$j.0/30 dir out action block
163 …     echo netns exec $ns ip xfrm policy add src 10.$i.1.0/29 dst 10.$i.$j.0/29 dir out action block
165 …     echo netns exec $ns ip xfrm policy add src 10.$i.1.0/24 dst 10.$i.$j.0/24 dir out action block
166 …     echo netns exec $ns ip xfrm policy add src 10.$i.$j.0/24 dst 10.$i.1.0/24 dir fwd action block
172     local ns=$1
176 …   echo netns exec $ns ip xfrm policy add src dead:$i::/64 dst dead:$i:$j::/64 dir out action block
177 …   echo netns exec $ns ip xfrm policy add src dead:$i:$j::/64 dst dead:$i::/24 dir fwd action block
184 	ns=$1
186 	ip netns exec $ns iptables-save -c |grep policy | ( read c rest
187 		ip netns exec $ns iptables -Z
188 		if [ x"$c" = x'[0:0]' ]; then
189 			exit 0
201 	# 0: iptables -m policy rule count == 0
202 	# 1: iptables -m policy rule count != 0
205 	local lret=0
235 	local lret=0
238 	check_xfrm 0 254
239 	if [ $? -ne 0 ]; then
248 	if [ $? -ne 0 ]; then
257 	if [ $? -ne 0 ]; then
270 	i=0
274 		ip -net ns1 xfrm policy set hthresh6 0 28 || break
277 		ip -net ns1 xfrm policy set hthresh6 0 28 || break
287 	return 0
294 	local ns=$1
298 		ip -net $ns xfrm policy flush
299 		for j in $(seq 0 16 255 | sort -R); do
300 			ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow
302 		for j in $(seq 0 16 255); do
303 			if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then
311 		ip -net $ns xfrm policy flush
312 		for j in $(seq 0 16 255 | sort -R); do
314 			ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow
316 		for j in $(seq 0 16 255); do
318 			if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then
325 	ip -net $ns xfrm policy flush
328 	return 0
332 if [ "$(id -u)" -ne 0 ];then
338 if [ $? -ne 0 ];then
345 if [ $? -ne 0 ];then
351     ip netns add ns$i
352     ip -net ns$i link set lo up
363     ip -net ns$i link set $DEV up
364     ip -net ns$i addr add 10.0.$i.2/24 dev $DEV
365     ip -net ns$i addr add dead:$i::2/64 dev $DEV
367     ip -net ns$i addr add 10.0.$i.253 dev $DEV
368     ip -net ns$i addr add 10.0.$i.254 dev $DEV
369     ip -net ns$i addr add dead:$i::fd dev $DEV
370     ip -net ns$i addr add dead:$i::fe dev $DEV
374 ip -net ns$i link set eth1 up
375 ip -net ns$i link set veth0 up
396 		ip netns exec ns$i sysctl net.ipv$j.conf.eth1.forwarding=1 > /dev/null
397 		ip netns exec ns$i sysctl net.ipv$j.conf.veth0.forwarding=1 > /dev/null
404 if [ $? -ne 0 ];then
406 	for i in 1 2 3 4;do ip netns del ns$i;done
426 if [ $? -ne 0 ]; then
442 if [ $? -ne 0 ]; then
450 if [ $? -ne 0 ]; then
484 for i in 1 2 3 4;do ip netns del ns$i;done